A byte-compiled Python file, with a patch to the cpython source showing that the opcodes have been scrambled. Let's go! Mixed was a really fun challenge from the recent Google CTF, that zaratec and I worked on together, each focusing on a different aspect. You can find her write-up here , which covers a lot more about the pattern recognition side of things that I skim over. Problem Description We…
We need to recover the flag from a file that has been encrypted using a random 40000 byte long key using a custom encryption routine, using only the 1 known ciphertext. Overall I found this challenge to be quite interesting and well designed. Only 3 teams solved it over the course of the 48 hour contest (organized by Perfect Blue ), and it had a final score of 443 points. This post describes how I…
In this challenge, we need to recover a message that is encrypted through 4 different RSA keys, while knowing some of the bits of the private keys. In particular, we are given code that generates 4 different RSA keys (of ~2100 bits each), permutes them, encrypts the flag by each of them in succession, and then provides us the encrypted flag. Additionally, we are given the moduli of the keys, as…
In this challenge, we had to obtain remote code execution, simply by exploiting a 1-day bug that forgot the difference between -0 and +0. This has probably been one of the most difficult, fun, and frustrating bugs I have ever exploited. As someone who has never exploited a JavaScript engine vulnerability ever before, this challenge was a journey, filled with tons of ups and downs. I had an…
Last weekend was HITCON CTF 2018, and it was really awesome! I personally spent time on various super interesting challenges. Below is just one of them that I happened to solve on the first day. I found to be particularly interesting to solve since I never have had a chance to dive into any homomorphic encryption systems before. I lost my modulus. Can you find it for me? nc 13.112.92.9 21701…
I spent the past week, at the Summer School on Formal Techniques , and it was an absolutely amazing experience. Chronicled below, are the different great talks/labs that were part of this week long program, as well as my thoughts interspersed in. Overall, this was an unforgettable week, where I learnt a lot, made new friends, and had some nice discussions about a lot of very interesting topics. I…
Influenced by Gynvael's CONFidence CTF 2017 Livestreams here and here ; and by his Google CTF Quals 2017 Livestream here Reverse engineering is a mix of an art as well as a science. Over time, one tends to gather a repertoire of common "tips and tricks" that one might use when reversing any given piece of software. What follows are a condensed form of some tricks gained from Gynvael's livestreams.…
[This was originally published on Expectations IITR , run by Geek Gazette , just after completing my B.Tech. at IIT Roorkee] My desk is definitely not this organized Truly, time flies extremely fast when you are enjoying yourself. These 4 years have been amongst the most memorable ones in my life till date, and have helped me grow as an individual in countless ways. First year was the first time I…
Influenced by a discussion with @p4n74 and @h3rcul35 on the InfoSecIITR #bin chat. We were discussing on how sometimes beginners struggle to start with a larger challenge binary, especially when it is stripped. To either solve an RE challenge, or to be able to pwn it, one must first analyze the given binary, in order to be able to effectively exploit it. Since the binary might possibly be stripped…
Influenced by this awesome live stream by Gynvael Coldwind, where he discusses the basics of ROP, and gives a few tips and tricks Return Oriented Programming (ROP) is one of the classic exploitation techniques, that is used to bypass the NX (non executable memory) protection. Microsoft has incorporated NX as DEP (data execution prevention). Even Linux etc, have it effective, which means that with…
Written on May 27 2017; extended on May 29 2017. Influenced by this amazing live stream by Gynvael Coldwind, where he talks about the basic theory behind genetic fuzzing, and starts to build a basic genetic fuzzer. He then proceeds to complete the implementation in this live stream. Here, we take a look at "advanced" fuzzing (in comparison to a blind fuzzer, as described in my "Basics of Fuzzing"…
Influenced by this awesome live stream by Gynvael Coldwind, where he talks about what fuzzing is about, and also builds a basic fuzzer from scratch! What is a fuzzer, in the first place? And why do we use it? Consider that we have a library/program that takes input data. The input may be structured in some way (say a PDF, or PNG, or XML, etc; but it doesn't need to be any "standard" format). From…
Influenced from a nice challenge in PicoCTF 2017 (name of challenge withheld, since the contest is still under way) WARNING: This note might seem simple/obvious to some readers, but it necessitates saying, since the layering wasn't crystal clear to me until very recently. Of course, when programming, all of us use abstractions, whether they be classes and objects, or functions, or meta-functions,…
Influenced by this awesome live stream by Gynvael Coldwind, where he talks about format string exploitation While simple format string vulnerabilities are becoming relatively less common these days, every once in a while, we come across some interesting cases in either CTFs or (less likely) real world programs, where having a better understanding of how to attack these vulnerabilities helps…
Influenced by this amazing live stream by Gynvael Coldwind, where he explains about race conditions If a memory region (or file or any other resource) is accessed twice with the assumption that it would remain same, but due to switching of threads, we are able to change the value, we have a race condition. Most common kind is a TOCTTOU (Time-of-check to Time-of-use), where a variable (or file or…
Influenced by this amazing live stream by Gynvael Coldwind, where he is experimenting on the heap Amongst the various kinds of heap exploitation techniques, there are 3 that are considered extremely basic, and provide the fundamentals to understand more complicated heap exploits. Use-after-free: Let us say we have a bunch of pointers to a place in heap, and it is freed without making sure that all…
This was a great challenge, and I learnt a lot, even though I ended up spending many hours (over 10 hours!) on it. The challenge Santa Claus had a massive, multi-day lag and is still stuck at sorting out christmas trees and presents. Help him with the trees at nc 78.46.224.71 14449 . If he doesn't reward you with a satisfactory present, you might have to bash him a bit. ATTENTION: this challenge…