Python – PETIR CYBER SECURITY

May 14, 2020May 14, 2020

[Angstrom CTF 2020] – canary

Posted in Binary Exploitation by ArkAngels Leave a Comment

Diberikan sebuah binary dengan konfigurasi sebagai berikut: Berikut adalah list dari semua fungsi pada binary: Berikut adalah pseudocode dari fungsi yang memiliki celah:

unsigned __int64 greet()
{
  char format; // [rsp+0h] [rbp-60h]
  char v2; // [rsp+20h] [rbp-40h]
  unsigned __int64 v3; // [rsp+58h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  printf("Hi! What's your name? ");
  gets(&format);
  printf("Nice to meet you, ");
  strcat(&format, "!\n");
  printf(&format);
  printf("Anything else you want to tell me? ");
  gets(&v2);
  return __readfsqword(0x28u) ^ v3;
}

unsigned __int64 greet()

{

char format; // [rsp+0h] [rbp-60h]

char v2; // [rsp+20h] [rbp-40h]

unsigned __int64 v3; // [rsp+58h] [rbp-8h]

v3 = __readfsqword(0x28u);

printf("Hi! What's your name? ");

gets(&format);

printf("Nice to meet you, ");

strcat(&format, "!\n");

printf(&format);

printf("Anything else you want to tell me? ");

gets(&v2);

return __readfsqword(0x28u) ^ v3;

}

Dilihat program menggunakan gets() yang memiliki kelemahan buffer overflow dan printf(&format) memiliki kelemahan format string attack. Tujuan dari soal ini adalah untuk memanggil fungsi flag(). Namun dari nama soal dan konfigurasi binary, terdapat stack canary […]

May 14, 2020May 14, 2020

[Joints2020] – crackme

Posted in Reverse Engineering by ArkAngels Leave a Comment

Diberikan sebuah binary 64 bit not stripped. Pseudocode dari fungsi main adalah sebagai berikut:

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char v4; // [rsp+0h] [rbp-30h]
  _BYTE v5[3]; // [rsp+5h] [rbp-2Bh]
  _BYTE v6[6]; // [rsp+Ah] [rbp-26h]
  int v7; // [rsp+14h] [rbp-1Ch]
  char v8; // [rsp+19h] [rbp-17h]
  unsigned __int64 v9; // [rsp+28h] [rbp-8h]

  v9 = __readfsqword(0x28u);
  __isoc99_scanf("%5c-%5c-%5c-%5c-%5c", &v4, v5, v6, &v6[5], &v7);
  v8 = 0;
  if ( checker(&v4) )
    unlock();
  else
    printf("Invalid serial key");
  return 0;
}

int __cdecl main(int argc, const char **argv, const char **envp)

{

char v4; // [rsp+0h] [rbp-30h]

_BYTE v5[3]; // [rsp+5h] [rbp-2Bh]

_BYTE v6[6]; // [rsp+Ah] [rbp-26h]

int v7; // [rsp+14h] [rbp-1Ch]

char v8; // [rsp+19h] [rbp-17h]

unsigned __int64 v9; // [rsp+28h] [rbp-8h]

v9 = __readfsqword(0x28u);

__isoc99_scanf("%5c-%5c-%5c-%5c-%5c", &v4, v5, v6, &v6[5], &v7);

v8 = 0;

if ( checker(&v4) )

unlock();

else

printf("Invalid serial key");

return 0;

}

Dilihat program meminta input sepanjang 25 karakter dan kemudian input akan diproses oleh fungsi checker() dan bila hasil dari checker() adalah true maka fungsi unlock() akan dipanggil. Berikut pseudocode dari fungsi unlock():

int unlock()
{
  char i; // al
  FILE *stream; // [rsp+8h] [rbp-8h]

  stream = fopen("flag.txt", "r");
  for ( i = fgetc(stream); i != -1; i = fgetc(stream) )
    putchar(i);
  return fclose(stream);
}

int unlock()

{

char i; // al

FILE *stream; // [rsp+8h] [rbp-8h]

stream = fopen("flag.txt", "r");

for ( i = fgetc(stream); i != -1; i = fgetc(stream) )

putchar(i);

return fclose(stream);

}

Fungsi tersebut akan membuka file flag.txt pada server nc. Berikut pseudocode dari fungsi checker():

