Binary Exploitation – Petir Cyber Security

December 30, 2018

[35c3CTF] – Collection

Posted in Binary Exploitation by tempestuous Leave a Comment

Sebenarnya saya baru solve ini +12 jam setelah CTF berakhir, dengan bantuan rekan tim Auxy dan Kileak. File berada di sini. Kita diberikan 5 file:

python3.6:                                  ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=9dae0eec9b3f9cb82612d20dc0c3088feab9e356, stripped
libc-2.27.so:                               ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0, for GNU/Linux 3.2.0, stripped
Collection.cpython-36m-x86_64-linux-gnu.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=241f5274d685b0cd35c64b14f024fb7171ea04b2, stripped
server.py:                                  Python script, ASCII text executable
test.py:                                    ASCII text

python3.6: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=9dae0eec9b3f9cb82612d20dc0c3088feab9e356, stripped

libc-2.27.so: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0, for GNU/Linux 3.2.0, stripped

Collection.cpython-36m-x86_64-linux-gnu.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=241f5274d685b0cd35c64b14f024fb7171ea04b2, stripped

server.py: Python script, ASCII text executable

test.py: ASCII text

Mari kita lihat isi dari server dan test:

import os
import tempfile
import os
import string
import random

def randstr():
    return ''.join(random.choice(string.ascii_uppercase + string.digits + string.ascii_lowercase) for _ in range(10))


flag = open("flag", "r")


prefix = """
from sys import modules
del modules['os']
import Collection
keys = list(__builtins__.__dict__.keys())
for k in keys:
    if k != 'id' and k != 'hex' and k != 'print' and k != 'range':
        del __builtins__.__dict__[k]

"""


size_max = 20000

print("enter your code, enter the string END_OF_PWN on a single line to finish")


code = prefix
new = ""
finished = False

while size_max > len(code):
    new = raw_input("code> ")
    if new == "END_OF_PWN":
        finished = True
        break
    code += new + "\n"

if not finished:
    print("max length exceeded")
    sys.exit(42)


file_name = "/tmp/%s" % randstr()
with open(file_name, "w+") as f:
    f.write(code.encode())


os.dup2(flag.fileno(), 1023)
flag.close()

cmd = "python3.6 -u %s" % file_name
os.system(cmd)

import os

import tempfile

import os

import string

import random

def randstr():

return ''.join(random.choice(string.ascii_uppercase + string.digits + string.ascii_lowercase) for _ in range(10))

flag = open("flag", "r")

prefix = """

from sys import modules

del modules['os']

import Collection

keys = list(__builtins__.__dict__.keys())

for k in keys:

if k != 'id' and k != 'hex' and k != 'print' and k != 'range':

del __builtins__.__dict__[k]

"""

size_max = 20000

print("enter your code, enter the string END_OF_PWN on a single line to finish")

code = prefix

new = ""

finished = False

while size_max > len(code):

new = raw_input("code> ")

if new == "END_OF_PWN":

finished = True

break

code += new + "\n"

if not finished:

print("max length exceeded")

sys.exit(42)

file_name = "/tmp/%s" % randstr()

with open(file_name, "w+") as f:

f.write(code.encode())

os.dup2(flag.fileno(), 1023)

flag.close()

cmd = "python3.6 -u %s" % file_name

os.system(cmd)

import Collection

a = Collection.Collection({"a":1337, "b":[1.2], "c":{"a":45545}})

print(a.get("a"))
print(a.get("b"))
print(a.get("c"))

import Collection

a = Collection.Collection({"a":1337, "b":[1.2], "c":{"a":45545}})

print(a.get("a"))

print(a.get("b"))

print(a.get("c"))

Ingat bahwa file flag sudah dibuka dan berada pada fd nomor 1023. Pada pertamanya, mungkin ini akan terlihat seperti […]

November 12, 2018

[HCTF 2018] – babyprintf

Posted in Binary Exploitation by tempestuous Leave a Comment

baby printf comes again :)

nc 150.109.44.250 20005
nc 150.109.46.159 20005

URL http://phx0fp4pe.bkt.clouddn.com/babyprintf_ver2_99aaef89552b3713c7dc756f96475b9bdd6c6558f5ba44572bde923f33a30f23.zip

