I stuck even at lvl1 but I think how to solve it. Could anyone may help me? I want to learn and I don't want to spoiler here.
Jabber: .thing@jabber.ccc.de
ICQ: 366509265
Thanks
Hack your way through Stripe's Capture the Flag
171–180 of 219 posts
Re: Hack your way through Stripe's Capture the Flag
#172Looking forward to trying this! I bookmarked it for later and noticed the title was just "Stripe Blog". Could you put the title of your blog post in the title tag? Makes bookmarking and also sharing via bit.ly extension much easier :)
Re: Hack your way through Stripe's Capture the Flag
#173Earlier quoted context omitted.
Same, the only thing I can think of is doing something with the pointers in the fns variable in main, but I can't quite figure out what to do.
Yeah, I'm stuck on level 3 as well. I see the printf() bug in capitalize(), but I don't think it's any help. I don't see anything obviously wrong in truncate_and_copy() (the strncpy() call and friends look right). run() is the juicy target, and I know where it's at in memory. There's the obvious comparison bug in main(), and I can use that to call a function pointer other than in the array, but I can't seem to locate…
Any hints? :)
Re: Hack your way through Stripe's Capture the Flag
#174Earlier quoted context omitted.
For level 1 to 3, Google those: system() exploit, never trust user input, buffer overflow
I'm entirely new to hacking, and as such I'm struggling with level 1. I looked up the system() exploit, and I've managed to compile my own date program, but when I try to read the password from level02, I'm told I don't have permission. Could you point me in the right direction?
Yeah that's not part of the test. Just use your level2 password for the http auth.
Re: Hack your way through Stripe's Capture the Flag
#175Earlier quoted context omitted.
Yeah, I'm stuck on level 3 as well. I see the printf() bug in capitalize(), but I don't think it's any help. I don't see anything obviously wrong in truncate_and_copy() (the strncpy() call and friends look right). run() is the juicy target, and I know where it's at in memory. There's the obvious comparison bug in main(), and I can use that to call a function pointer other than in the array, but I can't seem to locate…
Did you really end up using buffer overflow? I've been trying to overflow a different quantity all this time, and I'm quite sure you can't buffer overflow..
Right--no buffer overflow. I did find a way to get my needed function pointer on the stack. Hint: we're lucky that the function pointer doesn't have any null bytes in it...
Re: Hack your way through Stripe's Capture the Flag
#176Re: Hack your way through Stripe's Capture the Flag
#177Once they've run this for a while, I'd love to see a post and screencast on some of the techniques needed to solve it. I don't know much about this subject, and I'd enjoy having a chance to learn in a setting unlikely to get me arrested.
I'd love to see how people solved #2, and if they used any special tools like I did or if there's an easier way to do it. And I can't wait to delve deeper into #3 tomorrow :)
Tool used: One line of javascript, entered in location bar. (Seems Chrome resource inspector doesn't allow the edit I needed.)
Re: Hack your way through Stripe's Capture the Flag
#178Just a quick note on the claimed fork bomb. It may not have been all that nice to other users, but there may have been a method to their madness: http://dtors.org/2010/08/25/reversing-latest-exploid-release...
ASLR and non-executable stack make level 4 a huge pain in the ass. (But it's not me doing that)
Update: they helped a brother out, and the stack is actually executable on those binaries. I found out after mailing the organizers in exasperation. I was under this impression because newly-compiled binaries had no-exec on the stack, and I was off by a little when I tried to exploit it the first time. Doh!
Re: Hack your way through Stripe's Capture the Flag
#179Once they've run this for a while, I'd love to see a post and screencast on some of the techniques needed to solve it. I don't know much about this subject, and I'd enjoy having a chance to learn in a setting unlikely to get me arrested.
I'd love to see how people solved #2, and if they used any special tools like I did or if there's an easier way to do it. And I can't wait to delve deeper into #3 tomorrow :)
I used a Firefox add-on that lets you [mumble mumble]. I found at least two add-ons that looked like they would work when I googled it.
Re: Hack your way through Stripe's Capture the Flag
#180I stuck even at lvl1 but I think how to solve it. Could anyone may help me? I want to learn and I don't want to spoiler here. Jabber: .thing@jabber.ccc.de ICQ: 366509265 Thanks
Did it. Lvl 3 now