d0now

• yoyoyoyo

d0now

• yoyo

d0now

• yo

d0now

• My first time firefox js exploit
• Not a intended way, but I was fast (first blood)

d0now

• Lua arbitrary heap pointer write (?)
• My first time lua exploit
• Also First Blood :) (Team: STLCTF)

d0now

• SQLite3 extension reversing
• ROP with bit flipping attack
• Cryptographic logic was identified by bindiff

d0now

1. you can get server binary using: curl --path-as-is http://[SERVER]/docs/../../../../../../../proc/self/exe
2. and you need to reverse-engineering the function Service::checkFlag
3. I used binary ninja for automation and it was quite easy for me.

d0now

1. download binary and do: base64.b64decode(gzip.decompress(binary))
2. find randomly generated constraint function and other informations. (I know that there are many ways to handle this.) 2.1. I did it with binaryninja.
3. solve constraints by emulation, symbolic execution, dynamic binary instrumentation, or anything you want. 3.1. I did it with unicorn engine.
4. finally, you can reach fsb and bof.
5. done!

d0now

import sys
import json
import requests
import shutil
from pathlib import Path
from zipfile import ZipFile


API = 'https://samate.nist.gov/SARD/api/test-cases/search?flaw%5B%5D={cwe}&language%5B%5D=c&page={page}&limit={limit}'
DOWNLOADS=(Path(__file__).parent / 'downloads')

d0now

#!python3

import angr
import networkx
from pathlib import Path


def main(args):
    
    p = angr.Project(args.binary, load_options={