Theme Layout

Boxed or Wide or Framed

Wide

Theme Translation

Display Featured Slider

Featured Slider Styles

Display Grid Slider

yes

Grid Slider Styles

Display Trending Posts

Display Author Bio

Display Instagram Footer

off

Dark or Light Style

Light
Powered by Blogger.
Navigation Menu

All rights reserved
komorebi 2016

Thursday, February 2, 2017

[Hacker School] FTZ Level18 ( Ver. Eng )

[Hacker School] FTZ Level18 ( Ver. Eng )

Posted by 12:21:00 PM



Level18

 After logging in with level18 account, check the hint as follows.



When I look at the code, If I have more than 100 characters in the string array, The program outputs “what are you trying to do?”. If the check variable is set to 0xdeadbeef, then shellout() is executed and a shell with level19 permission is executed. I put “A”*100 to make sure the code is right.



As expected, what are you trying to do? is displayed. Now, I use the following code to confirm the positional relationship between variables.



After compiling the above code and executing the program, the result is as follows.



Base on the above results, the following diagram shows the stack.



the count variable is located at an address lower than the string variable, so it is not easy to use the BOF method. 
Since the level19 shell only needs to enter 0xdeadbeef into the check variable, I proceed to change the value of the check variable by manipulating the pointer.Since the check variable is the same as string[-4], we moved the pointer by putting “\x08” 4times to reduce the count by 4, and then put 0xdeadbeef.



shellout() is executed and the level19 shell is executed, and I confirm the password of level19 using my-pass command.


Read more »
Unknown
0 Comments

You Might Also Like

Wargame
[Hacker School] FTZ Level17 ( Ver. Eng )

[Hacker School] FTZ Level17 ( Ver. Eng )

Posted by 11:54:00 AM



Level17


After logging in with level17 account, check the hint as follows.


Unlike the previous problem, there was a function to execute a shell in the program, but it does not exist in this program. In order to catch the attack direction, I first analyze it with gdb.


A total of 56 bytes are allocated for the memory space. Put the start address of printout in ebo-16 and execute printout through call function.I let the call()l function execute the system() function and system() function to execute “/bin/sh”.I put the address of system() function at the location of call() function and the address of /bin/sh at the beginning of the array using the point where the call() function ends and ebp+4 is located. How to get the address of system() is /bin/sh is omitted because it was covered in level11.




Read more »
Unknown
0 Comments

You Might Also Like

Wargame
[Hacker School] FTZ Level16 ( Ver. Eng )

[Hacker School] FTZ Level16 ( Ver. Eng )

Posted by 11:39:00 AM



Level16


After accessing level16 account, check the hint as follows.



When viewed in the code. If I call up the shell() function using call function in the main, I can execute the level17 shell. After copying to the tmp folder, I execute the program added a line of code to find out the memory structure.



And then, I analyze the attackme using gdb.



Based on above two analysis, The structure of stack is shown as follows.



I need the address of shell() function. Because I execute the shell() function through the call() function. So, I find address of the shell() function using gdb.



When I disassemble the shell, I find the starting address of shell function. When I type dummy values as 40byte and the address of shell() function, the call function execute the shell() function.



As a result, the level17 shell is executed. I confirm the password of level17 is “king poetic”.


Read more »
Unknown
0 Comments

You Might Also Like

Wargame

Wednesday, February 1, 2017

[Hacker School] FTZ Level15 ( Ver. Eng )

[Hacker School] FTZ Level15 ( Ver. Eng )

Posted by 11:19:00 PM



Level15


After accessing level15 account, check the hint as follows.



Up to the previous level bof a little different from problems, is declared as a variable check is that a variable declared as a pointer. 
Pointer variables are variables with the value of that memory address.
In other words, check is recognized the address of the memory within variables. 
In the code, if I put 0xdeadbeef into the address of memory that pointed to by check pointer variable, the level16 shell is executed. 
To know the relationship between the three variables, I executed the program adding a line of code.



In addition, I analyze it with gdb to understand the stack structure.



I know that the size of the memory space is 0x38 ( 56 byte). 
Also, I know that this program put the value of ebp-16 to eax, and the value of eax compare with 0xdeadbeef.Based on the above, the structure of the stack is shown as follows.



Since the program compare 0xdeadbeef with the value of eax, I look for the location where 0xdeadbeef is included in the program. 



I know that 0xdeadbeef in 0x080484b2. So, When I put a dummy value as 40byte and put the 0x080484b2, The check pointer variable contain 0xdeadbeef.



as a result, I confirm the password of level16.




Read more »
Unknown
0 Comments

You Might Also Like

Wargame
[Hacker School] FTZ Level14 ( Ver. Eng )

[Hacker School] FTZ Level14 ( Ver. Eng )

Posted by 10:05:00 PM



Level14


After accessing level14 account, check the hint as follows.



When the 0xdeadbeef enter a variable called check, The program is executed level15 shell..I create file that equal to attackme using hint, and analyze it.



I know the size of stack is 0x38 ( 56byte ). 
and I know that the program compare 0xdeadbeef with value of ebb-16. 
When the 0xdeadbeef enters the ebp-16, level15 shell is executed. 
So I put the dummy value to its front, and put a “\xef\xbe\xad\xde”.



As a result, I know the password of level15.


Read more »
Unknown
0 Comments

You Might Also Like

Wargame
[Hacker Shcool] FTZ Level13 ( Ver. Eng )

[Hacker Shcool] FTZ Level13 ( Ver. Eng )

Posted by 9:44:00 PM




Level13


After accessing level13 account, check the hint as follows.

This is attackme source code. Since attackme has a setuid. So, It is difficult to debug. 
So, I create the same file using contents of hint. then, I analyzed file that created file.



When I analyze program, I use gdb. The important part is to compare 0x123456 with the value located at ebp-12.The way to defeat the BOF in this way is called Stack Guard. 
In order to bypass, it is supposed to put the value of 0x123456 in ebp-12. 
I put a BreakPoint on main+79 and analyze it in detail.

As a result, I know that 8bytes of dummy exists between ebp-12 and  SFP. 
To bypass using RTL, I check the address of the system function, the address of /bin/sh, and whether libc applied ASLR. 
I skip how to find address above things. because I already got it at level11. 
Here is a digram of payload.

When I type the payload, I can see that shell of level14 is executed as follows.and I know the level14 password using my-pass command.

Read more »
Unknown
0 Comments

You Might Also Like

Wargame
[Hacker School] FTZ Level12. ( Ver. Eng )

[Hacker School] FTZ Level12. ( Ver. Eng )

Posted by 9:25:00 PM


Level12


 After accessing with level12 account, check the hint as follows.

In the source code, first, The program declares a local variable str array of 256 bytes size. Then grant permission level13 (3093) to attackme. It outputs a string “ Input a sentence. ”, receives a string with the get functions, prints the input string, and exists.


I analyze it using gdb.When I think about the structure of the stack, it seems to be the same as level11.To use RTL ( Return To Libc ), I check whether ASLR was done using ldd command.


As a result, I confirm that libc is not applied ASLR. All subsequent attack sequences are identical to level11. The address where /bin/sh is located and the address of the system function are also same. Level12 receives string input during program execution differently from level11, so I tried attack like the following, and as a result, I know the password of level13.




Read more »
Unknown
0 Comments

You Might Also Like

Wargame
Subscribe to: Posts (Atom)

Follow @SunriseSunsetBlog