November 5, 2019

[KKSI 2019] – siapGRAAK

Posted in Reverse Engineering by Jason Theopilus 2 Comments

Soal ini dapat kalian download disini Pada kita diberikan soal berupa ELF 64-bit.

root@kali:~# file siapGRAAK 
siapGRAAK: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a8680e08d2a4cd7f23306ac67459036c1f914f7e, not stripped

1 2	root@kali:~# file siapGRAAK siapGRAAK: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a8680e08d2a4cd7f23306ac67459036c1f914f7e, not stripped

kita coba jalankan program ini terlebih dahulu,

root@kali:~# ./siapGRAAK 
Flag nya apa nih Kang ?:
iWantThatFLagg
SALAH NIH

root@kali:~# ./siapGRAAK

Flag nya apa nih Kang ?:

iWantThatFLagg

SALAH NIH

kita coba lihat program ini menggunakan IDA pro 64-bit, dan pada mainnya terdapat psudeocode seperti ini,

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int result; // eax
  size_t i; // [rsp+0h] [rbp-C0h]
  size_t v5; // [rsp+8h] [rbp-B8h]
  char s2[8]; // [rsp+10h] [rbp-B0h]
  __int64 v7; // [rsp+18h] [rbp-A8h]
  __int64 v8; // [rsp+20h] [rbp-A0h]
  int v9; // [rsp+28h] [rbp-98h]
  __int16 v10; // [rsp+2Ch] [rbp-94h]
  char s[136]; // [rsp+30h] [rbp-90h]
  unsigned __int64 v12; // [rsp+B8h] [rbp-8h]

  v12 = __readfsqword(0x28u);
  *(_QWORD *)s2 = -821479746076235608LL;
  v7 = -4697167109371201534LL;
  v8 = -6839456764105678448LL;
  v9 = 1520982160;
  v10 = 61;
  puts("Flag nya apa nih Kang ?:");
  fgets(s, 128, stdin);
  s[strlen(s) - 1] = 0;
  v5 = strlen(s);
  for ( i = 0LL; i < v5; ++i )
    s[i] = get_tbl_entry((unsigned int)s[i]);
  if ( v5 == 29 )
  {
    if ( !strncmp(s, s2, 0x1EuLL) )
    {
      puts("YESSS BERHASIL");
      result = 0;
    }
    else
    {
      puts("SALAH NIH");
      result = 1;
    }
  }
  else
  {
    puts("SALAH NIH");
    result = 1;
  }
  return result;
}

int __cdecl main(int argc, const char **argv, const char **envp)

{

int result; // eax

size_t i; // [rsp+0h] [rbp-C0h]

size_t v5; // [rsp+8h] [rbp-B8h]

char s2[8]; // [rsp+10h] [rbp-B0h]

__int64 v7; // [rsp+18h] [rbp-A8h]

__int64 v8; // [rsp+20h] [rbp-A0h]

int v9; // [rsp+28h] [rbp-98h]

__int16 v10; // [rsp+2Ch] [rbp-94h]

char s[136]; // [rsp+30h] [rbp-90h]

unsigned __int64 v12; // [rsp+B8h] [rbp-8h]

v12 = __readfsqword(0x28u);

*(_QWORD *)s2 = -821479746076235608LL;

v7 = -4697167109371201534LL;

v8 = -6839456764105678448LL;

v9 = 1520982160;

v10 = 61;

puts("Flag nya apa nih Kang ?:");

fgets(s, 128, stdin);

s[strlen(s) - 1] = 0;

v5 = strlen(s);

for ( i = 0LL; i < v5; ++i )

s[i] = get_tbl_entry((unsigned int)s[i]);

if ( v5 == 29 )

{

if ( !strncmp(s, s2, 0x1EuLL) )

{

puts("YESSS BERHASIL");

result = 0;

}

else

{

puts("SALAH NIH");

result = 1;

}

else

{

puts("SALAH NIH");

result = 1;

}

return result;

}

dapat dipahami bahwa inputan kita dilakukan pengolahan pada fungsi get_tbl_entry() pada setiap char inputan kita. Mari kita lihat isi […]

