Showing posts with label Pwnable. Show all posts

Monday, December 26, 2016

[Pwnable.kr/Toddler's bottle] cmd2 ( Solved. 16.12.26 )

Posted by Unknown 11:40:00 AM

# Problem

: I think this problem is similar to cmd1. The problem is as follows.

'' Daddy bought me a system command shell. But he put some filters to prevent me from playing with it without his permission... but I wanna play anytime I want!''

# How To solve

: First, connect the server cmd2@pwnable.kr -p2222 (pw : flag of cmd1 )

then, check the program source code.

When I look at the source code, I can see that it filters out some characters. I decided to use the environment variable I used in cmd1. I also decided to use the following attributes to use the / character.

The first code I think is:

./cmd2 '$(echo /)bin$(echo /)cat flag

However, I change the ascii code for the /, which is filtered here.

./cmd2 '$(echo "\57")bin$(echo "\57")cat flag

And the character "flag" was changed using an environment variable.

The result is as follows.

Unknown

0 Comments

[Pwnable.kr/Toddler's bottle] mistake ( Solved. 16.12.26)

Posted by Unknown 10:14:00 AM

# Problem

: This problem is about operator priority.

# How To Solve.

: First, connect the server ssh mistake@pwnabler.kr -p2222 and check the program source code.

The problem is the 17th line. A problem arises because comparison operators have higher precedence than arithmetic operators.

First, open("/home/mistake/password",0_RDONLY,0400) <0 is computed, This operation takes the form of a positive number<0. Therefore, It becomes False and returns 0. Fd=0 is equal to stdio. The first input value is put into pw_buf, the second input value is put into pw_buf2. and compare the xor operation value of pw_buf2 with the value of pw_buf to see the flag if it is the same.

Unknown

0 Comments

Thursday, December 15, 2016

Pwnable Wargame

[Pwnable.kr/Toddler's Bottle] ShellShock ( Solved. 16.12.15 )

Posted by Unknown 12:17:00 PM

# Problem.

: This problem is about shell shock vulnerability. This vulnerability has been categorized as CVE-2014-6271. The contents of CVE are as follows.

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix. -- CVE site

# How To solve.

: The bash shell can define functions with environment variables. After the function definition is completed, an additional command is executed to execute the command.

Unknown

0 Comments

Pwnable Wargame

[Pwnable.kr/Toddler's Bottle] Lotto ( Solved. 16.12.13 )

Posted by Unknown 11:25:00 AM

# Problem.

: This program has a code problem.

# How To Solve.

: The code where the vulnerability exists is in the followed section.

 // calculate lotto score
 int match = 0, j = 0;
 for(i=0; i<6; i++){
  for(j=0; j<6; j++){
   if(lotto[i] == submit[j]){
    match++;

In this part, even if only one out of six is matched by the for statement, the match can be increased to 6.

Note that the value of submit[6] in this program is character variables.
Since lotto ranges from 1 to 45, player can input one of the characters from 33 to 45 six times.

The result is as follows.

Unknown

0 Comments

Tuesday, December 13, 2016

Pwnable Wargame

[Pwnable.kr/Toddler's Bottle] BlackJack ( Solved 16.12.13 )

Posted by Unknown 5:36:00 PM

# Problem.

: This problem is blackjack game. If player earn more than $1 million through BlackJack game, Player can see the flag.

# How To solve.

: When I first solved this problem, I solved it without reference to the source code. The vulnerability of this program is that if player enter more money than player own, player will be prompted to re-enter it, but only once. So, when player re-enter more than $1 million and win the game, player can easily see the flag. I did the following.

And, If player win this game, player can check the flag as follows.

Unknown

0 Comments

Saturday, December 10, 2016

Pwnable PwnMenu Wargame

[Pwnable.kr] Write up List.

Posted by Unknown 10:48:00 AM

# Write up List.

This page is the problem solving list document of pwnable.kr. The order of the list is by order of difficulty, the order in which I solved the problem. and may be different from order of the problems on the pwnable.kr. I created this page because it is not easy to find the problem I want in the category on this blog.

