Petir Cyber Security – Page 2 – Petir adalah tim lomba untuk kompetisi Capture The Flag (CTF) yang menjadi wadah untuk belajar lebih dalam tentang cyber security dengan intensif dan kompetitif dimana semua membernya adalah mahasiswa universitas bina nusantara

March 20, 2019April 29, 2019

[Vulnhub] – unknowndevice64

Posted in Pentest by ArkAngels Leave a Comment

Pada kesempatan kali ini, penulis ingin kembali berbagi pengalamannya dalam mengerjakan Vulnhub. Langsung saja gaskeun! 😀 Pertama kita menggunakan netdiscover untuk mencari IP address VM kita, berikut commandnya: $ sudo netdiscover -i wlp3s0 -r 172.20.10.1/24 Sepertinya, IP address VM kita ada di 172.20.10.12. Kalau begitu, langkah berikutnya adalah kita scan port untuk mencari tahu port […]

March 11, 2019April 29, 2019

[Vulnhub] – DC-1

Posted in Pentest by ArkAngels Leave a Comment

Pada kesempatan kali ini, penulis ingin berbagi pengalaman mengerjakan Vulnbox pertamanya. Kita diberikan sebuah VM yang kemudian langkah pertama adalah scan terlebih dahulu untuk mendapatkan IP dari vulnbox kita. Tools yang digunakan adalah netdiscover dan dengan perintah yang digunakan adalah: $ sudo netdiscover -i wlp3s0 -r 172.20.10.1/24 Dengan output sebagai berikut: Dari gambar diatas, sepertinya vulnbox […]

December 30, 2018

[35c3CTF] – Collection

Posted in Binary Exploitation by tempestuous Leave a Comment

Sebenarnya saya baru solve ini +12 jam setelah CTF berakhir, dengan bantuan rekan tim Auxy dan Kileak. File berada di sini. Kita diberikan 5 file:

python3.6:                                  ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=9dae0eec9b3f9cb82612d20dc0c3088feab9e356, stripped
libc-2.27.so:                               ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0, for GNU/Linux 3.2.0, stripped
Collection.cpython-36m-x86_64-linux-gnu.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=241f5274d685b0cd35c64b14f024fb7171ea04b2, stripped
server.py:                                  Python script, ASCII text executable
test.py:                                    ASCII text

python3.6: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=9dae0eec9b3f9cb82612d20dc0c3088feab9e356, stripped

libc-2.27.so: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=b417c0ba7cc5cf06d1d1bed6652cedb9253c60d0, for GNU/Linux 3.2.0, stripped

Collection.cpython-36m-x86_64-linux-gnu.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=241f5274d685b0cd35c64b14f024fb7171ea04b2, stripped

server.py: Python script, ASCII text executable

test.py: ASCII text

Mari kita lihat isi dari server dan test:

import os
import tempfile
import os
import string
import random

def randstr():
    return ''.join(random.choice(string.ascii_uppercase + string.digits + string.ascii_lowercase) for _ in range(10))


flag = open("flag", "r")


prefix = """
from sys import modules
del modules['os']
import Collection
keys = list(__builtins__.__dict__.keys())
for k in keys:
    if k != 'id' and k != 'hex' and k != 'print' and k != 'range':
        del __builtins__.__dict__[k]

"""


size_max = 20000

print("enter your code, enter the string END_OF_PWN on a single line to finish")


code = prefix
new = ""
finished = False

while size_max > len(code):
    new = raw_input("code> ")
    if new == "END_OF_PWN":
        finished = True
        break
    code += new + "\n"

if not finished:
    print("max length exceeded")
    sys.exit(42)


file_name = "/tmp/%s" % randstr()
with open(file_name, "w+") as f:
    f.write(code.encode())


os.dup2(flag.fileno(), 1023)
flag.close()

cmd = "python3.6 -u %s" % file_name
os.system(cmd)

import os

import tempfile

import os

import string

import random

def randstr():

return ''.join(random.choice(string.ascii_uppercase + string.digits + string.ascii_lowercase) for _ in range(10))

flag = open("flag", "r")

prefix = """

from sys import modules

del modules['os']

import Collection

keys = list(__builtins__.__dict__.keys())

for k in keys:

if k != 'id' and k != 'hex' and k != 'print' and k != 'range':

del __builtins__.__dict__[k]

"""

size_max = 20000

print("enter your code, enter the string END_OF_PWN on a single line to finish")

code = prefix

new = ""

finished = False

while size_max > len(code):

new = raw_input("code> ")

if new == "END_OF_PWN":

finished = True

break

code += new + "\n"

if not finished:

print("max length exceeded")

sys.exit(42)

file_name = "/tmp/%s" % randstr()

with open(file_name, "w+") as f:

f.write(code.encode())

os.dup2(flag.fileno(), 1023)

flag.close()

cmd = "python3.6 -u %s" % file_name

os.system(cmd)

import Collection

a = Collection.Collection({"a":1337, "b":[1.2], "c":{"a":45545}})

print(a.get("a"))
print(a.get("b"))
print(a.get("c"))

import Collection

a = Collection.Collection({"a":1337, "b":[1.2], "c":{"a":45545}})

print(a.get("a"))

print(a.get("b"))

print(a.get("c"))

Ingat bahwa file flag sudah dibuka dan berada pada fd nomor 1023. Pada pertamanya, mungkin ini akan terlihat seperti […]

December 9, 2018June 20, 2019

[Ringzer0] – What’s the Definition of NULL?

