Hack your way through Stripe's Capture the Flag • Hacker News Board

Re: Hack your way through Stripe's Capture the Flag

#121

Post by turkeygizzard » Thu, Feb 23, 2012, 4:41 AM UTC

olalonde wrote: post #71

jessepollak wrote: post #30

anyone have any good resources for understanding the basics of all of this?

For level 1 to 3, Google those: system() exploit, never trust user input, buffer overflow

I'm entirely new to hacking, and as such I'm struggling with level 1. I looked up the system() exploit, and I've managed to compile my own date program, but when I try to read the password from level02, I'm told I don't have permission. Could you point me in the right direction?

Re: Hack your way through Stripe's Capture the Flag

#122

Post by [deleted] » Thu, Feb 23, 2012, 4:59 AM UTC

[deleted]

Re: Hack your way through Stripe's Capture the Flag

#123

Post by luckygerbils » Thu, Feb 23, 2012, 4:59 AM UTC

starnix17 wrote: post #54

Anyone having trouble connecting to this?

I think someone decided to forkbomb it. I'm still logged on and every external command I type gets me "bash: fork: retry: Resource temporarily unavailable".

This is why we can't have nice things.

Re: Hack your way through Stripe's Capture the Flag

#124

Post by le_isms » Thu, Feb 23, 2012, 5:01 AM UTC

Here's the descriptions for all the levels from /usr/local/bin/ctfsh...

https://gist.github.com/1890401

Re: Hack your way through Stripe's Capture the Flag

#125

Post by joe_bleau » Thu, Feb 23, 2012, 5:06 AM UTC

jc4p wrote: post #28

jetsnoc wrote: post #20

Earlier quoted context omitted.

Stuck at level3 for a minute

Same, the only thing I can think of is doing something with the pointers in the fns variable in main, but I can't quite figure out what to do.

Yeah, I'm stuck on level 3 as well. I see the printf() bug in capitalize(), but I don't think it's any help. I don't see anything obviously wrong in truncate_and_copy() (the strncpy() call and friends look right). run() is the juicy target, and I know where it's at in memory. There's the obvious comparison bug in main(), and I can use that to call a function pointer other than in the array, but I can't seem to locate a pointer to run(). I thought there might be a way to overflow atoi(), but that doesn't seem useful either.

Several posters have hinted at buffer overflow, but I'm not yet seeing a buffer that I can overflow.

[edit: Nevermind, I got it. Whew.]

Re: Hack your way through Stripe's Capture the Flag

#126

Post by azernik » Thu, Feb 23, 2012, 5:09 AM UTC

For CTF on shared servers, there need to be some explicit rules about DOSing shared resources; otherwise things get really dull really fast.

If people are going to be using brute-force tactics, they're probably each going to need separate virtual machines.

Re: Hack your way through Stripe's Capture the Flag

#127

Post by [deleted] » Thu, Feb 23, 2012, 5:19 AM UTC

[deleted]

Re: Hack your way through Stripe's Capture the Flag

#128

Post by [deleted] » Thu, Feb 23, 2012, 5:21 AM UTC

gdb wrote: post #84

mjijackson wrote: post #82

Earlier quoted context omitted.

Can anyone from Stripe confirm that this box is not rooted?

Confirmed.

[deleted]

Re: Hack your way through Stripe's Capture the Flag

#129

Post by le_isms » Thu, Feb 23, 2012, 5:25 AM UTC

kogir wrote: post #107

gdb wrote: post #92

Earlier quoted context omitted.

I think the machine was actually hosed due to fork bomb. (I kept bumping the rlimits as more people logged in and ran up against nprocs, but the last time I clearly just bumped nprocs way too high. Live and learn....) You certainly should be able to solve all of the levels without tons of brute force though.

Oops, thought that no one had commented when I deleted. Sorry.

It's cool, why the delete anyways?

Re: Hack your way through Stripe's Capture the Flag

#130

Post by rurounijones » Thu, Feb 23, 2012, 5:37 AM UTC

gdb wrote: post #90

heywire wrote: post #69

Earlier quoted context omitted.

Must be fun watching all of the attempts... Do you have any way to monitor progress?

We don't have an exposed way. We'll probably do a summary blog post in the future with stats though!

I would LOVE to see something like a graph with the number of users who are logged in at each level over time and a little log at the bottom.

"User 10.0.0.1 read the level 1 file" "User 10.0.0.1 read the level 3 file"

Then I am a stats junkie