🔓 Bypass Me — picoCTF (100 pts) — Simple Writeup

In this challenge, we are given a binary file called **bypassme.bin. It asks for a password and sanitizes (filters) the input, but we are not supposed to guess the password. Instead, we must reverse engineer or debug** the program to find the real password and get the flag.

We connect using SSH:

ssh ctf-player@foggy-cliff.picoctf.net -p 61599
Password: 83dcefb7

Inside, we find the binary.

🧪 Step 1: Run the Program

When we run ./bypassme.bin, it shows a login screen:

[3 tries left] Enter password:

Whatever we type is “sanitized,” meaning it keeps only alphabet letters. So 83dcefb7 becomes dcefb.

This means: 👉 We will never be able to type the actual password normally because anything not a letter gets removed.

So we must get the password another way.

🔍 Step 2: Look Inside Using Strings

Running:

strings bypassme.bin

shows interesting function names like:

• sanitize
• decode_password
• auth_sequence

This hints that the program calculates the real password internally.

🐞 Step 3: Debug the Binary (LLDB)

We run the program inside LLDB:

lldb ./bypassme.bin

We set a breakpoint after the password-decoding function runs, then inspect memory to see what password the program calculated.

The decoded string found in memory is:

SuperSec***

That’s the real password the program checks against.

🚀 Step 4: Enter the Real Password

Now we run the program normally and enter:

SuperSecu**

The program responds:

Authenticating...
🎉 Flag: picoCTF{d3bugg3r_p0w3r_is_4w3s0m3_f*******8}

Success!

🏁 Final Flag

picoCTF{d3bugg3r_p0w3r_is_4w3s0m3_********}