> Toddler's Bottle.

Unknown

0 Comments

Friday, December 9, 2016

Pwnable Wargame

[Pwnable.kr/Toddler's Bottle] random ( Solved. 16.12.09 )

Posted by Unknown 1:04:00 PM

# Problem.

This problem is about the random value.

# How To Solve.

First, Connect the server ssh random@pwnable.kr -p2222

and I check the source code about the random.

According to the code, The core of the program is the XOR operation of key & random value. If the computed value is equal to 0xdeadbeef, we can see the flag.

Because of the large number of cases, I analyzed the random program using the GDB.

The results of the analysis are as follows.

I used the following method to find the key value by inverse operation of 0xdeadbeef and random value.

Since the random value is in [rbp-0x4], So I put the breakpoint in the next line <+21> and run the program. And I checked the value in [rbp-0x4].

Finally, The key value could be obtained by XOR operation with 0xdeadbeef & 0x6b8b4567.

Unknown

0 Comments

Thursday, December 8, 2016

Pwnable Wargame

[Pwnable.kr/Toddler's Bottle] Bof ( Solved 16.12.08 )

Posted by Unknown 3:57:00 PM

# Problem.

This problem is about the buffer overflow vulnerability.

# How To Solve.

First of all,

Download bof ( http://pwnable.kr/bin/bof ) & bof.c ( http://pwnable.kr/bin/bof.c)

and i look the bof.c, it looks as follows.

first, look at the main function, I notice that the 0xdeadbeef is calling the func() as a transfer factor. and then, look the func() function, I notice that if key == 0xcafebabe, system("/bin/sh") is excuted.

To change the key value 0xcafebabe, I analyzed the bof using the gdb.

and I disassemble <func>. It looks as follows.

From <+29> to <+40>, It can be seen that the distance from buffer to ret is 52bytes. So, I can change the key value by filling the dummy value by 52 bytes and filling with 0xcafebabe.

Here is the payload and flag.

Unknown

0 Comments

Pwnable Wargame

[Pwnable.kr/Toddler's Bottle] collision ( Solved 16.12.08 )

Posted by Unknown 2:02:00 PM

# Problem.

This problem is about the MD5 hash Collision.

# How To Solve.

first. connect the server ssh col@pwnable.kr -p2222

and open the col.c using vi.

look the check_password code. we notice that this code returns a res by adding the input value five times.

now at the main part, hashcode == check_password(argv[1])

Because the hashcode is 0x21DD09EC, the value of the finished check_password must also be 0x21dd093c.

therefore, we divide 0x21DD09EC by 0x05, the following formula is calculated.

0x21DD093C = 0x6C5CEC8 *5 + 4

Therefore, the value that we need to input to find the flag is as follows.

then, we can find the flag.

Unknown

0 Comments

Pwnable Wargame

[Pwnable.kr/Toddler's Bottle]cmd1 ( Solved 16.12.08 )

Posted by Unknown 11:10:00 AM

# Problem.

Mommy! what is PATH environment in Linux??

# How to solve.

This problem is about the PATH in Linux.

First, connect to the ssh cmd1@pwnable.kr -p2222

After accessing the server and using the vim, we can see the source code about cmd1.

we can't use some keywords like flag, sh and tmp.

so, I used environment PATH.

then, we can find the flag.

Unknown

0 Comments

Wednesday, December 7, 2016

Pwnable Wargame

[Pwnable.kr/Toddler's Bottle] fd ( Solved 16.12.07 )

Posted by Unknown 4:02:00 PM

Mommy! What is a file descriptor in Linux?

This problem is about the file descriptor in Linux.
As given, connect the ssh fd@pwnable.kr -p2222
when using the vim, we can see the source about fd.

0x1234 is equal to 4660. So, we need to give 0x1234 ( 4660 in demical ) as argv[1]
then, Let see if(!strcmp("LETMEWIN\n", buf).
at that point, the return value must be 1.
so, we also input the "LETMEWIN\n"