Showing posts with label Wargame. Show all posts

Thursday, February 2, 2017

[Hacker School] FTZ Level20. ( Ver. Eng ) + Ends.

Posted by Unknown 1:27:00 PM

Level20.

After logging in with level20 account, check the hint as follows.

When I look at the code, The program declares an 80bytes array named bleh.

To do BOF, I have to manipulate RET.

Since the fgets function only accepts 79bytes, BOF attack seems to difficult.

Printf(bleh) has a FSB vulnerability, so I think i should try to attack using the FSB.

As a result of substituting %x, I see that the FSB vulnerability as expected.

I tried to analyze the program using gdb. but the main function does not exist.

So, analysis is impossible. Therefore I used .dtros area using the FSB.

The output address 0x08049594 is the address of __DTOR__LIST__.

I use address 0x08049598 to overwrite the symbol of __DTOR__END__ which is +4 away. then, put the shell code in the environment variable and check the address.

To see how much of bleh[80] exists on the stack, I try the following.

I notice that bleh[80] starts after moving 12bytes.The result of configuring and assigning payload is as follows.

Ends.

I had solved hacker school FTZ before.

At that time, I did not leave this document when I solved, but this time when I solved problem and left this document, I feel newly.

This document focuses on the problem-solving process and is not a detailed description.

In the future, I would like to put a detailed list of RTL, FSB, etc. on my blog.Before I join the army, I plan to solve and document other problems wile studying computer/security.

Unknown

0 Comments

[Hacker School] FTZ Level19 ( Ver. Eng )

Posted by Unknown 1:01:00 PM

Level19

After logging in with level19 account, check the hint as follows.

A BOF vulnerability exists because it is a gets function that does not check the length of the input string. I used gdb to analyze the code.

The size allocated for memory space is 40 bytes.

If you try to use BOF attack with this information, the shell will run with level19 permissions instead of level20 permissions.

I execute setreuid(3100,3100) and system(“/bin/sh”) to execute a level20 shell.

To this, I use Chaining RTL. The following diagram illustrates the stack.

First, I find the address of system() and setreuid().

I use objdump to find pop - pop - ret as follows.

Finally I use the code that using in level11 to find the address of /bin/sh.

After compiling the above code and executing the program, I find the address of /bin/sh.

Now, I have all the values i need, I type the payload.

As a result, I execute level20 shell.

Unknown

0 Comments

Hacker School FTZ Wargame

[Hacker School] FTZ Level18 ( Ver. Eng )

Posted by Unknown 12:21:00 PM

Level18

After logging in with level18 account, check the hint as follows.

When I look at the code, If I have more than 100 characters in the string array, The program outputs “what are you trying to do?”. If the check variable is set to 0xdeadbeef, then shellout() is executed and a shell with level19 permission is executed. I put “A”*100 to make sure the code is right.

As expected, what are you trying to do? is displayed. Now, I use the following code to confirm the positional relationship between variables.

After compiling the above code and executing the program, the result is as follows.

Base on the above results, the following diagram shows the stack.

the count variable is located at an address lower than the string variable, so it is not easy to use the BOF method.

Since the level19 shell only needs to enter 0xdeadbeef into the check variable, I proceed to change the value of the check variable by manipulating the pointer.Since the check variable is the same as string[-4], we moved the pointer by putting “\x08” 4times to reduce the count by 4, and then put 0xdeadbeef.

shellout() is executed and the level19 shell is executed, and I confirm the password of level19 using my-pass command.

Unknown

0 Comments

Hacker School FTZ Wargame

[Hacker School] FTZ Level17 ( Ver. Eng )

Posted by Unknown 11:54:00 AM

Level17

After logging in with level17 account, check the hint as follows.

Unlike the previous problem, there was a function to execute a shell in the program, but it does not exist in this program. In order to catch the attack direction, I first analyze it with gdb.

A total of 56 bytes are allocated for the memory space. Put the start address of printout in ebo-16 and execute printout through call function.I let the call()l function execute the system() function and system() function to execute “/bin/sh”.I put the address of system() function at the location of call() function and the address of /bin/sh at the beginning of the array using the point where the call() function ends and ebp+4 is located. How to get the address of system() is /bin/sh is omitted because it was covered in level11.

Unknown

0 Comments

Hacker School FTZ Wargame

[Hacker School] FTZ Level16 ( Ver. Eng )

Posted by Unknown 11:39:00 AM

Level16

After accessing level16 account, check the hint as follows.

When viewed in the code. If I call up the shell() function using call function in the main, I can execute the level17 shell. After copying to the tmp folder, I execute the program added a line of code to find out the memory structure.

And then, I analyze the attackme using gdb.

Based on above two analysis, The structure of stack is shown as follows.

I need the address of shell() function. Because I execute the shell() function through the call() function. So, I find address of the shell() function using gdb.

When I disassemble the shell, I find the starting address of shell function. When I type dummy values as 40byte and the address of shell() function, the call function execute the shell() function.

As a result, the level17 shell is executed. I confirm the password of level17 is “king poetic”.

Unknown

0 Comments

Wednesday, February 1, 2017

Hacker School FTZ Wargame

[Hacker School] FTZ Level15 ( Ver. Eng )

Posted by Unknown 11:19:00 PM

Level15

After accessing level15 account, check the hint as follows.

Up to the previous level bof a little different from problems, is declared as a variable check is that a variable declared as a pointer.
Pointer variables are variables with the value of that memory address.
In other words, check is recognized the address of the memory within variables.
In the code, if I put 0xdeadbeef into the address of memory that pointed to by check pointer variable, the level16 shell is executed.
To know the relationship between the three variables, I executed the program adding a line of code.

In addition, I analyze it with gdb to understand the stack structure.

I know that the size of the memory space is 0x38 ( 56 byte).
Also, I know that this program put the value of ebp-16 to eax, and the value of eax compare with 0xdeadbeef.Based on the above, the structure of the stack is shown as follows.

Since the program compare 0xdeadbeef with the value of eax, I look for the location where 0xdeadbeef is included in the program.

I know that 0xdeadbeef in 0x080484b2. So, When I put a dummy value as 40byte and put the 0x080484b2, The check pointer variable contain 0xdeadbeef.

as a result, I confirm the password of level16.

Unknown

0 Comments

Hacker School FTZ Wargame

[Hacker School] FTZ Level14 ( Ver. Eng )

Posted by Unknown 10:05:00 PM

Level14

After accessing level14 account, check the hint as follows.

When the 0xdeadbeef enter a variable called check, The program is executed level15 shell..I create file that equal to attackme using hint, and analyze it.

I know the size of stack is 0x38 ( 56byte ).
and I know that the program compare 0xdeadbeef with value of ebb-16.
When the 0xdeadbeef enters the ebp-16, level15 shell is executed.
So I put the dummy value to its front, and put a “\xef\xbe\xad\xde”.