Ghidra
Ghidra turns the binary into readable C pseudocode. On HTB it shows up with custom SUID binaries, Go or .NET services and pwn challenges: look for main, interesting strings and calls to system, strcpy or gets.
- Platform
- Linux · Windows · macOS (Java)
- Official site
- ghidra-sre.org
- On HTB
- 9 machines
Install
sudo apt install ghidraGhidra cheat sheet
Triage before opening Ghidra
What the file is
file ./binario
Readable strings
strings -n 8 ./binario | less
Binary protections
checksec --file=./binario
Library and system calls at runtime
ltrace ./binario
strace -f ./binarioNo command matches.
HTB machines where Ghidra is used
Taken from the chapters of IppSec videos where Ghidra shows up. The ▶ link jumps to the minute of that part.