A collection of some thoughts, occasionally security related
I recently played CSAW CTF 2021 with PPP. I worked with Anish on a cool challenge, grande, by @itszn13 . This was an Express node application which exposed some interesting behavior about Express’s query parsing. # Overview There were two steps in the challenge. The first was a XSS. This required creating an array-like object for which Array.isArray(obj) === false , which can be done with…
I found and reported these vulnerabilities with @ginkoid . In this post, I will discuss the root cause of these vulnerabilities, as well as briefly walk through the exploitation process. I’ll also include some thoughts about bug bounty in general at the end. These are the associated CVEs and payouts: CVE-2021-32804 ($10,000) CVE-2021-32803 ($2,000) CVE-2021-37701 ($2,500) CVE-2021-37712 (found…
This is an author writeup for the paired Chrome sandbox escape I made for redpwnCTF 2021 , Empires and Deserts . When writing this challenge, I wanted to create a sandbox escape where the solution is not obvious. In other words, the difficulty of the challenge arises not from exploiting the vulnerability - but in finding the vulnerability itself. # Introduction I think most good challenges have a…
Lately, I’ve been getting into Chrome sandbox exploitation. Having found and exploited a few sandbox escape vulnerabilities, I thought it would be fun to include these in a CTF. Unfortunately, one issue I faced while learning SBX is lack of online resources. I think conceptually, this attack surface is not exceedingly complex - at least compared to the renderer. In this blog post, I aim to provide…
I found and reported this vulnerability with @ginkoid . This was actually the first report that paid out for me on HackerOne. At $35,000, it’s also the highest bounty I’ve received so far from HackerOne (and I believe the highest GitHub has paid out to date). A lot of bugs seem to be a mix of both luck and intuition. In this blog post, I’ll illustrate my thought processes in approaching such a…
Over the summer of my junior year, I decided to do some router pentesting. Embedded security always seemed very fun to me. I liked the idea of breaking things that are found in our everyday lives, and what better place to start than my router. I was also inspired by my friend @arinerron who had some success with his router previously. I dumped the firmware and started analyzing the binaries in…
This is a bit of a departure from the norm on this blog. I thought it might be interesting to switch it up a bit, and talk about my experience with the American college application process. This is in part inspired by my friend @arinerron ’s post on school sponsored extracurriculars . I think college applications have quite a lot of symbolic value. They’re the culmination of a twelve-year…
This is an author writeup for Adult CSP, a Chromium sandbox escape that I wrote for DiceCTF 2021. # Overview I wanted to write a pseudo-realistic Chromium sandbox escape. In particular, this meant no helper functions to give leaks. There were a total of two intended vulnerabilities: UAF on Cat* for leaks UAF on CATServiceImpl* for controlled vcall Interestingly enough, both of these showed up in…
I recently won the SSD November challenge , the challenge itself was actually quite interesting. The first vulnerability was improper hashing. while (i < size) { tmp_value._0_1_ = input[i]; if (( int )( char )tmp_value * 10 < 0x20 ) { tmp_value._0_1_ = ( char )tmp_value % '\x05' ; } else { tmp_value._0_1_ = ( char )((( int )( char )tmp_value * 0x124343 ) % 0xef ); } input[i] = ( char )tmp_value; i…
The week before early admission deadline, perfect time to do a CTF and burn a weekend. # Analysis Libc version is 2.27, we get tcache without the security checks. As usual, the first thing we do is run checksec . [+] checksec for '/home/robert/writeups/binexp/meta20/dmzf/dmzf' Canary : ✓ NX : ✓ PIE : ✓ Fortify : ✘ RelRO : Full Canary, NX, PIE, Full RelRO - it’s a typical heap exploit challenge.…
## House of Red This is an author writeup for house-of-red and its sibling problem zero-the-hero , both of which appeared in the 2020 redpwnCTF . Their respective challenge repositories are also open sourced . This writeup presents a relatively novel exploitation technique, that can be applied to a wide range of challenges. ### Implications There are two prerequisites to execute this attack. Libc…
This was a very interesting challenge. # Analysis The libc version is 2.29. This implies the use of tcache bins, as well as additional protections against double-free. As usual, the first thing we do is run checksec . $ checksec shattered [*] '/home/robert/writeups/binexp/hsctf20/shattered/shattered' Arch: amd64-64-little RELRO: Full RELRO Stack: Canary found NX: NX enabled PIE: PIE enabled All…
This was one of the more interesting challenges I’ve done in a while. We were one of 4 teams who solved this binary exploitation challenge in DawgCTF . ## Analysis This was the only challenge where we were given a libc. Looks like it’s going to be a heap pwn. As usual, the first thing we do is look at the protections on the binary. $ checksec tiktok [*]…
