Chris breadchris

Backdoor CTF 2015 team Writeup

TL;DR

Format string

Given that this challenge was 600 points, I expected to be challenged with this one. But with 91 solves I think the people at SDSLabs kinda messed up on the points for this one lol.

Checking out what type of file we were dealing with here:

[~/Documents/CTFs/backdoor]$ file team

Delphi

files given:

delphi-07a5c9d07a4c20ae81a2ddc66b9602d0dcceb74b
libtwenty.so-4a3918b2efd9fbdfd20eeb8fa51ca76bc42eb2f2

TL;DR

Reverse Command Protocol
Integer Overflow
Metacharacter Injection

	<!DOCTYPE html>
	<html>
	<!--So long and thanks for all the fish-->
	<head>
	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
	<title>Pocket Export</title>
	</head>
	<body>
	<h1>Unread</h1>
	<ul>

	tab_depth = 0


	def log(s=None, **kwargs):
	global tab_depth
	msg = s if s is not None else ", ".join(["{} == {}".format(k, v) for k, v in kwargs.items()])
	print("\t" * tab_depth + msg)

	def perms(n, l):
	global tab_depth

	void randop() {
	munmap((void*)0x0F000000, MAPLEN);
	void buf = mmap((void)0x0F000000, MAPLEN, PROT_READ\|PROT_WRITE, MAP_ANON\|MAP_PRIVATE\|MAP_FIXED, 0, 0);
	unsigned seed;
	if(read(0, &seed, 4) != 4) return;
	srand(seed);
	for(int i = 0; i < MAPLEN - 4; i+=3) {
	(int )&((char*)buf)[i] = rand();
	if(i%66 == 0) ((char*)buf)[i] = 0xc3;
	}

	//
	// challenge_6.c
	// Matasano Crypto Challenge

	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>

	char* HEX_LOOKUP = "0123456789abcdef";

	int overflow()
	{
	char buf[136];
	return read(0, &buf, 256u);
	}

	int main()
	{
	overflow();
	return write(1, "WIN\n", 4u);