Is it intended behaviour for users to be able to access other people's files via /tmp/tmp, tmp/hacks, etc?
Hack your way through Stripe's Capture the Flag
211–219 of 219 posts
Re: Hack your way through Stripe's Capture the Flag
#212SPOILER SPOILER SPOILER Don't look at this if you actually want to enjoy the contest. http://pastebin.com/VJ4xpawq
For level 06, I came up with a completely different solution. After hitting my head against the wall all day trying to fight with blocking/non-blocking IO, I resorted to a timing attack on the system call which worked really well. Check it out: https://gist.github.com/1899389 (SPOILERS!)
i did it a different way to both of you but similar to zx2c4 's :) i found a way to block the child process from writing to stderr. i thought the way they were writing to stderr/ stdout was too much of a coincidence. all stdout writes end with \n
Re: Hack your way through Stripe's Capture the Flag
#213Earlier quoted context omitted.
For level 06, I came up with a completely different solution. After hitting my head against the wall all day trying to fight with blocking/non-blocking IO, I resorted to a timing attack on the system call which worked really well. Check it out: https://gist.github.com/1899389 (SPOILERS!)
i did it a different way to both of you but similar to zx2c4 's :) i found a way to block the child process from writing to stderr. i thought the way they were writing to stderr/ stdout was too much of a coincidence. all stdout writes end with \n
Wadja end up doin'? Source?
Re: Hack your way through Stripe's Capture the Flag
#214SPOILER SPOILER SPOILER Don't look at this if you actually want to enjoy the contest. http://pastebin.com/VJ4xpawq
All cleaned up now: http://git.zx2c4.com/Stripe-CTF/tree/
Re: Hack your way through Stripe's Capture the Flag
#215Earlier quoted context omitted.
Tool used: One line of javascript, entered in location bar. (Seems Chrome resource inspector doesn't allow the edit I needed.)
Damn, I always forget you can actually just use javascript to "do it", and end up using a Firefox add-on.
If I were in Firefox at the time I would have used Firebug (or I guess Firecookie, I don't remember if Firebug allows native editing of cookies), but I just happened to have Chrome running at the time.
Re: Hack your way through Stripe's Capture the Flag
#216Earlier quoted context omitted.
i did it a different way to both of you but similar to zx2c4 's :) i found a way to block the child process from writing to stderr. i thought the way they were writing to stderr/ stdout was too much of a coincidence. all stdout writes end with \n
Wadja end up doin'? Source?
Re: Hack your way through Stripe's Capture the Flag
#217Earlier quoted context omitted.
Wadja end up doin'? Source?
https://gist.github.com/1914845
I had the same solution, just different heuristics..
Re: Hack your way through Stripe's Capture the Flag
#2184 days later:
level06@ctf6:/tmp/tmp.0fPRsmsetz$ /levels/level06 /home/the-flag/.password %%%%%%%%% Welcome to the password checker! ........................ Wait, how did you know that the password was %%%%%%%%%?
Level 5 seemed too easy -- it seems like they forgot a much easier exploit. The code was carefully constructed in a way that suggested a pickle injection attack which required understanding the pickle stack machine, but you didn't need that.
Level 6 was interesting. Some people got it with a timing attack. I used a different, more elegant method with a hint from reddit.
Very well done, stripe.
Re: Hack your way through Stripe's Capture the Flag
#219The asshole who fork bombed it is boasting on Reddit: http://www.reddit.com/r/programming/comments/q1qii/want_to_t... Anyone else not at all surprised who it is?
I am surprised by the attitude against what he did, both on reddit and even more so here. Afterall this is "hacker news" and the submission is called "hack your way...". Any definition of hacking that I know includes cleverly exploiting the limitations and boundary cases of a system. I see this attitude as part of a larger trend of "sandbox"-ification, "theme park"-ization of computing.
And another way of looking at it is: someone offered you free entertainment and education and you slapped them in the face and ruined the fun for everyone for quite some time. "Hacker" certainly does not include or entitle you to being a dick.