I recently competed in Codegate CTF 2020 under the junior category. This was the one of the more interesting challenges that I solved. ## Summary This was more of a reversing problem than pwn. The llvm served only to obfuscated the code, as opposed to raising any challenges itself. ## Analysis Three observations are needed to solve the problem. The data pointer can be out of bounds after a…
I competed in Tasteless CTF this weekend with redpwn. We solved one challenge, House of Bad Taste, which was an interesting glibc heap pwn. # House of Bad Taste ## Flag tctf{p01nt3r_c00k1e_b3st_c00ki3!} ## Analysis As usual, the first step is to run checksec against the binary. $ checksec chall [*] '/pwn/tasteless19/house-of-bad-taste/chall' Arch: amd64-64-little RELRO: Full RELRO Stack: Canary…
## Analysis The binary uses glibc version 2.29, which patches the double free vulnerability. ## Solution We are given the libc base address, so no leaks are needed. All we have to do is get a write. ### House of Poortho The vulnerability is that read() overwrites the first byte of the next chunk header with a null byte. If the next chunk has a size header with least significant byte not equal to…
## Flag flag{th3_r3al_questi0n_is_why_1s_libc_2.23_still_4_th1ng_62167e9e} ## Analysis $ strings libc.so.6 | grep GNU GNU C Library (Ubuntu GLIBC 2.23-0ubuntu11) stable release version 2.23, by Roland McGrath et al. Compiled by GNU CC version 5.4.0 20160609. GNU Libidn by Simon Josefsson $ checksec sice_cream Arch: amd64-64-little RELRO: Full RELRO Stack: Canary found NX: NX enabled PIE: No PIE…
## Flag picoCTF{nu11_byt3_Gh05T_41a29ece} ## Analysis $ ldd ghostdiary linux-vdso.so.1 (0x00007ffcabdd4000) libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ff81dd18000) /lib64/ld-linux-x86-64.so.2 (0x00007ff81e30c000) $ strings /lib/x86_64-linux-gnu/libc.so.6 | grep GNU GNU C Library (Ubuntu GLIBC 2.27-3ubuntu1) stable release version 2.27. Compiled by GNU CC version 7.3.0. $ checksec…
I was one of the two teams that solved Tumbler from CSAW Red . ### Problem Pwn 500 No way that cryptocurrency is a scam, that would NEVER happen nc pwn.chal.csaw.io 1000 ### Analysis The libc provided was 2.23. $ strings libc.so.6 | grep GNU GNU C Library (Ubuntu GLIBC 2.23-0ubuntu10) stable release version 2.23, by Roland McGrath et al. Compiled by GNU CC version 5.4.0 20160609. GNU Libidn by…
Creating a seating chart for a class is an extremely interesting problem that delves into the realms of both web design and competitive programming. ### Overview There are two questions I attempted to answer. How to create an easy to use interface that minimizes the cognitive load on the user How to best create the seating chart given a list of preferences for each student ### Algorithmn The…
Honestly, you should switch to c++. But if you insist on using Java, here are some cool tricks. ### Memory Memory allocation is extremely cheap (~1e6 bytes per 1ms) compared to everything else - don’t be afraid to allocate huge arrays. That being said, be careful you don’t hit a MLE. Be careful of the dimensional order of 2D arrays. int [][] memory = new int [( int ) 1e7 ][ 3 ] is 10 million…
This is an account takeover attack I discovered on the open source Secret Hitler game. By submitting crafted parameters to the /password-reset endpoint, attackers are able to takeover arbitrary non-staff accounts. This vulnerability can be mitigated by disabling JSON parsing. We control all of the parameters passed through req.body . const { username, password, password2, tok } = req.body; The…
Two low-moderate vulnerabilites on the open source Secret Hitler game. Note that a lot of the vulnerabilites are due to the use of JSON parsing , which allows attackers to submit arbitrary objects to the endpoints. ### Obfuscated IP Leakage The check in the /profile endpoint is unnecessarily complex, and forgets an edge case. if (req && req.user && requestingUser && requestingUser !== 'undefined'…
Cryptography - 700 ### Problem Statement Dr. Xernon has finally approved an update to James Brahm’s spy terminal. (Someone finally told them that ECB isn’t secure.) Fortunately, CBC mode is safe! Right? Connect with nc 2018shell1.picoctf.com 22666 . source Hint: What killed SSL3? ### Research Googling the hint, we come across the POODLE attack. Apparently, this problem uses a weak form of…
Misc - 900 ### Description This is a classic machine learning problem. We came across this article and copy much of the template code from there. I wrote my code in a Jupyter notebook. The only problem that I encountered was that of the learning rate. The example’s learning rate was way too small, and resulted in no progress. In order to solve, I set the learning rate to 1e7 and decayed it by 0.99…
Written by nthistle ### Problem Statement If you stare into the abyss, the abyss stares back. nc problem1.tjctf.org 8006 ### Observations The first observation is that this is a Python environment. However, further experimentation reveals that all our errors are eaten up with a cute message. >>> blahblop The Abyss consumed your error. Furthermore, some words seem to be banned. >>> ().__class__…