Hack your way through Stripe's Capture the Flag • Hacker News Board

Re: Hack your way through Stripe's Capture the Flag

#111

Post by smountcastle » Thu, Feb 23, 2012, 2:39 AM UTC

ab wrote: post #85

rottencupcakes wrote: post #73

Earlier quoted context omitted.

Maybe they should just publish a VM image.

Not a bad idea, but how do you keep people from peeking at the passwords with root access on their own VM?

They are asking for code or a brief description of how you proceeded through the steps. If you're going to take the time to document the process (correctly) then it shouldn't matter that you have the root password. Presumably you'd get stuck at some point where you couldn't explain how you achieved the subsequent step.

Re: Hack your way through Stripe's Capture the Flag

#112

Post by sgricci » Thu, Feb 23, 2012, 3:02 AM UTC

Is part of the challenge dealing with the server timeouts?

In all seriousness, thanks for this!

Re: Hack your way through Stripe's Capture the Flag

#113

Post by saurik » Thu, Feb 23, 2012, 3:06 AM UTC

chrisacky wrote: post #95

gdb wrote: post #90

Earlier quoted context omitted.

We don't have an exposed way. We'll probably do a summary blog post in the future with stats though!

I've been trying to read $ history Failed. :) I figured that would of been an easy way to progress through the levels. Read bash history from other users.

(This would certainly work if you can read my history: I don't consider the level "complete" until I get it down to a short bash one-liner that prints out the password. ;P)

Re: Hack your way through Stripe's Capture the Flag

#114

Post by pvsnp » Thu, Feb 23, 2012, 3:40 AM UTC

farnsworth wrote: post #24

CZ-18 wrote: post #22

Earlier quoted context omitted.

EDIT: doh, didn't know we had write access to /tmp, that makes it easy

When you first connect, you are in a /tmp/tmp.something directory which you can edit.

You can also do cd $(mktemp -d) and get a new one if you need another one.

Re: Hack your way through Stripe's Capture the Flag

#115

Post by jcr » Thu, Feb 23, 2012, 3:41 AM UTC

Just a quick note on the claimed fork bomb. It may not have been all that nice to other users, but there may have been a method to their madness:

http://dtors.org/2010/08/25/reversing-latest-exploid-release...

Re: Hack your way through Stripe's Capture the Flag

#116

Post by semisight » Thu, Feb 23, 2012, 3:42 AM UTC

Can anyone give me a hint on level 02? I have absolutely no background in PHP, and only a little in HTML. If you wanna keep the message thread private you can email me too at billyman3 at gmail.

Re: Hack your way through Stripe's Capture the Flag

#117

Post by zaptheimpaler » Thu, Feb 23, 2012, 3:42 AM UTC

simon_weber wrote: post #51

jessepollak wrote: post #30

anyone have any good resources for understanding the basics of all of this?

The venerable CMU binary bomb assignment covers a lot of useful concepts.

Haha we just had that last week ( finished Buffer Overflow Lab a few hours ago! ), its definitely helping.

Re: Hack your way through Stripe's Capture the Flag

#118

Post by dillona » Thu, Feb 23, 2012, 4:09 AM UTC

I got to level 5, but I think it is time to call it a night

Re: Hack your way through Stripe's Capture the Flag

#119

Post by mhartl » Thu, Feb 23, 2012, 4:21 AM UTC

Once they've run this for a while, I'd love to see a post and screencast on some of the techniques needed to solve it. I don't know much about this subject, and I'd enjoy having a chance to learn in a setting unlikely to get me arrested.

Re: Hack your way through Stripe's Capture the Flag

#120

Post by a1k0n » Thu, Feb 23, 2012, 4:32 AM UTC

jcr wrote: post #115

Just a quick note on the claimed fork bomb. It may not have been all that nice to other users, but there may have been a method to their madness: http://dtors.org/2010/08/25/reversing-latest-exploid-release...

ASLR and non-executable stack make level 4 a huge pain in the ass. (But it's not me doing that)