August 12, 2019

[HackToday 2019 Qualification] – nani the fuk

Posted in Reverse Engineering by redspiracy Leave a Comment

Diberikan sebuah soal berbentuk binary, binary dapat di download di: https://s.id/6aIo7 Jika binary dieksekusi maka binary akan meminta input, setelah mencoba inputan, ternyata program hanya menerima input 1 karakter, seperti berikut Ketika input yang dimasukan salah maka program akan exit. Program tersebut terlihat seperti akan meminta input 1 karakter sebanyak 20 kali seperti yang […]

August 7, 2019August 7, 2019

[PicoCTF2018] – A Simple Question

Posted in Web Exploitation by Bryan Lee Leave a Comment

Writeup Reference https://github.com/shiltemann/CTF-writeups-public/tree/master/PicoCTF_2018#web-exploitation-650-a-simple-question Challenge Description : There is a website running at http://2018shell1.picoctf.com:36052 (link). Try to see if you can answer its question. Tampilan pertama setelah meng-klik link diatas adalah : Pertama penulis mengecek source code yang tertera :

<!doctype html>
<html>
<head>
    <title>Question</title>
    <link rel="stylesheet" type="text/css" href="//maxcdn.bootstrapcdn.com/bootstrap/3.3.5/css/bootstrap.min.css">
</head>
<body>
<div class="container">
    <div class="row">
        <div class="col-md-12">
            <div class="panel panel-primary" style="margin-top:50px">
                <div class="panel-heading">
                    <h3 class="panel-title">A Simple Question</h3>
                </div>
                <div class="panel-body">
                    <div>
                        What is the answer?
                    </div>  
                    <form action="answer2.php" method="POST">
<!-- source code is in answer2.phps -->
                        <fieldset>
                            <div class="form-group">
                                <div class="controls">
                                    <input id="answer" name="answer" class="form-control">
                                </div>
                            </div>

                            <input type="hidden" name="debug" value="0">

                            <div class="form-actions">
                                <input type="submit" value="Answer" class="btn btn-primary">
                            </div>
                        </fieldset>
                    </form>
                </div>
            </div>
        </div>
    </div>
</div>
</body>
</html>

<!doctype html>

<html>

<head>

<title>Question</title>

</head>

<body>

<h3 class="panel-title">A Simple Question</h3>

</div>

<div>

What is the answer?

</div>

</div>

</div>

</fieldset>

</form>

</div>

</body>

</html>

<!– source code is in answer2.phps –> Mari kita buka , didapat

<?php
  include "config.php";
  ini_set('error_reporting', E_ALL);
  ini_set('display_errors', 'On');

  $answer = $_POST["answer"];
  $debug = $_POST["debug"];
  $query = "SELECT * FROM answers WHERE answer='$answer'";
  echo "<pre>";
  echo "SQL query: ", htmlspecialchars($query), "\n";
  echo "</pre>";
?>
<?php
  $con = new SQLite3($database_file);
  $result = $con->query($query);

  $row = $result->fetchArray();
  if($answer == $CANARY)  {
    echo "<h1>Perfect!</h1>";
    echo "<p>Your flag is: $FLAG</p>";
  }
  elseif ($row) {
    echo "<h1>You are so close.</h1>";
  } else {
    echo "<h1>Wrong.</h1>";
  }
?>

<?php

include "config.php";

ini_set('error_reporting', E_ALL);

ini_set('display_errors', 'On');

$answer = $_POST["answer"];

$debug = $_POST["debug"];

$query = "SELECT * FROM answers WHERE answer='$answer'";

echo "<pre>";

echo "SQL query: ", htmlspecialchars($query), "\n";

echo "</pre>";

<?php

$con = new SQLite3($database_file);

$result = $con->query($query);

$row = $result->fetchArray();

if($answer == $CANARY) {

echo "<h1>Perfect!</h1>";

echo "<p>Your flag is: $FLAG</p>";

}

elseif ($row) {

echo "<h1>You are so close.</h1>";

} else {

echo "<h1>Wrong.</h1>";

}

Dari source code tersebut, dapat diketahui […]

July 29, 2019

[BackdoorCTF 2017] – No Calm

Posted in Reverse Engineering by Jason Theopilus Leave a Comment

Soal ini diberikan sebuah ELF 64bit file yang bisa kalian download disini Kemudian coba kita buka file tersebut dalam IDA Pro 64 bit, dan kita lihat psudeocodenya.

