[Hacker School] FTZ Level20. ( Ver. Eng ) + Ends.

Posted by Unknown 1:27:00 PM

Level20.

After logging in with level20 account, check the hint as follows.

When I look at the code, The program declares an 80bytes array named bleh.

To do BOF, I have to manipulate RET.

Since the fgets function only accepts 79bytes, BOF attack seems to difficult.

Printf(bleh) has a FSB vulnerability, so I think i should try to attack using the FSB.

As a result of substituting %x, I see that the FSB vulnerability as expected.

I tried to analyze the program using gdb. but the main function does not exist.

So, analysis is impossible. Therefore I used .dtros area using the FSB.

The output address 0x08049594 is the address of __DTOR__LIST__.

I use address 0x08049598 to overwrite the symbol of __DTOR__END__ which is +4 away. then, put the shell code in the environment variable and check the address.

To see how much of bleh[80] exists on the stack, I try the following.

I notice that bleh[80] starts after moving 12bytes.The result of configuring and assigning payload is as follows.

Ends.

I had solved hacker school FTZ before.

At that time, I did not leave this document when I solved, but this time when I solved problem and left this document, I feel newly.

This document focuses on the problem-solving process and is not a detailed description.

In the future, I would like to put a detailed list of RTL, FSB, etc. on my blog.Before I join the army, I plan to solve and document other problems wile studying computer/security.

Unknown

0 Comments

[Hacker School] FTZ Level19 ( Ver. Eng )

Posted by Unknown 1:01:00 PM

Level19

After logging in with level19 account, check the hint as follows.

A BOF vulnerability exists because it is a gets function that does not check the length of the input string. I used gdb to analyze the code.

The size allocated for memory space is 40 bytes.

If you try to use BOF attack with this information, the shell will run with level19 permissions instead of level20 permissions.

I execute setreuid(3100,3100) and system(“/bin/sh”) to execute a level20 shell.

To this, I use Chaining RTL. The following diagram illustrates the stack.

First, I find the address of system() and setreuid().

I use objdump to find pop - pop - ret as follows.

Finally I use the code that using in level11 to find the address of /bin/sh.

After compiling the above code and executing the program, I find the address of /bin/sh.

Now, I have all the values i need, I type the payload.

As a result, I execute level20 shell.

Unknown

0 Comments

Hacker School FTZ Wargame

[Hacker School] FTZ Level18 ( Ver. Eng )

Posted by Unknown 12:21:00 PM

Level18

After logging in with level18 account, check the hint as follows.

When I look at the code, If I have more than 100 characters in the string array, The program outputs “what are you trying to do?”. If the check variable is set to 0xdeadbeef, then shellout() is executed and a shell with level19 permission is executed. I put “A”*100 to make sure the code is right.

As expected, what are you trying to do? is displayed. Now, I use the following code to confirm the positional relationship between variables.

After compiling the above code and executing the program, the result is as follows.

Base on the above results, the following diagram shows the stack.

the count variable is located at an address lower than the string variable, so it is not easy to use the BOF method.

Since the level19 shell only needs to enter 0xdeadbeef into the check variable, I proceed to change the value of the check variable by manipulating the pointer.Since the check variable is the same as string[-4], we moved the pointer by putting “\x08” 4times to reduce the count by 4, and then put 0xdeadbeef.

shellout() is executed and the level19 shell is executed, and I confirm the password of level19 using my-pass command.

Unknown

0 Comments

Hacker School FTZ Wargame

[Hacker School] FTZ Level17 ( Ver. Eng )

Posted by Unknown 11:54:00 AM

Level17

After logging in with level17 account, check the hint as follows.

Unlike the previous problem, there was a function to execute a shell in the program, but it does not exist in this program. In order to catch the attack direction, I first analyze it with gdb.

A total of 56 bytes are allocated for the memory space. Put the start address of printout in ebo-16 and execute printout through call function.I let the call()l function execute the system() function and system() function to execute “/bin/sh”.I put the address of system() function at the location of call() function and the address of /bin/sh at the beginning of the array using the point where the call() function ends and ebp+4 is located. How to get the address of system() is /bin/sh is omitted because it was covered in level11.