Hack your way through Stripe's Capture the Flag • Hacker News Board

Re: Hack your way through Stripe's Capture the Flag

#71

Post by olalonde » Wed, Feb 22, 2012, 11:37 PM UTC

jessepollak wrote: post #30

anyone have any good resources for understanding the basics of all of this?

For level 1 to 3, Google those: system() exploit, never trust user input, buffer overflow

Re: Hack your way through Stripe's Capture the Flag

#72

Post by spydum » Wed, Feb 22, 2012, 11:38 PM UTC

Was up and working, got to level 3, and network died. I love CTF's.. Got a chance to do the CTF @ Sans (netwars) Orlando in 2011, and it was a blast.

Re: Hack your way through Stripe's Capture the Flag

#73

Post by rottencupcakes » Wed, Feb 22, 2012, 11:39 PM UTC

starnix17 wrote: post #54

Anyone having trouble connecting to this?

Maybe they should just publish a VM image.

Re: Hack your way through Stripe's Capture the Flag

#74

Post by jetsnoc » Wed, Feb 22, 2012, 11:40 PM UTC

dmuino wrote: post #44

gue5t wrote: post #36

Earlier quoted context omitted.

I've been playing with nm, but without a hex editor I feel crippled :/

gdb works fine. (gdb) x/4x fns 0xffeaa0cc: 0x080485e4 0x08048640 0x0804869c 0x08048719 (gdb) x run 0x804875b : 0x83e58955 (gdb) gdb) x/40x (void*)fns-0x40 etc.

Well, I got my math right to tweak the index I think and now the system is unavailable. Blasted!

Re: Hack your way through Stripe's Capture the Flag

#75

Post by pranjalv123 » Wed, Feb 22, 2012, 11:41 PM UTC

I'm getting a Remote Host Identification Changed error, did you guys change your certificate or is someone trying to MITM me?

Re: Hack your way through Stripe's Capture the Flag

#76

Post by jazzychad » Wed, Feb 22, 2012, 11:42 PM UTC

uh oh, remote host identification has changed... new host or mitm? as this is a cracker-centric event, i'm now very hesitant to reconnect... perhaps you could publish the correct fingerprint somewhere?

Re: Hack your way through Stripe's Capture the Flag

#77

Post by jessepollak » Wed, Feb 22, 2012, 11:44 PM UTC

jazzychad wrote: post #76

uh oh, remote host identification has changed... new host or mitm? as this is a cracker-centric event, i'm now very hesitant to reconnect... perhaps you could publish the correct fingerprint somewhere?

same...hopefully it will get resolved soon.

Re: Hack your way through Stripe's Capture the Flag

#78

Post by gdb » Wed, Feb 22, 2012, 11:47 PM UTC

jessepollak wrote: post #77

jazzychad wrote: post #76

uh oh, remote host identification has changed... new host or mitm? as this is a cracker-centric event, i'm now very hesitant to reconnect... perhaps you could publish the correct fingerprint somewhere?

same...hopefully it will get resolved soon.

New host :). We brought up a new machine for this, and didn't copy over the SSH keys.

Never hurts to be paranoid though.

Re: Hack your way through Stripe's Capture the Flag

#79

Post by jcr » Wed, Feb 22, 2012, 11:48 PM UTC

You should note that the SSH key has been changed.

  $ dsocks.sh ssh level01@ctf.stri.pe
  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  @    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @
  @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
  IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
  Someone could be eavesdropping on you right now (man-in-the-middle attack)!
  It is also possible that a host key has just been changed.
  The fingerprint for the RSA key sent by the remote host is
  74:67:32:4a:04:b8:9f:05:b6:e8:29:43:26:12:75:11.
  Please contact your system administrator.
  Add correct host key in /home/jcr/.ssh/known_hosts to get rid of this message.
  Offending RSA key in /home/jcr/.ssh/known_hosts:8
  RSA host key for ctf.stri.pe has changed and you have requested strict checking.
  Host key verification failed.

It may be something harmless/simple like round-robin DNS combined with a failure to replicate the key, or more likely, someone has rooted the box.

EDIT: As confirmed by gdb and ab below, there's a good reason for the key change.

Re: Hack your way through Stripe's Capture the Flag

#80

Post by jetsnoc » Wed, Feb 22, 2012, 11:49 PM UTC

jcr wrote: post #79

You should note that the SSH key has been changed. $ dsocks.sh ssh level01@ctf.stri.pe @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a hos…

I'm estimating they booted a few new EC2 systems up. Right before the system got a new key it was unavailable.