david942j @ 217
Foreword I planned to go through the details of these challenges about how components interacted with each other. But after seeing the team organizers posts their writeup which is so well organized and detailed I have a different thought. So readers, please refer to their write-up, especially the "challenge architecture" section which is accurate and illustrated. I suggest you to read their…
Path of Exploitation (PoE) are the pwn challenges I designed for this year's HITCON CTF qualification. It contains three stages/layers, hackers have to exploit a user-space program, do privilege escalation on Linux, and attack the custom device embedded in QEMU. Solve all three stages to be the master of pwn! This challenge has a similar hierarchy as "Abyss" has, which is also my series of…
Few weeks ago I solved a great KVM escaping challenge from TWCTF hosted by @TokyoWesterns . I have given a writeup on my blog: [Write-up] TokyoWesterns CTF 2018 - pwn240+300+300 EscapeMe , but it mentions nothing about KVM because there's no bug (at least I didn't find) around it. Most introduction articles of KVM I found are actually introducing either libvirt or qemu, lack of how to utilize KVM…
The best KVM (Kernel-based Virtual Machine) challenge I've ever seen! Thanks @shift_crops for giving such great challenge. He released the source code of EscapeMe after the contest as well. The released files can be found in the author's repo , include 4 binaries, two text files, and one python script. And you can find all my three exploit scripts in my ctf-writeups repo . Introduction There're…
Basic Info This is an interesting sandbox-escaping challenge! Though I solved it after the game, still want to share how fun this challenge is, so I make this writeup. Attachment contains the binary and source code, you can find them in my github repository . checksec of the binary: It's a 64-bit x86 binary and all modern protections are enabled, but later you will found these protections are not…
Glad to say that we (HITCON) are the only team solved this challenge :D But in my opinion this challenge is more like a reversing but not a pwnable one. This is a pwn challenge - but the pwn part is extremely easy, and the hardest part is to understand what is this binary doing. Anyway, let's see the details. 0x01 Basic Info The binary, ELF interpreter, and libc.so.6 are given, you can find them…
Introduction The attachment can be found in my repository: link Many people ask me to give this writeup because I announced that all the 11 teams used unintended solution on IRC. Now comes the intended one :D This task asks you to exploit the ruby interpreter, given arbitrary ruby code execution but protected by seccomp rules. The service code (server.rb): # !/usr/bin/ruby require __dir__ + '…
It's a long time since I last wrote a writeup for reversing challenge! Since we(217) are the only team to solve this, and it's a great challenge, I decide to do so.This challenge was solved by me and my teammate +PZ Read . 0x01 Files The challenge has two attached files, a x86_64 binary steganographer_revenge and an image file invitation.png . You can find this two files in my github repo . The…
Before Start This challenge took me 40 hours (including sleeping) to solve! One reason is I'm not familiar with race condition bugs. Main reason is because there're too many strategies (seems) can solve it. I have tried at least four kinds of exploitation and finally got the correct and stable one. I will show the final solution I got and mention why other solutions failed. Another reason hard to…
