codeslinger

//
//  Created by Michael Petrov on 12-02-23.
//  Copyright (c) 2012 TenthBit Inc. All rights reserved.
//  http://michaelpetrov.com ([email protected])
//
//
//  This solution performs a timing attack on the fork system call. By monitoring the process closely
//  it is possible to discover where the fork likely happened. With some basic heuristics, it's possible
//  to infer where the wrong character is. With very minor brute force searching it becomes very easy
//  to find the password one letter at a time.

codeslinger

Stripe CTF - Work Notes
mpetrov ([email protected])

These notes are very rough. They should give a general idea of how each level was solved.

---- LEVEL 01 (login: e9gx26YEb2) -----
Solution: modifying PATH env variable
Password: kxlVXUvzv

date.c

codeslinger

Counting objects: 5, done.
Compressing objects: 100% (2/2), done.
Writing objects: 100% (3/3), 267 bytes, done.
Total 3 (delta 1), reused 0 (delta 0)
remote: /data/github/current/lib/github/config/resque.rb:27: undefined method `constantize' for "GitHub::Jobs::GistStats":String (NoMethodError)
remote:         from /data/github/current/lib/github/config/resque.rb:26:in `each'
remote:         from /data/github/current/lib/github/config/resque.rb:26
remote:         from /data/github/current/lib/rock_queue.rb:9:in `require'
remote:         from /data/github/current/lib/rock_queue.rb:9
remote:         from hooks/post-receive:27:in `require'

codeslinger

import java.io.IOException;
import java.net.InetSocketAddress;
import java.net.ServerSocket;
import java.net.StandardSocketOptions;
import java.nio.ByteBuffer;
import java.nio.channels.CancelledKeyException;
import java.nio.channels.ReadableByteChannel;
import java.nio.channels.SelectionKey;
import java.nio.channels.Selector;
import java.nio.channels.ServerSocketChannel;

codeslinger

> curl -I "http://www.rogerebert.com/apps/pbcs.dll/article?AID=/20111228/COMMENTARY/111229973/"
HTTP/1.0 200 OK
Cache-Control: max-age=0, s-maxage=0
Content-Length: 74284
Content-Type: text/html; charset=iso-8859-1
Expires: Sat, 31 Dec 2011 02:21:46 GMT
Last-Modified: Sat, 31 Dec 2011 02:21:46 GMT
Server: Microsoft-IIS/7.0
Set-Cookie: PBCSPERMUSERID=873450176906098; path=/; expires=Sat, 29 Dec 2012 21:21:46 GMT
Set-Cookie: PBCSSESSIONID=873450176906098; path=/

codeslinger

(def migrations (sorted-map
                 ;; Migrations are numbered by integer values to explicitly document them

                 1 {
                    :doc "Foo Table"
                    :up  (fn []
                            (create-table
                             :Foo
                             [:id :int "PRIMARY KEY" "NOT NULL GENERATED ALWAYS AS IDENTITY"]
                                        ; store a JSON blob in here for the screening record

codeslinger

import logging
import riak

log = logging.getLogger(__name__)

class RiakCounter(object):
    def __init__(self, bucket, key):
        self.bucket = bucket
        self.bucket.set_allow_multiples(True)
        self.key = key

codeslinger

require 'rubygems'
require 'json'
require 'redis'

class RedisComments
    def initialize(redis,namespace,sort_proc=nil)
        @r = redis
        @namespace = namespace
        @sort_proc = sort_proc
    end

codeslinger

package com.mypackage.benchmark

import com.mypackage.util.Logging
import net.lag.configgy.Configgy
import scala.collection.mutable
import scala.collection.JavaConversions._

import java.net.InetSocketAddress
import java.nio.charset.Charset
import java.util.concurrent._

codeslinger

/**
 * This file is licensed to you under the Apache License, Version 2.0 (the 
 * "License"); you may not use this file except in compliance with the 
 * License. You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.