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int i; // [rsp+1Ch] [rbp-34h]
  char v5; // [rsp+20h] [rbp-30h]
  char v6; // [rsp+21h] [rbp-2Fh]
  char v7; // [rsp+22h] [rbp-2Eh]
  char v8; // [rsp+23h] [rbp-2Dh]
  char v9; // [rsp+24h] [rbp-2Ch]
  char v10; // [rsp+25h] [rbp-2Bh]
  char v11; // [rsp+26h] [rbp-2Ah]
  char v12; // [rsp+27h] [rbp-29h]
  char v13; // [rsp+28h] [rbp-28h]
  char v14; // [rsp+29h] [rbp-27h]
  char v15; // [rsp+2Ah] [rbp-26h]
  char v16; // [rsp+2Bh] [rbp-25h]
  char v17; // [rsp+2Ch] [rbp-24h]
  char v18; // [rsp+2Dh] [rbp-23h]
  char v19; // [rsp+2Eh] [rbp-22h]
  char v20; // [rsp+2Fh] [rbp-21h]
  char v21; // [rsp+30h] [rbp-20h]
  char v22; // [rsp+31h] [rbp-1Fh]
  char v23; // [rsp+32h] [rbp-1Eh]
  char v24; // [rsp+33h] [rbp-1Dh]
  char v25; // [rsp+34h] [rbp-1Ch]
  char v26; // [rsp+35h] [rbp-1Bh]
  char v27; // [rsp+36h] [rbp-1Ah]
  char v28; // [rsp+37h] [rbp-19h]
  char v29; // [rsp+38h] [rbp-18h]
  char v30; // [rsp+39h] [rbp-17h]
  char v31; // [rsp+3Ah] [rbp-16h]
  char v32; // [rsp+3Bh] [rbp-15h]
  char v33; // [rsp+3Ch] [rbp-14h]
  char v34; // [rsp+3Dh] [rbp-13h]
  unsigned __int64 v35; // [rsp+48h] [rbp-8h]

  v35 = __readfsqword(0x28u);
  if ( argc != 31 )
  {
    printf("Usage ./challenge <each byte of flag seperated by spaces>", argv, envp, argv);
    exit(1);
  }
  for ( i = 0; argc - 1 > i; ++i )
    *(&v5 + i) = *argv[i + 1LL];
  if ( v6 + v5 - v7 == 81 )
  {
    if ( v5 - v6 + v7 == 53 )
    {
      if ( v6 - v5 + v7 == 87 )
      {
        if ( v9 + v8 - v10 == 90 )
        {
          if ( v8 - v9 + v10 == 156 )
          {
            if ( v9 - v8 + v10 == 66 )
            {
              if ( v12 + v11 - v13 == 98 )
              {
                if ( v11 - v12 + v13 == 140 )
                {
                  if ( v12 - v11 + v13 == 92 )
                  {
                    if ( v15 + v14 - v16 == 38 )
                    {
                      if ( v14 - v15 + v16 == 170 )
                      {
                        if ( v15 - v14 + v16 == 60 )
                        {
                          if ( v18 + v17 - v19 == 29 )
                          {
                            if ( v17 - v18 + v19 == 161 )
                            {
                              if ( v18 - v17 + v19 == 69 )
                              {
                                if ( v21 + v20 - v22 == 163 )
                                {
                                  if ( v20 - v21 + v22 == 27 )
                                  {
                                    if ( v21 - v20 + v22 == 69 )
                                    {
                                      if ( v24 + v23 - v25 == 147 )
                                      {
                                        if ( v23 - v24 + v25 == 43 )
                                        {
                                          if ( v24 - v23 + v25 == 59 )
                                          {
                                            if ( v27 + v26 - v28 == 146 )
                                            {
                                              if ( v26 - v27 + v28 == 86 )
                                              {
                                                if ( v27 - v26 + v28 == 44 )
                                                {
                                                  if ( v30 + v29 - v31 == 67 )
                                                  {
                                                    if ( v29 - v30 + v31 == 89 )
                                                    {
                                                      if ( v30 - v29 + v31 == 75 )
                                                      {
                                                        if ( v33 + v32 - v34 == 117 )
                                                        {
                                                          if ( v32 - v33 + v34 == 125 )
                                                          {
                                                            if ( v33 - v32 + v34 == 125 )
                                                              success();
                                                            else
                                                              fail();
                                                          }
                                                          else
                                                          {
                                                            fail();
                                                          }
                                                        }
                                                        else
                                                        {
                                                          fail();
                                                        }
                                                      }
                                                      else
                                                      {
                                                        fail();
                                                      }
                                                    }
                                                    else
                                                    {
                                                      fail();
                                                    }
                                                  }
                                                  else
                                                  {
                                                    fail();
                                                  }
                                                }
                                                else
                                                {
                                                  fail();
                                                }
                                              }
                                              else
                                              {
                                                fail();
                                              }
                                            }
                                            else
                                            {
                                              fail();
                                            }
                                          }
                                          else
                                          {
                                            fail();
                                          }
                                        }
                                        else
                                        {
                                          fail();
                                        }
                                      }
                                      else
                                      {
                                        fail();
                                      }
                                    }
                                    else
                                    {
                                      fail();
                                    }
                                  }
                                  else
                                  {
                                    fail();
                                  }
                                }
                                else
                                {
                                  fail();
                                }
                              }
                              else
                              {
                                fail();
                              }
                            }
                            else
                            {
                              fail();
                            }
                          }
                          else
                          {
                            fail();
                          }
                        }
                        else
                        {
                          fail();
                        }
                      }
                      else
                      {
                        fail();
                      }
                    }
                    else
                    {
                      fail();
                    }
                  }
                  else
                  {
                    fail();
                  }
                }
                else
                {
                  fail();
                }
              }
              else
              {
                fail();
              }
            }
            else
            {
              fail();
            }
          }
          else
          {
            fail();
          }
        }
        else
        {
          fail();
        }
      }
      else
      {
        fail();
      }
    }
    else
    {
      fail();
    }
  }
  else
  {
    fail();
  }
  return 0;
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