Posted in Web Exploitation by KyKz Leave a Comment

HARI INI KITA BELAJAR SQLi(te)! Soal yang ini agak lucu sih soalnya paradox gitu dan mengerti kenapa harus dijadikan paradox kayak gitu agak sulit. But we’ll get there in the process. Let’s start. Jadi kita dapet soal seperti ini pas dibuka: Nah, yang menarik adalah id=MQ== di urlnya (karena saya selalu ketriggered kalo ngeliat soal […]

December 1, 2018June 20, 2019

[Ringzer0] – Don’t mess with Noemie; she hates admin!

Posted in Web Exploitation by KyKz Leave a Comment

DID YOU HECKIN MISS ME?? Call me phoenix bcs I’m back from death. Okeh kali ini kita ambil soal dari Ringzer0, tempat fevorit saya karena saya jadi trendsetter di komunitas ini gara gara ringzero. Jadi soalnya seperti ini: Informasi yang kita dapat adalah: 1. Usernamenya bukan admin 2. … gak ada lagi sih… Dan kalau […]

November 12, 2018

[HCTF 2018] – babyprintf

Posted in Binary Exploitation by tempestuous Leave a Comment

baby printf comes again :)

nc 150.109.44.250 20005
nc 150.109.46.159 20005

URL http://phx0fp4pe.bkt.clouddn.com/babyprintf_ver2_99aaef89552b3713c7dc756f96475b9bdd6c6558f5ba44572bde923f33a30f23.zip

Base Score 1000.00
Now Score 480.42
Team solved 19

baby printf comes again :)

nc 150.109.44.250 20005

nc 150.109.46.159 20005

URL http://phx0fp4pe.bkt.clouddn.com/babyprintf_ver2_99aaef89552b3713c7dc756f96475b9bdd6c6558f5ba44572bde923f33a30f23.zip

Base Score 1000.00

Now Score 480.42

Team solved 19

Sebelum ke writeup, ada baiknya pembaca membaca artikel ini terlebih dulu, agar mendapat gambaran tentang struktur FILE dan FSOP. Script dan container ada di sini. Kita diberikan binary dan libc dengan konfigurasi sebagai berikut: printf dan fortifikasi yang dinyalakan adalah kombinasi yang sangat buruk, berikut screenshot yang menjelaskan mengapa: Singkatnya, kita tidak […]

November 11, 2018June 20, 2019

[HCTF 2018] – the end

Posted in Binary Exploitation by tempestuous Leave a Comment

where is the end?

nc 150.109.44.250 20002
nc 150.109.46.159 20002

URL http://phx0fp4pe.bkt.clouddn.com/the_end_890eb79d67925bd059ffb9ba60697f4d19cc2bbd923f474b2a84daaa22e59068.zip

Base Score 1000.00
Now Score 298.34
Team solved 46

where is the end?

nc 150.109.44.250 20002

nc 150.109.46.159 20002

URL http://phx0fp4pe.bkt.clouddn.com/the_end_890eb79d67925bd059ffb9ba60697f4d19cc2bbd923f474b2a84daaa22e59068.zip

Base Score 1000.00

Now Score 298.34

Team solved 46

Sebelum ke writeup, ada baiknya pembaca membaca tentang struktur FILE dan FSOP pada artikel ini (karena orang ini menjelaskan dengan lebih baik dibandingkan penulis sendiri). script exploit dan container dapat diambil di sini. Diberikan binary dan libc dengan konfigurasi sebagai berikut: Mari kita lihat pseudocode dari IDA:

void main()
{
    void *buf;

    sleep(0);

    printf("here is a gift %p, good luck ;)\n", &sleep);
    fflush(stdout);

    close(1);
    close(2);

    for (int i=0; i<=4;i++)
    {
        read(0, &buf, 8);
        read(0, buf, 1);
    }

    exit(1337);
}

void main()

{

void *buf;

sleep(0);

printf("here is a gift %p, good luck ;)\n", &sleep);

fflush(stdout);

close(1);

close(2);

for (int i=0; i<=4;i++)

{

read(0, &buf, 8);

read(0, buf, 1);

}

exit(1337);

}

Ini terlihat buruk… stdout […]

October 30, 2018June 20, 2019

[PicoCTF 2018] – fancy-alive-monitoring!

