#pwnable

[aydin21-blog]

Pwnable Task: [Cmd1]

I have solved another pwnable CTF challenge, this time it was the “Cmd1″ challenge. The code file for this particular challenge was rather small, only around 10 lines.  The code was fairly straight forward. If your input contained the certian terms “flag”, “sh”, or “tmp” it would be rejected, otherwise, it would place the input into the system() function. I looked up what the system() function does and it simply takes its input and runs it as code. I noticed that the code that would provide us with the flag would be along the lines of “cat flag” however this would be rejected to the the “flag” check in filter. I was also curious as to what exactly the putenv(...) line of code was doing so I checked the file path and found that it was a list of all the directories where the data was located. After trying to figure out exactly what this would do, I found at that it meant I needed to enter the whole path of the cat data (i.e. add /bin to it). This resolved the environment issue but I was still at a loss over how to get around the filter function. After looking up how to get around it, I found that adding quotation marks when entered result in an output without the quotation marks (i.e. ‘f’’l’’a’’g’, would lead to flag). I thought I may as well try this and entered the input “/bin/cat ‘f’’l’’a’’g’” which turned out to work and printed out the flag. 

From this challenge, I learnt what the putenv() function does and how quotation marks in a line of input can be removed when entered in output.

[aydin21-blog]

Pwnable Task: [Lotto]

I have solved another pwnable challenge, “lotto”. At first looking at this code I thought I could maybe keep guessing and hoping for the best (this was a foolish thought but I thought might as well try my luck). After several attempts I got over guessing and knew that this wasn’t what was intended for this challenge. I decided to look closely into the code for the play path of this challenge. It took me a while but I noticed that the supposed integer inputs for the game were actually stored as char variables. Finding this out, and knowing that the lotto only takes in numbers between 1 and 45, I narrowed it down to the range of 33 to 45. These numbers in the ascii table consist of these characters; !”#$%&’()*+,-.

So, with this I decided to try entering random sets of these characters into the guessing input. After several tries I never won the lotto game. I looked into the code again and checked how these values were actually treated and checked. I noticed that the snippet of code which calculated the lotto score (the score which determined if you won, needed to be 6), iterated over every character in the input. So, if I were to enter any of these possible characters 6 times, it would greater increase my chance of winning.

After several tries of entering the same character 6 times, I finally won the game and acquired the flag.

From this challenge, I learnt how pointless it is to randomly guess numbers and hope for the best (XD). But really, I learnt simple mistakes such as setting values as the wrong type or code snippets which works but is logically wrong can lead to faults in a code file and be exploited. 

[aydin21-blog]

Pwnable Task: [Shellshock]

I have solved another CTF challenge on pwnable, the “shellshock” challenge. At first inspection I wasn’t sure what this challenge required so I decided to look up what “shellshock” meant, I found out that it was actually a vulnerability in the bash shell user interface. After learning a little bit more about it, and googling some of the function calls in the code provided in the challenge, I better understood what was happening in the code and what needed to be done. I figured out that I needed to set a environment variable that contained the functions and commanded that were needed to be executed in order to acquire the flag before running the code. After setting it up and running the code, I successfully acquired the flag, and solved the challenge.

I learnt from this challenge a bit on what a shellshock is and how it can be used to exploit things. 

[aydin21-blog]

Pwnable Task: [Mistake]

I have solved my 4th CTF challenge on pwnable, “Mistake”.  Like I did for the other ones I solved, I started by looking into the contents of the c file for hints. After reading through it several times, trying to find something to go off of. I realised that I wasn’t quite sure how the if statement containing the open() function worked as I’ve never actually seen or created an if clause like that before. So I looked into it to see how it works. This however didn’t help me understand what I needed to do to solve the challenge. I also realised that this particular challenge gave a clue about a mistake in operator priority. After looking through the code again I noticed that in that same if case I looked up there are 2 operators used within it, ‘=‘ and ‘<’.  I searched up and found that the ‘<’ has higher priority than the ‘=‘ operator and saw that it first checked if the value of open(...) was less than 0. It turned out that this case is always false and will return 0, hence it set fd (the value in the if case which is set ‘=‘ to the open() function) to 0. I remembered that from the first challenge, when fd is set to 0, it reads its value from stdin.