int __cdecl main(int argc, const char **argv, const char **envp)

{

int i; // [rsp+1Ch] [rbp-34h]

char v5; // [rsp+20h] [rbp-30h]

char v6; // [rsp+21h] [rbp-2Fh]

char v7; // [rsp+22h] [rbp-2Eh]

char v8; // [rsp+23h] [rbp-2Dh]

char v9; // [rsp+24h] [rbp-2Ch]

char v10; // [rsp+25h] [rbp-2Bh]

char v11; // [rsp+26h] [rbp-2Ah]

char v12; // [rsp+27h] [rbp-29h]

char v13; // [rsp+28h] [rbp-28h]

char v14; // [rsp+29h] [rbp-27h]

char v15; // [rsp+2Ah] [rbp-26h]

char v16; // [rsp+2Bh] [rbp-25h]

char v17; // [rsp+2Ch] [rbp-24h]

char v18; // [rsp+2Dh] [rbp-23h]

char v19; // [rsp+2Eh] [rbp-22h]

char v20; // [rsp+2Fh] [rbp-21h]

char v21; // [rsp+30h] [rbp-20h]

char v22; // [rsp+31h] [rbp-1Fh]

char v23; // [rsp+32h] [rbp-1Eh]

char v24; // [rsp+33h] [rbp-1Dh]

char v25; // [rsp+34h] [rbp-1Ch]

char v26; // [rsp+35h] [rbp-1Bh]

char v27; // [rsp+36h] [rbp-1Ah]

char v28; // [rsp+37h] [rbp-19h]

char v29; // [rsp+38h] [rbp-18h]

char v30; // [rsp+39h] [rbp-17h]

char v31; // [rsp+3Ah] [rbp-16h]

char v32; // [rsp+3Bh] [rbp-15h]

char v33; // [rsp+3Ch] [rbp-14h]

char v34; // [rsp+3Dh] [rbp-13h]

unsigned __int64 v35; // [rsp+48h] [rbp-8h]

v35 = __readfsqword(0x28u);

if ( argc != 31 )

{

printf("Usage ./challenge <each byte of flag seperated by spaces>", argv, envp, argv);

exit(1);

}

for ( i = 0; argc - 1 > i; ++i )

*(&v5 + i) = *argv[i + 1LL];

if ( v6 + v5 - v7 == 81 )

{

if ( v5 - v6 + v7 == 53 )

