d0now

#!python3

from angr                                       import Project
from angr.sim_state                             import SimState
from angr.sim_manager                           import SimulationManager
from angr.exploration_techniques.director       import Director, ExecuteAddressGoal
from angr.exploration_techniques.veritesting    import Veritesting


hits = {}

d0now

#!python3

import angr
import networkx
from pathlib import Path


def main(args):
    
    p = angr.Project(args.binary, load_options={

d0now

import sys
import json
import requests
import shutil
from pathlib import Path
from zipfile import ZipFile


API = 'https://samate.nist.gov/SARD/api/test-cases/search?flaw%5B%5D={cwe}&language%5B%5D=c&page={page}&limit={limit}'
DOWNLOADS=(Path(__file__).parent / 'downloads')

d0now

1. download binary and do: base64.b64decode(gzip.decompress(binary))
2. find randomly generated constraint function and other informations. (I know that there are many ways to handle this.) 2.1. I did it with binaryninja.
3. solve constraints by emulation, symbolic execution, dynamic binary instrumentation, or anything you want. 3.1. I did it with unicorn engine.
4. finally, you can reach fsb and bof.
5. done!

d0now

1. you can get server binary using: curl --path-as-is http://[SERVER]/docs/../../../../../../../proc/self/exe
2. and you need to reverse-engineering the function Service::checkFlag
3. I used binary ninja for automation and it was quite easy for me.

d0now

• SQLite3 extension reversing
• ROP with bit flipping attack
• Cryptographic logic was identified by bindiff

d0now

• Lua arbitrary heap pointer write (?)
• My first time lua exploit
• Also First Blood :) (Team: STLCTF)

d0now

• My first time firefox js exploit
• Not a intended way, but I was fast (first blood)

d0now

• yo

d0now

• yoyo