As a result, I found that the next if case caused the value from stdin to be set to the value of pw_buf, which later in the code would be xored with the value 1 (value 1 was set in the code). This value would then be compared with the second input which is stored in pw_buf2. So, I had to find a way to make it so that the first input xored with 1 will lead to the second. After some tests I found that using 1′s in first input and 0′s in second input worked, and I acquired the flag.

This particular challenge taught me what operator priority was, and how it can be exploited to break a piece of code that was structured poorly with it. I also learnt how the open() function works in an if case.

[aydin21-blog]

Pwnable Task: [Random]

I have completed my third pwnable challenge, “Random”. From looking in the source code I saw that this file simply takes your input and checks if the value of your input, to the power of a random variable is equivalent to “0xdeadbeef”. In the code, we can see that it uses the rand() function, this function is known for being quite weak as it tends to follow the same randoming pattern. When a seed is not given to the rand function it will always start from the first random number in its pattern. Hence, if its called only once, it will always return the same thing. To find what this first term in the rand sequence was, I created a simple rand() file and ran it to see what value was returned. With this value, I then found the required key (input) by simply taking this ran value I found and taking it to the power of “0xdeadbeef”. After that, I got the key and then input it into the code and retrieved the flag. 

From this particualr pwnable task, I was required to do some research into the rand() function to understand how to exploit it for this challenge (as I already heard that it is a week random function from Richard in the lectures). As a result, this task helped me to learn more about how this function was flawed.

[aydin21-blog]

Pwnable Task: [Collision]

I have successfully completed the pwnable challenge “Collision” on pwnable. Firstly, i opened the c file provided and looked at its contents. I found that in order to access the flag I had to get past an if clause checking whether the input I provided matched the hash “0x21DD09EC”. I also saw, that the input to the code had to be of length 20 bytes, which derived to be equivalent to 5 integers (as one integer is 4 bytes). Within the check function that derives the check for the input, it simply adds these 5 inputs together.  After finding this, I thought I should find out the decimal value of the hashcode that the input is checked against, which was ‘568134124′. I then needed to divide this number by 5 to get the 5 inputs to enter into the code. However, this number is not divisible by 5, so after getting the value of dividing by 5, I added 4 of them together and subtracted that from the hashcode decimal to get the 5th. I now acquired the 5 inputs I need, however I when entering these in this decimal form, it was incorrect. I realised that I needed to convert it into the original hexadecimal form. After converting, I entered them into the code and acquired the flag.

I believe that from this challenge I didn’t learn all too much but it was fun trying to solve a hash collision problem which is taught in this course.

[ishaikhspear-blog]

CTF: bof

Topic: buffer overflow

Buffer overflows are the most common vulnerability exploit in software. “Lower level” languages like C and C++ are especially vulnerable to these kinds of attacks. Since in C you can deal with memory management almost manually, often common coding practices lead to easily exploited security vulnerability. 

 So for the next challenge I needed to download 2 files:

bof.c 

bof

Reading the bof.c file shows:

My first concerns after looking at this was that, since key was given as a parameter to the function perhaps the storage locations between key and overflow were physically far apart. To an extent I was correct but not so much that the distance would make the task impossible.

 I started to use gdb as it allowed me an easy way to inspect memory. So this is what I discovered. I ran gdb with a 32 bit register settings so that it wouldn’t be such a hassle overflowing 64 bit registers. 

At memory address 0x56555654 I saw the value 0xcafebabe. The same value being compared to key. So I put a break at address 0x56555654, so that when the program reached this point I would be able to inspect the memory addresses better. When asked to give an overflow to the system I inputed a load of A’s, just because I know the value of A is 41. 

After inspecting the next 30 registers. 

Okay let’s do that again this time but also without overwriting the memory address I am most concerned with :) .

So now we can see that exactly 13, 4 byte blocks later we land upon the value 0xdeadbeef, which we need to change to 0xcafebabe. So if we can write ‘A’ 13*4 times and then write the value 0xcafebabe backwards (little endian), we can overwrite the value of key and allow us to run a shell script inside the program.

So running this into server, we get. 

And there you go.

[aydin21-blog]

Pwnable First Task Complete

I have solved the first task found on the pwnable.kr website “[fd]”. To solve this challenge I read the contents within the fd.c file they provided, found that if I could set a certain variable to 0 then I would be able to provide further input into the file when run. Looking at the if case within the code, this value had to be the text “LETMEWIN” in order to get into the if case. Once I did this, I was presented with the flag.