{

if ( v6 - v5 + v7 == 87 )

{

if ( v9 + v8 - v10 == 90 )

{

if ( v8 - v9 + v10 == 156 )

{

if ( v9 - v8 + v10 == 66 )

{

if ( v12 + v11 - v13 == 98 )

{

if ( v11 - v12 + v13 == 140 )

{

if ( v12 - v11 + v13 == 92 )

{

if ( v15 + v14 - v16 == 38 )

{

if ( v14 - v15 + v16 == 170 )

{

if ( v15 - v14 + v16 == 60 )

{

if ( v18 + v17 - v19 == 29 )

{

if ( v17 - v18 + v19 == 161 )

{

if ( v18 - v17 + v19 == 69 )

{

if ( v21 + v20 - v22 == 163 )

{

if ( v20 - v21 + v22 == 27 )

{

if ( v21 - v20 + v22 == 69 )

{

if ( v24 + v23 - v25 == 147 )

{

if ( v23 - v24 + v25 == 43 )

{

if ( v24 - v23 + v25 == 59 )

{

if ( v27 + v26 - v28 == 146 )

{

if ( v26 - v27 + v28 == 86 )

{

if ( v27 - v26 + v28 == 44 )

{

if ( v30 + v29 - v31 == 67 )

{

if ( v29 - v30 + v31 == 89 )

{

if ( v30 - v29 + v31 == 75 )

{

if ( v33 + v32 - v34 == 117 )

{

if ( v32 - v33 + v34 == 125 )

{

if ( v33 - v32 + v34 == 125 )

success();

else

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

else

{

fail();

}

return 0;

}

Kemudian dari hasil Psudeocode ini kita mendapati banyak sekali constraint yang diterapkan pada soal, sehingga ada 2 cara untuk mengerjakannya yakni dengan Angr atau dengan Z3 solver. […]

July 27, 2019July 30, 2019

[TJCTF2019] – Moar Horse 2

Posted in Web Exploitation by EternalBeats Leave a Comment

WriteUp reference : https://github.com/Hong5489/TJCTF-2019/tree/master/moar Pada soal yang ini kita diberikan sebuah website yang memiliki 2 tombol (“Backward”) dan (“Forward”). Bila kita click backward berkali-kali atau forward berkali-kali kita berakhir pada link yang sama yaitu /4b043a01-a4b7-4141-8a99-fc94fe7e3778.html, tetapi bila kita click backward beberapa kali dan kemudian click forward beberapa kali kita mendapatkan link yang berbeda-beda. Kita sepertinya […]

July 26, 2019July 26, 2019

[ISITDTU Quals 2019] – rosegarden

Posted in Web Exploitation by Bryan Lee Leave a Comment

Challenge Description : Rosé is a beautiful singer with a sweet voice, but she is so much busy and she needs more staff to work in her garden. Diberikan web http://45.77.247.11/ . Saat mengakses web, yang pertama terlihat adalah sebuah webpage yang dihias dengan picture/video Rosé Blackpink. Terdapat “home”, dan “Send request” yang melakukan redirect ke […]

July 26, 2019

[Vulnhub] – DC-2

Posted in Pentest by ArkAngels Leave a Comment

Pada kesempatan kali ini, penulis ingin kembali berbagi ilmu yang didapat penulis dari mengerjakan sebuah vulnbox yang bernama DC-2. Box ini merupakan seri lanjutan dari DC-1 yang dimana memperkenalkan kita pada beberapa sudut pandang baru dalam pentest. Langsung saja gaskeun! Seperti biasa, kita mulai dengan mencari IP dari box kita menggunakan netdiscover, berikut syntaxnya: $ […]

June 19, 2019June 19, 2019

[BCACTF19] – basic-pass-3

Posted in Reverse Engineering by ArkAngels Leave a Comment

Challenge description: Hint: Diberikan sebuah service netcat. Mari kita lihat terlebih dahulu dari isi servicenya. Hmm, sepertinya service ini meminta kita memasukan sesuatu lalu dari backend akan di evaluasi. Di beberapa karakter yang di input, salah satu angka 0 yang ada akan berubah menjadi 1. Sepertinya soal ini merupakan soal bruteforce. Setelah fuzzing berikutnya didapatkanlah hasil sebagai berikut: Sepertinya […]