Base Score 1000.00
Now Score 480.42
Team solved 19

baby printf comes again :)

nc 150.109.44.250 20005

nc 150.109.46.159 20005

URL http://phx0fp4pe.bkt.clouddn.com/babyprintf_ver2_99aaef89552b3713c7dc756f96475b9bdd6c6558f5ba44572bde923f33a30f23.zip

Base Score 1000.00

Now Score 480.42

Team solved 19

Sebelum ke writeup, ada baiknya pembaca membaca artikel ini terlebih dulu, agar mendapat gambaran tentang struktur FILE dan FSOP. Script dan container ada di sini. Kita diberikan binary dan libc dengan konfigurasi sebagai berikut: printf dan fortifikasi yang dinyalakan adalah kombinasi yang sangat buruk, berikut screenshot yang menjelaskan mengapa: Singkatnya, kita tidak […]

November 11, 2018November 12, 2018

[HCTF 2018] the end

Posted in Binary Exploitation by tempestuous Leave a Comment

where is the end?

nc 150.109.44.250 20002
nc 150.109.46.159 20002

URL http://phx0fp4pe.bkt.clouddn.com/the_end_890eb79d67925bd059ffb9ba60697f4d19cc2bbd923f474b2a84daaa22e59068.zip

Base Score 1000.00
Now Score 298.34
Team solved 46

where is the end?

nc 150.109.44.250 20002

nc 150.109.46.159 20002

URL http://phx0fp4pe.bkt.clouddn.com/the_end_890eb79d67925bd059ffb9ba60697f4d19cc2bbd923f474b2a84daaa22e59068.zip

Base Score 1000.00

Now Score 298.34

Team solved 46

Sebelum ke writeup, ada baiknya pembaca membaca tentang struktur FILE dan FSOP pada artikel ini (karena orang ini menjelaskan dengan lebih baik dibandingkan penulis sendiri). script exploit dan container dapat diambil di sini. Diberikan binary dan libc dengan konfigurasi sebagai berikut: Mari kita lihat pseudocode dari IDA:

void main()
{
    void *buf;

    sleep(0);

    printf("here is a gift %p, good luck ;)\n", &sleep);
    fflush(stdout);

    close(1);
    close(2);

    for (int i=0; i<=4;i++)
    {
        read(0, &buf, 8);
        read(0, buf, 1);
    }

    exit(1337);
}

void main()

{

void *buf;

sleep(0);

printf("here is a gift %p, good luck ;)\n", &sleep);

fflush(stdout);

close(1);

close(2);

for (int i=0; i<=4;i++)

{

read(0, &buf, 8);

read(0, buf, 1);

}

exit(1337);

}

Ini terlihat buruk… stdout […]

October 29, 2018

[P.W.N. CTF 2018] Exploitation Class

Posted in Binary Exploitation by tempestuous Leave a Comment

Exploitation Class – 200 + 156 points (11 solves) File di sini. Diberikan binary dan libc dengan konfigurasi sebagai berikut:

exploitClass: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=ecd82897ed2390ae18cc6617ce41dc4e7a163333, not stripped
[*] '/home/tempest/CTF/pwnuni18/pwn/exploitclass/exploitClass'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

GNU C Library (GNU libc) stable release version 2.28.

exploitClass: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=ecd82897ed2390ae18cc6617ce41dc4e7a163333, not stripped

[*] '/home/tempest/CTF/pwnuni18/pwn/exploitclass/exploitClass'

Arch: amd64-64-little

RELRO: Full RELRO

Stack: Canary found

NX: NX enabled

PIE: PIE enabled

GNU C Library (GNU libc) stable release version 2.28.

Konfigurasi ini terlihat buruk… Mari kita jalankan programnya:

Welcome to the student registration service for the binary exploitation class in WS18!
Enter 1 to read, 2 to write and any other number to exit!
1
Which entry to show?
0
John
Enter 1 to read, 2 to write and any other number to exit!
2
Which entry to write?
0
What to write?
abcdabcd
Enter 1 to read, 2 to write and any other number to exit!
0
Closing session!

Welcome to the student registration service for the binary exploitation class in WS18!

Enter 1 to read, 2 to write and any other number to exit!

Which entry to show?

John

Enter 1 to read, 2 to write and any other number to exit!

Which entry to write?

What to write?

abcdabcd

Enter 1 to read, 2 to write and any other number to exit!

Closing session!

