GabrielL

import dbus


def iwd_stations(obj):
    for k, v in obj.items():
        if 'net.connman.iwd.Station' in v:
            yield k, v


system_bus = dbus.SystemBus()

GabrielL

# before, launch qemu-system-x86_64 stos-i386-pc.boot \
#        -serial tcp:127.0.0.1:4445,server,nowait \
#        -qmp tcp:127.0.0.1:4444,server,nowait \
#        -nographic

import sys
sys.path.append("/home/gaby/source/qemu/scripts/qmp")
import qmp
import pexpect
import time

GabrielL

Writeup net300 (ebCTF teaser 2013)

by tsuro and comawill (Stratum 0 https://stratum0.org)

Step 1: Reverse engineering

Here is what the program does:

• It opens an socket(AF_INET, SOCK_RAW, 0xfe)
• and waits with an resvmsg for incoming packets
• each packet will be 'parsed' (extracts source_addr of the packet and skips the remaining part)
• expexts the first four bytes of the payload as length of payload - 4

GabrielL

#!/bin/sh

binutils_version=2.23
gcc_version=4.7.2
gdb_version=7.5.1
newlib_version=2.0.0

export TARGET=i386-none-elf
export PREFIX=/opt/cross

GabrielL

#
# Implemented from http://web.eecs.utk.edu/~vose/Publications/random.pdf
# and http://scriptogr.am/jj/post/simulating-a-loaded-dice-in-a-constant-time
#

class AliasMethod

   def initialize(probs)
      @probability = probs
      @alias_numbers = [ -1 ] * @probability.size

GabrielL

$ dmd -c toot.d  
toot.d(6): Error: class toot.B interface function A.foo isn't implemented
toot.d(10): Error: class toot.C interface function A.foo isn't implemented
toot.d(10): Error: class toot.C interface function A.foo isn't implemented
toot.d(14): Error: class toot.D interface function A.foo isn't implemented
toot.d(10): Error: class toot.C interface function A.foo isn't implemented
toot.d(14): Error: class toot.D interface function A.foo isn't implemented

GabrielL

#include <stdarg.h>
#include <stdlib.h>
#include <syslog.h>

void log_err(const char *format, ...)
{
        va_list ap;
        va_start(ap, format);
        syslog(LOG_ERR, format, ap);
        va_end(ap);

GabrielL

#include <stdio.h>
#include <string.h>

/*
 * Split the argument by ','
 */
int main(int argc, char **argv)
{
        char *token;
        char *string = argv[1];

GabrielL

#include <err.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/mman.h>
#include <unistd.h>

#define OFFSET_PARAM    0x2
#define OFFSET_ADDR     (OFFSET_PARAM + 8 + 2)

GabrielL

CC      = gcc
CXX     = g++

CFLAGS  = `llvm-config --cflags`
LDFLAGS = `llvm-config --libs --cflags --ldflags core analysis executionengine jit interpreter native`

# c++ compiler needed here for -lstdc++
fac:fac.o
        $(CXX) $^ -o $@ $(LDFLAGS)