Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hack your way through Stripe's Capture the Flag

stripe.com

Post reply on HN
Print view View original

131–140 of 219 posts

Re: Hack your way through Stripe's Capture the Flag

#134

Post by lawnchair_larry »

jcr wrote: post #79

You should note that the SSH key has been changed. $ dsocks.sh ssh level01@ctf.stri.pe @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a hos…

Rooting the box would not change the key.

Re: Hack your way through Stripe's Capture the Flag

#135

Post by ianbishop »

mirkules wrote: post #131

Guys, I gotta say, this is SO much fun! I am actually learning a ton, and while I'm only up to level 3, I feel this is such an awesome learning experience! Plus, I feel totally "leet" for figuring out levels 2 and 3. The world definitely needs more of these.

Ah man, I couldn't agree more. I've learned a ton just messing around with the first few, though getting this was a real bummer:

Run till exit from #0 run (str=0xffece7ec "cat /home/level04/.password") at level03.c:53 cat: /home/level04/.password: Permission denied

Ah well, a sign to go to sleep. Tomorrow I'll have to learn more things to figure it out if it's still up.

Re: Hack your way through Stripe's Capture the Flag

#137

Post by Rudisimo »

mirkules wrote: post #131

Guys, I gotta say, this is SO much fun! I am actually learning a ton, and while I'm only up to level 3, I feel this is such an awesome learning experience! Plus, I feel totally "leet" for figuring out levels 2 and 3. The world definitely needs more of these.

Same here, but I'm stuck on level 3 though...maybe my strategy is wrong. I am able to execute the function run from /levels/level03 with the following command:

  cat /home/level04/.password
But I'm still getting access denied. I thought that would have done it for sure. The program runs under the following credentials:

  uid=1003(level03) gid=1004(level03) groups=1001(chroot),1004(level03)
Which is kind of weird since /levels/level03 has a setuid of level04. It could be gdb...

Re: Hack your way through Stripe's Capture the Flag

#138

Post by bmohlenhoff »

tzs wrote: post #136

The asshole who fork bombed it is boasting on Reddit: http://www.reddit.com/r/programming/comments/q1qii/want_to_t... Anyone else not at all surprised who it is?

This actually made me laugh a little bit as it brought me back to my college days. The first week of February every year was when the yearly OS class covered fork(), and as a result the compute clusters all over campus were basically unusable due to people trying to run their homework. Ahh, memories.

Re: Hack your way through Stripe's Capture the Flag

#139

Post by jsharpe »

ianbishop wrote: post #135
mirkules wrote: post #131

Guys, I gotta say, this is SO much fun! I am actually learning a ton, and while I'm only up to level 3, I feel this is such an awesome learning experience! Plus, I feel totally "leet" for figuring out levels 2 and 3. The world definitely needs more of these.

Ah man, I couldn't agree more. I've learned a ton just messing around with the first few, though getting this was a real bummer: Run till exit from #0 run (str=0xffece7ec "cat /home/level04/.password") at level03.c:53 cat: /home/level04/.password: Permission denied Ah well, a sign to go to sleep. Tomorrow I'll have to learn more things to figure it out if it's still up.

setuid doesn't work inside of GDB. You have to run the program without a debugger to get level04 permissions.

(Disclaimer: I haven't succeeded yet.)

Re: Hack your way through Stripe's Capture the Flag

#140

Post by robbles »

turkeygizzard wrote: post #121
olalonde wrote: post #71

Earlier quoted context omitted.

For level 1 to 3, Google those: system() exploit, never trust user input, buffer overflow

I'm entirely new to hacking, and as such I'm struggling with level 1. I looked up the system() exploit, and I've managed to compile my own date program, but when I try to read the password from level02, I'm told I don't have permission. Could you point me in the right direction?

Try to figure out how you could trick a setuid program into running your date program instead of the real one.
Post reply on HN