Penulis berasumsi bahwa akan ada vulnerability seperti Out of Bound (OOB) read/write. Berikut pseudocode dari IDA Pro untuk read dan write […]

October 28, 2018

[Seccon CTF 2018] – profile

Posted in Binary Exploitation by tempestuous Leave a Comment

Profile – 255 (64 solves) File dapat ditemukan di sini. Diberikan binary dengan konfigurasi sebagai berikut:

profile: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=80d81e528f97618c35e57b145a0c11df21769e67, not stripped
[*] '/home/tempest/CTF/seccon18/pwn/profile/profile'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)
    linux-vdso.so.1 (0x00007ffe177d5000)
    libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007f48ec73c000)
    libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f48ec524000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f48ec133000)
    libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f48ebd95000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f48ecac5000)

profile: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=80d81e528f97618c35e57b145a0c11df21769e67, not stripped

[*] '/home/tempest/CTF/seccon18/pwn/profile/profile'

Arch: amd64-64-little

RELRO: Partial RELRO

Stack: Canary found

NX: NX enabled

PIE: No PIE (0x400000)

linux-vdso.so.1 (0x00007ffe177d5000)

libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007f48ec73c000)

libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f48ec524000)

libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f48ec133000)

libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f48ebd95000)

/lib64/ld-linux-x86-64.so.2 (0x00007f48ecac5000)

Terlihat bahwa ini merupakan program C++ (asumsi awal: ini adalah heap exploitation). Ketika program dijalankan:

Please introduce yourself!
Name >> abcdabcd
Age >> 14
Message >> huehuehue

1 : update message
2 : show profile
0 : exit
>>

Please introduce yourself!

Name >> abcdabcd

Age >> 14

Message >> huehuehue

1 : update message

2 : show profile

0 : exit

Profile merupakan sebuah class dengan definisi sebagai berikut (menurut analisa penulis):

class Profile
{
	private:
		std::string msg;
		int age;
		std::string name;

	public:
		Profile(){}
		~Profile(){}

		void set_name(std::string name){ this->name = name; }
		void set_age(int age){ this->age = age; }
		void set_msg(std::string msg){ this->msg = msg; }

		void update_msg();
		void show();
};

class Profile

{

private:

std::string msg;

int age;

std::string name;

public:

Profile(){}

~Profile(){}

void set_name(std::string name){ this->name = name; }

void set_age(int age){ this->age = age; }

void set_msg(std::string msg){ this->msg = msg; }

void update_msg();

void show();

};

Penulis mengasumsikan bahwa vulnerability terdapat pada method […]

October 14, 2018October 14, 2018

[Cyber Jawara Final 2018] – Hades

Posted in Binary Exploitation by tempestuous Leave a Comment

Diberikan binary dan libc sebagai berikut (link di bawah): Fungsi main hanya mematikan buffering dan memanggil fungsi service. Pada fungsi tersebut, terdapat 2 pilihan menu, yaitu input angka dan keluar. Kelemahannya terdapat pada input angka; berikut pseudocodenya:

void insert(unsigned long long *array)
{
	canary = read_canary();
	unsigned long long number;
	int counter;
	for(int i=0;i<2048;i++) array[i] = 0;
	counter = 0;
	while(1)
	{
		scanf("%llu",&number);
		if(!number) break;
		array[counter++] = number;
	}
	compute_lis(array);
	getchar();
	if(canary ^ read_canary()) __stack_chk_fail();
}

void insert(unsigned long long *array)

{

canary = read_canary();

unsigned long long number;

int counter;

for(int i=0;i<2048;i++) array[i] = 0;

counter = 0;

while(1)

{

scanf("%llu",&number);

if(!number) break;

array[counter++] = number;

}

compute_lis(array);

getchar();

if(canary ^ read_canary()) __stack_chk_fail();

}

Jika kita lihat, terdapat Out-Of-Bound write pada variabel counter, karena tidak divalidasi terhadap size array. […]

September 1, 2018September 25, 2018

[Tokyo Western 2018] – load

Posted in Binary Exploitation by tempestuous Leave a Comment

load – (? solves) host : pwn1.chal.ctf.westerns.tokyo port : 34835 Tidak ada deskripsi, hanya diberikan host, port, dan sebuah file (tanpa libc). File dapat di download di sini Kelihatannya seperti buffer overflow… Jika program dijalankan: Saya sudah mempersiapkan flag bohongan. Nampaknya, program hanya membaca isi file, kemudian keluar. Mari kita lihat pseudocode dari program: […]