Posted in Web Exploitation by Reagle Val Leave a Comment

### URL : http://2018shell2.picoctf.com:56517/index.php Writeup Aslinya: https://github.com/liuhack/writeups/blob/master/2018/picoCTF/Fancy-alive-monitoring/README.md https://rawsec.ml/en/picoCTF-2018-write-up/#400-fancy-alive-monitoring-web Awalnya saya tidak mengerti cara menyelesaikan problem ini namun ketika beberapa orang ini membuat sebuah writeup tentang ” PicoCTF 2018 – fancy-alive-monitoring! ” saya jadi mengerti dan dapat membuat writeup ini yang saya coba sendiri dan berhasil maka saya tuliskan dalam bahasa indonesia Diberikan sebuah website […]

October 29, 2018June 20, 2019

[P.W.N. CTF 2018] – Exploitation Class

Posted in Binary Exploitation by tempestuous Leave a Comment

Exploitation Class – 200 + 156 points (11 solves) File di sini. Diberikan binary dan libc dengan konfigurasi sebagai berikut:

exploitClass: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=ecd82897ed2390ae18cc6617ce41dc4e7a163333, not stripped
[*] '/home/tempest/CTF/pwnuni18/pwn/exploitclass/exploitClass'
    Arch:     amd64-64-little
    RELRO:    Full RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      PIE enabled

GNU C Library (GNU libc) stable release version 2.28.

exploitClass: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=ecd82897ed2390ae18cc6617ce41dc4e7a163333, not stripped

[*] '/home/tempest/CTF/pwnuni18/pwn/exploitclass/exploitClass'

Arch: amd64-64-little

RELRO: Full RELRO

Stack: Canary found

NX: NX enabled

PIE: PIE enabled

GNU C Library (GNU libc) stable release version 2.28.

Konfigurasi ini terlihat buruk… Mari kita jalankan programnya:

Welcome to the student registration service for the binary exploitation class in WS18!
Enter 1 to read, 2 to write and any other number to exit!
1
Which entry to show?
0
John
Enter 1 to read, 2 to write and any other number to exit!
2
Which entry to write?
0
What to write?
abcdabcd
Enter 1 to read, 2 to write and any other number to exit!
0
Closing session!

Welcome to the student registration service for the binary exploitation class in WS18!

Enter 1 to read, 2 to write and any other number to exit!

Which entry to show?

John

Enter 1 to read, 2 to write and any other number to exit!

Which entry to write?

What to write?

abcdabcd

Enter 1 to read, 2 to write and any other number to exit!

Closing session!

Penulis berasumsi bahwa akan ada vulnerability seperti Out of Bound (OOB) read/write. Berikut pseudocode dari IDA Pro untuk read dan write […]

October 28, 2018

[Seccon CTF 2018] – profile

Posted in Binary Exploitation by tempestuous Leave a Comment

Profile – 255 (64 solves) File dapat ditemukan di sini. Diberikan binary dengan konfigurasi sebagai berikut:

profile: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=80d81e528f97618c35e57b145a0c11df21769e67, not stripped
[*] '/home/tempest/CTF/seccon18/pwn/profile/profile'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
    Stack:    Canary found
    NX:       NX enabled
    PIE:      No PIE (0x400000)
    linux-vdso.so.1 (0x00007ffe177d5000)
    libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007f48ec73c000)
    libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f48ec524000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f48ec133000)
    libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f48ebd95000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f48ecac5000)

profile: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=80d81e528f97618c35e57b145a0c11df21769e67, not stripped

[*] '/home/tempest/CTF/seccon18/pwn/profile/profile'

Arch: amd64-64-little

RELRO: Partial RELRO

Stack: Canary found

NX: NX enabled

PIE: No PIE (0x400000)

linux-vdso.so.1 (0x00007ffe177d5000)

libstdc++.so.6 => /usr/lib/x86_64-linux-gnu/libstdc++.so.6 (0x00007f48ec73c000)

libgcc_s.so.1 => /lib/x86_64-linux-gnu/libgcc_s.so.1 (0x00007f48ec524000)

libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f48ec133000)

libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007f48ebd95000)

/lib64/ld-linux-x86-64.so.2 (0x00007f48ecac5000)

Terlihat bahwa ini merupakan program C++ (asumsi awal: ini adalah heap exploitation). Ketika program dijalankan:

Please introduce yourself!
Name >> abcdabcd
Age >> 14
Message >> huehuehue

1 : update message
2 : show profile
0 : exit
>>

Please introduce yourself!

Name >> abcdabcd

Age >> 14

Message >> huehuehue

1 : update message

2 : show profile

0 : exit

Profile merupakan sebuah class dengan definisi sebagai berikut (menurut analisa penulis):

class Profile
{
	private:
		std::string msg;
		int age;
		std::string name;

	public:
		Profile(){}
		~Profile(){}

		void set_name(std::string name){ this->name = name; }
		void set_age(int age){ this->age = age; }
		void set_msg(std::string msg){ this->msg = msg; }

		void update_msg();
		void show();
};

class Profile

{

private:

std::string msg;

int age;

std::string name;

public:

Profile(){}

~Profile(){}

void set_name(std::string name){ this->name = name; }

void set_age(int age){ this->age = age; }

void set_msg(std::string msg){ this->msg = msg; }

void update_msg();

void show();

};

Penulis mengasumsikan bahwa vulnerability terdapat pada method […]