Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hack your way through Stripe's Capture the Flag

stripe.com

Post reply on HN
Print view View original

21–30 of 219 posts

Re: Hack your way through Stripe's Capture the Flag

#21

Post by jpablo »

farnsworth wrote: post #14
jetsnoc wrote: post #12

It's fun to feel like a nefarious hacker. I'm at level2, see you at level 6 guys!

Any tips? I want to actually learn from this - I'm not just looking for the answers. But I've read wikipedia on setuid, googled around a bit, and am still not sure what to do.

The setuid flags allows you to run a binary as someone else. Since processes inherit the credentials they have when they run another program, if you find a bug[1] in a setuid program that let's you run another program of your choosing you can gain the credentials of the setuid user.

[1] Buffer over flow, calling exec/system without proper escaping, creating predictable temp files, etc, etc.

Re: Hack your way through Stripe's Capture the Flag

#22

Post by CZ-18 »

lftl wrote: post #19
farnsworth wrote: post #14

Earlier quoted context omitted.

Any tips? I want to actually learn from this - I'm not just looking for the answers. But I've read wikipedia on setuid, googled around a bit, and am still not sure what to do.

My hint for level01 would be to look at the system line, and think about how it is executed.

EDIT: doh, didn't know we had write access to /tmp, that makes it easy

Re: Hack your way through Stripe's Capture the Flag

#23

Post by jcromartie »

chrisacky wrote: post #18

Lots of segfaults! Which by the looks of things, level03 is the furthest anyone is based on logs. > [32041.680408] level03[17009]: segfault at ffdc50c4 ip 00000000080487b2 sp 00000000ffe0aee0 error 4 in level03[8048000+1000]

Hello from segfault land!

Re: Hack your way through Stripe's Capture the Flag

#24

Post by farnsworth »

CZ-18 wrote: post #22
lftl wrote: post #19

Earlier quoted context omitted.

My hint for level01 would be to look at the system line, and think about how it is executed.

EDIT: doh, didn't know we had write access to /tmp, that makes it easy

When you first connect, you are in a /tmp/tmp.something directory which you can edit.

Re: Hack your way through Stripe's Capture the Flag

#25

Post by sim0n »

CZ-18 wrote: post #22
lftl wrote: post #19

Earlier quoted context omitted.

My hint for level01 would be to look at the system line, and think about how it is executed.

EDIT: doh, didn't know we had write access to /tmp, that makes it easy

Remember that you have write access to /tmp(/date) ;)

Re: Hack your way through Stripe's Capture the Flag

#26

Post by tlb »

chrisacky wrote: post #18

Lots of segfaults! Which by the looks of things, level03 is the furthest anyone is based on logs. > [32041.680408] level03[17009]: segfault at ffdc50c4 ip 00000000080487b2 sp 00000000ffe0aee0 error 4 in level03[8048000+1000]

Damn Linux stack randomization. Some amount of brute force seems to be required.

Re: Hack your way through Stripe's Capture the Flag

#27

Post by dmuino »

CZ-18 wrote: post #22
lftl wrote: post #19

Earlier quoted context omitted.

My hint for level01 would be to look at the system line, and think about how it is executed.

EDIT: doh, didn't know we had write access to /tmp, that makes it easy

You can write to /tmp. But since most people are also doing that, /tmp/date gets overriden frequently. I'd recommend mkdir /tmp/CZ-18; PATH=/tmp/CZ-18:$PATH; And then you can figure it out :)

Re: Hack your way through Stripe's Capture the Flag

#28

Post by jc4p »

jetsnoc wrote: post #20
jetsnoc wrote: post #12

It's fun to feel like a nefarious hacker. I'm at level2, see you at level 6 guys!

Stuck at level3 for a minute

Same, the only thing I can think of is doing something with the pointers in the fns variable in main, but I can't quite figure out what to do.

Re: Hack your way through Stripe's Capture the Flag

#29

Post by tlb »

tlb wrote: post #26
chrisacky wrote: post #18

Lots of segfaults! Which by the looks of things, level03 is the furthest anyone is based on logs. > [32041.680408] level03[17009]: segfault at ffdc50c4 ip 00000000080487b2 sp 00000000ffe0aee0 error 4 in level03[8048000+1000]

Damn Linux stack randomization. Some amount of brute force seems to be required.

Spoke too soon, there's a non-brute-force solution.
Post reply on HN