> For the complete documentation index, see [llms.txt](https://pikachuuu1436.gitbook.io/re_fun/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pikachuuu1436.gitbook.io/re_fun/ctf-challenges/grey-cat-the-flag-2022/runtime-environment.md).

# Runtime Environment

### Challenge Description

GO and try to solve this basic challenge.

FAQ: If you found the input leading to the challenge.txt you are on the right track

MD5 (gogogo.tar.gz) = 5515f1c3eee00e4042bf7aba84bbec5c

* rootkid

### Challenge Details

In this challenge, we are given a binary and an encoded file:

```
GvVf+fHWz1tlOkHXUk3kz3bqh4UcFFwgDJmUDWxdDTTGzklgIJ+fXfHUh739+BUEbrmMzGoQOyDIFIz4GvTw+j--
```

The challenge was evidently written in go as deduced from the challenge description and confirmed when running `file` on it which shows it GO build id:

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2F6NOY9J08FTCotIZjbiQp%2Fimage.png?alt=media\&token=70b3f28a-08a3-44c6-bbcd-d7ea98537617)

For this challenge, I used a set of IDA plugns found in this github repository which helps me identify go library functions and user-defined functions: 

<https://github.com/sibears/IDAGolangHelper>

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FyLURh1O9Ja3QSMNFCDKH%2Fimage.png?alt=media\&token=40173fc1-f0a9-43e2-b566-50a6a62732ac)

Upon running, the binary takes input from the user and prints out the encoded string:

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FPeu3RIMAbP4StLdK8Of5%2Fimage.png?alt=media\&token=7c289c91-899d-410c-88fa-d923c1809ea8)

Upon running it a few times with similar input as shown above, I realised that it feels like a base64 encoded string however, a normal base64 encoder says otherwise:

![pAin](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FKDkPXjqipExSKnp2IbaS%2Fimage.png?alt=media\&token=b5a66e3d-5908-4b73-9c7e-d519fd413787)

So i decided to look at the encoding function for the binary and found a 64 characters long string that have no repeating characters and a while loop that runs for 3 times and does it a final time after the loop:&#x20;

![The custom base 64 string](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FUS0kGy5QacHntKF5c2au%2Fimage.png?alt=media\&token=754ae93a-f181-42db-9c85-0f2abb67e860)

![While loop containing base64 operations](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FoznCgZ6X4FqbhPQmR5iI%2Fimage.png?alt=media\&token=94409983-931e-4951-8596-d101680f3124)

![Code after loop which is simply the same function](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2F2fsavy2PmOUsOJViKjxY%2Fimage.png?alt=media\&token=13b5b28b-842b-4e0c-a9ec-4604be1882a7)

This means that the challenge creator used a  custom base64 string :`NaRvJT1B/m6AOXL9VDFIbUGkC+sSnzh5jxQ273d4lHPg0wcEpYqruWyfZoM8itKe` and `-` as the padding and ran the encoder 4 times!

### Challenge Solution

Simply put the encoded chars through a base64 decoder 4 times using the custom base64 string and padding:

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FDgPZ535vM3lhSc9IkN8I%2Fimage.png?alt=media\&token=4bec00f3-9d56-49fb-aa06-8b5a123db8b6)

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FAHoEgzMwqOoRGRJf2EQt%2Fimage.png?alt=media\&token=853840cc-414c-441c-8050-24ff17d9bc21)

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FZc1SM1B2xpt5cPOIBQNc%2Fimage.png?alt=media\&token=ec84bf1c-9d21-410c-964a-454ed1cabf68)

![](https://328607669-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FdGNpbZRd2MxlpSieDi2n%2Fuploads%2FKokxCHN70eIg4WwolKXk%2Fimage.png?alt=media\&token=c04db95e-e57a-4b14-8826-1561da4717be)

Flag: grey{B4s3d\_G0Ph3r\_r333333}