15

I have a capture the flag (CTF) related question and I was wondering if someone can point me to the right direction.

I work on Mac OS X Yosemite and I was going through some war games and older capture the flag (CTF) challenges. My goal is to execute the ELF binary of the challenge "natively" into my iterm (after I scp it locally) although I realize that only MACH binaries may be executed by the underlying system.

Nevertheless, is such a thing possible through emulation perhaps (e.g. QEMU), or any other method, in order to avoid opening a whole VM just to run a binary?

1

2 Answers 2

5
+25

The answer is probably: Depends on how the ELF file was generated.

Based on this article, and this sentence:

  • A common misconception is that ELF files are just for executables...
  • We already have seen they can be used for partial pieces ...

Not all ELF files will be executed, even if you have a proper setup.

Based on this article, there is a group pf ELF files called FatELF:

  • FatELF is a file format that embeds multiple ELF binaries for different architectures into one file
  • Ship one file that works across Linux and FreeBSD

Based on this page from Apple

  • The BSD portion of the OS X kernel is derived primarily from FreeBSD

So, for Mac OS X, FatELF is the "beginning of the answer".

And finally, based on this page:

Object file converter

This utility can be used for converting object files between COFF/PE, OMF, ELF and Mach-O formats for all 32-bit and 64-bit x86 platforms. Can modify symbol names in object files. Can build, modify and convert function libraries across platforms. Can dump object files and executable files. Also includes a very good disassembler supporting the SSE4, AVX, AVX2, AVX512, FMA3, FMA4, XOP and Knights Corner instruction sets. Source code included (GPL).

You have a chance to active what you want.

PS: there is another page about XBinary, I didn't analyze it.

This document discusses XBinary, a new software that lets you add kernel-level support for executing files in arbitrary binary formats on Mac OS X

2

On its own, ELF binaries mean nothing. Few binaries run alone - You'd need supporting libraries, APIs and ABIs and other shiny things.

When running QEMU you still need most of the OS - just that its not tied as closely with the host system I suspect.

In theory if you had something like 'wine' but acting as a linux(or other *nix syle OS) -> OS X compatibility layer you could get what you want, but such a beast does not exist.

SO no, you can't run an arbitary, precompiled ELF binary on OS X

1
  • 1
    this question regards a security scenario that's rather niche in the superuser space. imagine a static binary (libs compiled into the image rather than dynamically linked) that an attacker wants to place on a target system and run (that's a basic CTF security game scenario). it won't need external libs, though your point about ABIs (eg syscalls) is a fair one. you're right in the general case, but this question is specifically not about the general case. imho it shouldn't have been moved from the security site.
    – quixotic
    Feb 12, 2017 at 0:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .