Any tips for level05 (the python one)?
nvm, got it
Hack your way through Stripe's Capture the Flag
201–210 of 219 posts
Re: Hack your way through Stripe's Capture the Flag
#202SPOILER
SPOILER
SPOILER
Don't look at this if you actually want to enjoy the contest.
Re: Hack your way through Stripe's Capture the Flag
#203Earlier quoted context omitted.
Update: they helped a brother out, and the stack is actually executable on those binaries. I found out after mailing the organizers in exasperation. I was under this impression because newly-compiled binaries had no-exec on the stack, and I was off by a little when I tried to exploit it the first time. Doh!
Ha! Last night I read your comment, assumed you were right, and then came up with a solution that did not assume an executable stack. ;P (I'm actually quite glad, as messing around with the stack would have been much harder.)
For both of you, were your solutions 100% reliable? I ended up with an exploit that required a little brute forcing (i.e., just run it a hundred times or whatever).
Re: Hack your way through Stripe's Capture the Flag
#204SPOILER SPOILER SPOILER Don't look at this if you actually want to enjoy the contest. http://pastebin.com/VJ4xpawq
Wow, I read in this very thread that NX was for sure disabled on level03 so I've been barking up the wrong tree completely. Your direction is brilliant! I never would have come up with that. Here's my attempt: http://pastebin.com/XVkfLaiB
Wait. wtf how is yours working with NX on?
Edit: OH! Yours doesn't actually manipulate the stack so it doesn't get caught? That makes sense. I should have noticed the __stack_chk_fail calls.
Re: Hack your way through Stripe's Capture the Flag
#205SPOILER SPOILER SPOILER Don't look at this if you actually want to enjoy the contest. http://pastebin.com/VJ4xpawq
For level 06, I came up with a completely different solution. After hitting my head against the wall all day trying to fight with blocking/non-blocking IO, I resorted to a timing attack on the system call which worked really well. Check it out:
https://gist.github.com/1899389 (SPOILERS!)
Re: Hack your way through Stripe's Capture the Flag
#206Earlier quoted context omitted.
Ha! Last night I read your comment, assumed you were right, and then came up with a solution that did not assume an executable stack. ;P (I'm actually quite glad, as messing around with the stack would have been much harder.)
For both of you, were your solutions 100% reliable? I ended up with an exploit that required a little brute forcing (i.e., just run it a hundred times or whatever).
Neither of our solutions were "reliable", and also required being run in a loop. (I know this about a1k0n's solution, as he sent me an e-mail asking me about my solution).
Re: Hack your way through Stripe's Capture the Flag
#207Earlier quoted context omitted.
For both of you, were your solutions 100% reliable? I ended up with an exploit that required a little brute forcing (i.e., just run it a hundred times or whatever).
Neither of our solutions were "reliable", and also required being run in a loop. (I know this about a1k0n's solution, as he sent me an e-mail asking me about my solution).
I actually have a 100% reliable solution that exploits the executable stack on level 04. No need to guess the address of the stack using one side effect that I found in this specific case:
https://gist.github.com/807e81ad64c4e84a7770 (SPOILERS)
Re: Hack your way through Stripe's Capture the Flag
#208Once they've run this for a while, I'd love to see a post and screencast on some of the techniques needed to solve it. I don't know much about this subject, and I'd enjoy having a chance to learn in a setting unlikely to get me arrested.
I just posted http://news.ycombinator.com/item?id=3631381
It's a complete walkthrough to the flag.
Re: Hack your way through Stripe's Capture the Flag
#209Earlier quoted context omitted.
Neither of our solutions were "reliable", and also required being run in a loop. (I know this about a1k0n's solution, as he sent me an e-mail asking me about my solution).
I actually have a 100% reliable solution that exploits the executable stack on level 04. No need to guess the address of the stack using one side effect that I found in this specific case: https://gist.github.com/807e81ad64c4e84a7770 (SPOILERS)
Awesome!! I totally saw that call instruction, and then went on a wild goose chase thinking about how to get the string into that register, totally missing the fact that some of my earlier attempts at using printf had established that the string already happened to be there to begin with. Now I just feel dumb. ;P
Re: Hack your way through Stripe's Capture the Flag
#210SPOILER SPOILER SPOILER Don't look at this if you actually want to enjoy the contest. http://pastebin.com/VJ4xpawq
For level 06, I came up with a completely different solution. After hitting my head against the wall all day trying to fight with blocking/non-blocking IO, I resorted to a timing attack on the system call which worked really well. Check it out: https://gist.github.com/1899389 (SPOILERS!)
That's neat. Timing. Awesome.
I made mine a bit more reliable and made a movie.
Source: http://pastebin.com/6M4cq8gB Video: http://www.youtube.com/watch?v=_q2wTd1jgUQ