Ziggarettes

Don’t smoke zigarettes, kids!

We’re given an ELF binary. I decompiled with Dogbolt and examined the Ghidra code. Here’s the relevant part:

1
  do {
2
    if (uVar8 == 0x23) goto LAB_00202664;
3
    if (uVar8 < 0x23) {
4
      cVar1 = *(char *)((long)&local_58 + uVar8);
5
      switch(uVar8) {
6
      case 0:
7
      case 0x20:
8
        if (cVar1 != 'p') goto LAB_00202677;
9
        break;
10
      case 1:
11
        if (cVar1 != 'i') {
12
LAB_00202677:
13
          uVar12 = 7;
14
          pcVar16 = "Wrong!\n";
15
          do {
16
            local_78[0] = 1;
17
            sVar4 = FUN_00202714(local_78,pcVar16,uVar12);
18
            if (sVar4 != 0) {
19
LAB_002025e0:
20
              uVar12 = *(undefined8 *)(&DAT_002006c8 + (long)sVar4 * 0x10);
21
              uVar3 = *(undefined8 *)(&DAT_002006d0 + (long)sVar4 * 0x10);
22
              local_70[0] = 2;
23
              FUN_0020284a(&DAT_00207104);
24
              local_78[0] = 2;
25
              sVar4 = FUN_00202714(local_78,"error: {s}\n",7);
26
              if ((sVar4 == 0) &&
27
                 (sVar4 = FUN_0020291a(uVar12,uVar3,&DAT_002006a0,local_70), sVar4 == 0)) {
28
                local_58 = CONCAT44(local_58._4_4_,2);
29
                FUN_00202714(&local_58,"\n",1);
30
              }
31
              FUN_00202888(&DAT_00207104);
32
            }
33
            syscall();
34
LAB_00202664:
35
            uVar12 = 9;
36
            pcVar16 = "Correct!\n";
37
          } while( true );
38
        }
39
        break;
40
      case 2:
41
        if (cVar1 != 'n') goto LAB_00202677;
42
        break;
43
      case 3:
44
        if (cVar1 != 'g') goto LAB_00202677;
45
        break;
46
      case 4:
47
        if (cVar1 != '{') goto LAB_00202677;
48
        break;
49
      case 5:
50
        if (cVar1 != 'z') goto LAB_00202677;
51
        break;
52
      case 6:
53
      case 9:
54
        if (cVar1 != '1') goto LAB_00202677;
55
        break;
56
      case 7:
57
        if (cVar1 != 'G') goto LAB_00202677;
58
        break;
59
      default:
60
        if (cVar1 != '_') goto LAB_00202677;
61
        break;
62
      case 10:
63
        if (cVar1 != 'S') goto LAB_00202677;
64
        break;
65
      case 0xc:
66
        if (cVar1 != 'v') goto LAB_00202677;
67
        break;
68
      case 0xd:
69
      case 0x17:
70
        if (cVar1 != '3') goto LAB_00202677;
71
        break;
72
      case 0xe:
73
        if (cVar1 != 'R') goto LAB_00202677;
74
        break;
75
      case 0xf:
76
        if (cVar1 != 'Y') goto LAB_00202677;
77
        break;
78
      case 0x11:
79
        if (cVar1 != 'C') goto LAB_00202677;
80
        break;
81
      case 0x12:
82
        if (cVar1 != '0') goto LAB_00202677;
83
        break;
84
      case 0x13:
85
      case 0x1e:
86
        if (cVar1 != 'O') goto LAB_00202677;
87
        break;
88
      case 0x14:
89
      case 0x21:
90
        if (cVar1 != 'l') goto LAB_00202677;
91
        break;
92
      case 0x16:
93
      case 0x1f:
94
        if (cVar1 != '2') goto LAB_00202677;
95
        break;
96
      case 0x18:
97
        if (cVar1 != '4') goto LAB_00202677;
98
        break;
99
      case 0x19:
100
        if (cVar1 != 'm') goto LAB_00202677;
101
        break;
102
      case 0x1a:
103
      case 0x1c:
104
        if (cVar1 != 'K') goto LAB_00202677;
105
        break;
106
      case 0x1b:
107
      case 0x1d:
108
        if (cVar1 != 'I') goto LAB_00202677;
109
        break;
110
      case 0x22:
111
        if (cVar1 != '}') goto LAB_00202677;
112
      }
113
    }
114
    uVar8 = uVar8 + 1;
115
  } while( true );

Seems like it’s just a switch statement checking the characters! Only thing to note is that cases that come consecutively, where one case doesn’t have a break statement before the next one, run the same code. Knowing that, brute-forcing becomes trivial:

1
0123456789abcdef0123456789abcdef0123456789abcdef
2
ping{z1G_1S_v3RY_C0Ol_234mKIKIO2pl}