DEFCON Capture the Flag Qualification Challenge #1
1–10 of 18 posts
Re: DEFCON Capture the Flag Qualification Challenge #1
#2This is probably the easier way of solving the challenge; indeed, this is exactly how my team did it. However, there's a somewhat more interesting solution, exploiting a badly implemented doubly-linked list: https://blog.skullsecurity.org/2014/defcon-quals-writeup-for...
Re: DEFCON Capture the Flag Qualification Challenge #1
#3> Therefore, if we are copying into s2 and we only leak data after the 4th character, we can assume that by default in the uninitialized stack there is a null at s23.
I'm very inexperienced with reverse-engineering, and haven't finished the article yet, but is "s23" here a typo? I can't find any other reference to it in the article, and it doesn't make sense to me. Should it be "s2"? Thanks
Re: DEFCON Capture the Flag Qualification Challenge #1
#4> Therefore, if we are copying into s2 and we only leak data after the 4th character, we can assume that by default in the uninitialized stack there is a null at s23. I'm very inexperienced with reverse-engineering, and haven't finished the article yet, but is "s23" here a typo? I can't find any other reference to it in the article, and it doesn't make sense to me. Should it be "s2"? Thanks
It might be a slight typo, but I think that s23 is referring to the 3rd index in s2. Since the 4th character (or index 3 in a 0-index string), is the one that is causing the leak, this must be where the null character is.
Re: DEFCON Capture the Flag Qualification Challenge #1
#5> Therefore, if we are copying into s2 and we only leak data after the 4th character, we can assume that by default in the uninitialized stack there is a null at s23. I'm very inexperienced with reverse-engineering, and haven't finished the article yet, but is "s23" here a typo? I can't find any other reference to it in the article, and it doesn't make sense to me. Should it be "s2"? Thanks
[deleted]
Re: DEFCON Capture the Flag Qualification Challenge #1
#6Anyone who's interested we (Endgame) are hiring. Check the careers page and get in touch. I'm on the data science team, but we have a variety of openings in DC and SF.
Re: DEFCON Capture the Flag Qualification Challenge #1
#7> Therefore, if we are copying into s2 and we only leak data after the 4th character, we can assume that by default in the uninitialized stack there is a null at s23. I'm very inexperienced with reverse-engineering, and haven't finished the article yet, but is "s23" here a typo? I can't find any other reference to it in the article, and it doesn't make sense to me. Should it be "s2"? Thanks
It might be a slight typo, but I think that s23 is referring to the 3rd index in s2. Since the 4th character (or index 3 in a 0-index string), is the one that is causing the leak, this must be where the null character is.
That makes perfect sense, thank you!
Re: DEFCON Capture the Flag Qualification Challenge #1
#8Good God. Whenever I read these, I always get chills down my spine. Part of me wants to do the same, get better at it (I know tiny parts of many things including what is discussed here but not even remotely close to the author), the other one just wonders how does one get so good as to perform all this by themselves. Reverse engineering is beautiful :)
Re: DEFCON Capture the Flag Qualification Challenge #1
#9Good God. Whenever I read these, I always get chills down my spine. Part of me wants to do the same, get better at it (I know tiny parts of many things including what is discussed here but not even remotely close to the author), the other one just wonders how does one get so good as to perform all this by themselves. Reverse engineering is beautiful :)
He gave us a bit of a run-through presentation of his tactics for the latest shmoocon CTF. It seemed like it was a combination of time, skill, more time, patience... and skill? The world of reversing is so beyond my ken, but I love having people around who know how to do it.
When I asked how to get started, he suggested I just jump into a CTF and try.
[edit] I work at endgame (see my other comment), we're hiring, etc. etc.
Re: DEFCON Capture the Flag Qualification Challenge #1
#10This stuff is like crack to me. I love these sort of explanations. I have absolutely no ability to do any of it and can only kind of follow it, but it's so facinating to read about.