August 4, 2018August 4, 2018

[HackToday 2018] – nullflag

Posted in Binary Exploitation by tempestuous 1 Comment

nullflag (1 solve) Deskripsi: Maybe it’s funny if shorter

nc 103.56.207.107 30004

1 2	nc 103.56.207.107 30004

Soal ini solved atas dasar asumsi bahwa program dijalankan pada Ubuntu 16.04 dengan libc-2.23-x.so (x merupakan sub-versi dari libc-2.23; note: setiap versi memiliki offset library yang berbeda). Diberikan sebuah binary: Ini terlihat seperti skenario buffer overflow biasa. Berikut adalah disassembly dari program. Init hanya digunakan […]

August 1, 2018August 22, 2018

[how2bof]: Level 5 (bof5)

Posted in Binary Exploitation by Daniel Kong Leave a Comment

Pendahuluan

Source: https://github.com/Caesurus/how2bof
Introduction into ASLR, and using return to libc (ret2libc) for popping a shell.

1 2	Source: https://github.com/Caesurus/how2bof Introduction into ASLR, and using return to libc (ret2libc) for popping a shell.

Pertama-tama, mari kita lihat ciri-ciri dari binary ini: Binary tersebut merupakan binary 32-bit dengan fitur NX yang dinyalakan (kita tidak bisa memasukkan shellcode kita sendiri ke dalam stack.) Fitur ASLR juga diaktifkan (alamat libc akan berubah tiap kali kita menjalankan ldd) sehingga sedikit mempersulit peretasan binary ini. Mari kita jalankan binary ini terlebih […]

July 30, 2018July 30, 2018

[Slashroot 3.0] – rubycalc_v1_0

Posted in Binary Exploitation by tempestuous

Diberikan sebuah script ruby:

#!/usr/local/bin/ruby

require 'safe_ruby' # gem install safe_ruby

def eval(str)
    SafeRuby.eval(str)
end

def main
    puts %q(RubyCalc v1.0
Copyright 2018 SlashRoot CTF.
This is open source software with ABSOLUTELY NO WARRANTY.)
    loop do
        i = 0
        print "calc:#{i}> "
        inp = ''
        while (cons_inp = gets.chomp.downcase) != 'end'
            print "calc:#{i+=1}> "
            cons_inp.size == 0 ?  inp << cons_inp << "\n" : inp << cons_inp
        end
        check = /^\s*-?\d+(?:\s*[\-\+\*\/]\s*\d+)+$/
        puts (inp =~ check ? "=> #{inp} = #{eval(inp)}" : "=> Example: 5+1+3+2")
        rescue
           puts "\e[1;31m>> Please, input number and math operator only!\e[0m"
           !exit
        end
    end
end

if __FILE__ == $0
    $stdout.sync = true
    $stdin.sync = true
    main
end

#!/usr/local/bin/ruby

require 'safe_ruby' # gem install safe_ruby

def eval(str)

SafeRuby.eval(str)

end

def main

puts %q(RubyCalc v1.0

This is open source software with ABSOLUTELY NO WARRANTY.)

loop do

i = 0

print "calc:#{i}> "

inp = ''

while (cons_inp = gets.chomp.downcase) != 'end'

print "calc:#{i+=1}> "

cons_inp.size == 0 ? inp << cons_inp << "\n" : inp << cons_inp

end

check = /^\s*-?\d+(?:\s*[\-\+\*\/]\s*\d+)+$/

puts (inp =~ check ? "=> #{inp} = #{eval(inp)}" : "=> Example: 5+1+3+2")

rescue

puts "\e[1;31m>> Please, input number and math operator only!\e[0m"

!exit

end

if __FILE__ == $0

$stdout.sync = true

$stdin.sync = true

main

end

Pada awalnya, kode ini terlihat “aman“, karena 2 hal: pengecekan regex yang strict safe_ruby Challenge ini mirip dengan Final HackToday 2017 mathservice. Pada ruby terdapat kelemahan regex, yaitu pengecekan strict hanya dilakukan pada line pertama saja; jika terdapat input yang lebih dari satu, regex tidak akan mengecek line kedua dan […]