Introduction The challenge files can be downloaded here . Challenge contains three files: partyplanning.strip , partyplanning.dump , and relocator.py partyplanning.strip is the main binary, with less protection: Features Binary patching When executing the binary it will ask you give two addresses, the binary will "patch" itself according to the address you input: $ ./partyplanning.strip Before we…
Introduction binary This is not a normal but very interesting pwn challenge. The target of this chal is to "guess" random 64 bits. When running binary, it'll fetch 64 random bits from /dev/urandom, and mmap 64 pages according to the following rule: // bits = random 64 bits void * base = 0x200000000; for ( int i= 0 ;i< 64 ;i++) { mmap (base+( 2 *i+bits[i]) * 0x1000, 0x1000, ...); } And the result…
Introduction This is a rbash jail escaped challenge. There're are many solutions of this chal. What we used is 1-day of CVE-2016-9401. According to the administrator, we (HITCON) are the only team solved this challenge by using this CVE :p. I'm too lazy to introduce what this challenge doing, if you're not similar with this challenge yet, you can see this writeup with nice introduction. Exploit…
Introduction One-gadgets are useful gadgets in glibc, which leads to call execve ( ' /bin/sh ' , NULL , NULL ) . It's convenient to use it to get RCE (remote code execution) whenever we can only control PC (program counter). For example, sometimes the vulnerability only leads to an arbitrary function call without controlling the first argument, which forbids us to call system ( " sh " ) . But…
This challenge wasn't solved by me but +winesap during the competition. I do this challenge off-line and the exploit has been confirmed by +winesap will work. Basic Info Attachments are two 32bit ELFs and one plaintext: note_trial_1, ptrace_32 , blacklist.txt The note_trial_1 binary is Full RELRO but no PIE enable. While it do have canary, the checksec of pwntools might have bugs. The ptrace_32…
Basic Info 附加檔案 有兩個 32bit ELF note 跟 note_client 以及 libc-2.19 環境是一般程度的保護，PIE 沒開以及 Partial RELRO 直接執行 note 會看到一堆 Hex： IDA 打開看起來是正常的選單題： 那為何執行起來看到的是一堆 Hex 呢？ 仔細分析後 note 中所有 I/O 都被實作會經過某種 encode/decode 先跳過這邊，看看 note_client 會做什麼 直接執行： IDA 分析可以知道他想要開檔 config.txt ，並連線 config.txt 中寫的 host:port 因此 config.txt 內容寫 127.0.0.1 31337 ，並使用 ncat 將 note bind 在 127.0.0.1:31337 後執行 note_client ： 成功執行了！ note_client…
Basic Info Attachments are two 32bit ELF note, note_client and glibc libc-2.19 Normal protection, no PIE and Partial RELRO. Directly run binary note will face a punch of hex: While it looks like as normal menu challenge in IDA: Why there's hex code when running? After analysis, all I/O in note has been encrypt/decrypt in some way: Let's skip here, and see what does note_client do first: Directly…
diary 是我在這場 CTF 當中唯一做到的 pwn 題，趁其他隊友還在睡覺時撿來做的ＸＤ 這場比賽題目品質很好，種類多而且都不猜謎，難度也很恰當，打完後覺得學到不少東西的比賽最棒了！ Info 附加檔案是 ELF64 的執行檔 diary 。 PIE 沒開，Partial RELRO 連線上去感受一下功能，選項很少的選單題： 總之三個功能： 寫日記 顯示某篇日記 刪掉某篇日記 寫日記的時候要輸入日期、日記長度、跟日記內容 Vulnerability 一打開 IDA 就看到 getnline 這個讀日記內容的函式有非常明顯的漏洞： buffer a1 在傳進來之前是 malloc(len) 獲得的， read 時多讀了一個 byte( len + 1 )。 因為 len （日記長度）完全沒有限制，所以可以構造長度使得 overflow 壓到下一個 chunk 的 size ，就是個…
這場 217 沒人打，晚上回家順手註冊個來看看題目 看了幾題題目不太難，洞都滿經典的 發這篇文是為了紀念第一次在比賽中獨力做出 Web 題 XD 以往 Web 全都給隊友，難得自己打比賽就看了一下 Web 題這樣 題目提供一個網站連結： 網站用 php 寫的，駭客最愛的語言！ 表面上的按鈕有 4 個：Home, Music Player, Music Video, Contact 檢視原始碼看到 Music Player 頁面中有一段可疑的 js: function updateSource(song) { var audio = document.getElementById('audio'); var source = document.getElementById('mpSource'); source.src='stream_song.php?file=' + song;…
第二屆 Trend Micro CTF ，題目一如去年風格很通靈 rev300 是當中少數正常的題目了 難得在 reverse 題中拿到首殺ＸＤ，小時候寫過 ActionScript 可能還是有點幫助(?) 這題是個動畫 (SWF) 題，題目提供一個檔案(game.swf) 動畫執行畫面先是個輸入名字： 打完名字後如同檔名是個遊戲： 遊戲方式是上下左右移動人物 (綠色的 S)，撞怪物可以殺怪，被怪物撞 9 次就死亡。但身為一個 reverse 題，遊戲本身肯定是不重要的，因此先找工具對動畫進行反編譯。 我使用的反編譯工具是 open source 的 JPEXS Free Flash Decompiler ，賽中比較過其他工具但以這個解出來的最完整。 decompile 出來的目錄結構長得像這樣： game ├── binaryData │ ├── 1__el_-__-_--.bin │…