BLAHAJ/writeups
BLAHAJ
/
writeups
10
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

fix source language

This commit is contained in:
xenia 2020-07-26 02:54:33 -04:00
parent 6f8457e842
commit 32c1a47905
1 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
2020/3kctf/babym1ps/README.md
View File

@ -22,7 +22,7 @@ you can manually reverse for the password, it's not super complicated but just t
with using angr, i used angr. with using angr, i used angr.
``` ```python
# idk what this is, it's not important # idk what this is, it's not important
p.hook(0x00400550, angr.SIM_PROCEDURES["stubs"]["Nop"]()) p.hook(0x00400550, angr.SIM_PROCEDURES["stubs"]["Nop"]())
# shim other functions # shim other functions
@ -47,7 +47,7 @@ main based on the parameters and how they're used. i also recorded the values re
of PRNG, probably `rand()` during a concrete execution and added a custom SimProcedure for that. the of PRNG, probably `rand()` during a concrete execution and added a custom SimProcedure for that. the
rest is straightforward rest is straightforward
``` ```python
# call main # call main
st = p.factory.call_state(0x004005e0) st = p.factory.call_state(0x004005e0)
sm = p.factory.simulation_manager(st) sm = p.factory.simulation_manager(st)
@ -62,7 +62,7 @@ be leaked by the `printf()` call for the username, since that will keep printing
a null byte. the LSB of the cookie is always null, but by providing an overwrite of 1 char into the a null byte. the LSB of the cookie is always null, but by providing an overwrite of 1 char into the
cookie we can leak the whole thing. just remember to set the null back with the next overwrite. cookie we can leak the whole thing. just remember to set the null back with the next overwrite.
``` ```python
log.info("performing stack leak") log.info("performing stack leak")
p.send("A" * 129) p.send("A" * 129)
name = p.recvuntil("your pass") name = p.recvuntil("your pass")
@ -134,7 +134,7 @@ now it turns out the challenge author did it in 3 gadgets but weh. this also wor
and here's the code and here's the code
``` ```python
log.info("performing attack") log.info("performing attack")
pwd = b"dumbasspassword" pwd = b"dumbasspassword"
@ -180,3 +180,12 @@ were run on a real MIPS board).
the typical mitigation for this is to add additional ROP steps to call `sleep()` with a small value the typical mitigation for this is to add additional ROP steps to call `sleep()` with a small value
-- kernel context switching will flush the caches and then you'll be all set. -- kernel context switching will flush the caches and then you'll be all set.
## last word
it's kinda ironic to me how the challenge is named such that it appears to be a `baby`-type
challenge but then it also only got 3 solves. i wouldn't say it's not fairly straightforward once
you get into it, but for me personally having to find gadgets by hand was a major time sink, and it
sucks that the ghidra scripts mostly failed to find stuff even though there _are_ lots of useful
gadgets in the binary. i mean c'mon it's static libc, of course there are useful gadgets.
🦈✨