Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hack your way through Stripe's Capture the Flag

stripe.com

Post reply on HN
Print view View original

141–150 of 219 posts

Re: Hack your way through Stripe's Capture the Flag

#141

Post by david_xia »

semisight wrote: post #116

Can anyone give me a hint on level 02? I have absolutely no background in PHP, and only a little in HTML. If you wanna keep the message thread private you can email me too at billyman3 at gmail.

First play with the webpage after entering the correct credentials. Then read through the PHP script that generates that page and understand what's going on behind it. Do you see any vulnerabilities in it?

Re: Hack your way through Stripe's Capture the Flag

#142

Post by david_xia »

mhartl wrote: post #119

Once they've run this for a while, I'd love to see a post and screencast on some of the techniques needed to solve it. I don't know much about this subject, and I'd enjoy having a chance to learn in a setting unlikely to get me arrested.

I would also like to see a detailed explanation of how they prepared the box to safely allow people to play (ie logins, permissions, etc). How to restrict privileges yet allow just enough to make it varied and fun.

Re: Hack your way through Stripe's Capture the Flag

#143

Post by thirsteh »

Rudisimo wrote: post #137
mirkules wrote: post #131

Guys, I gotta say, this is SO much fun! I am actually learning a ton, and while I'm only up to level 3, I feel this is such an awesome learning experience! Plus, I feel totally "leet" for figuring out levels 2 and 3. The world definitely needs more of these.

Same here, but I'm stuck on level 3 though...maybe my strategy is wrong. I am able to execute the function run from /levels/level03 with the following command: cat /home/level04/.password But I'm still getting access denied. I thought that would have done it for sure. The program runs under the following credentials: uid=1003(level03) gid=1004(level03) groups=1001(chroot),1004(level03) Which is kind of weird since /l…

Since gdb is the parent of your process, it's running as level03, not root. You can't use gdb on a setuid binary unless you run gdb itself as root.

Re: Hack your way through Stripe's Capture the Flag

#144

Post by mirkules »

mhartl wrote: post #119

Once they've run this for a while, I'd love to see a post and screencast on some of the techniques needed to solve it. I don't know much about this subject, and I'd enjoy having a chance to learn in a setting unlikely to get me arrested.

I'd love to see how people solved #2, and if they used any special tools like I did or if there's an easier way to do it. And I can't wait to delve deeper into #3 tomorrow :)

Re: Hack your way through Stripe's Capture the Flag

#145

Post by mirkules »

jsharpe wrote: post #139
ianbishop wrote: post #135

Earlier quoted context omitted.

Ah man, I couldn't agree more. I've learned a ton just messing around with the first few, though getting this was a real bummer: Run till exit from #0 run (str=0xffece7ec "cat /home/level04/.password") at level03.c:53 cat: /home/level04/.password: Permission denied Ah well, a sign to go to sleep. Tomorrow I'll have to learn more things to figure it out if it's still up.

setuid doesn't work inside of GDB. You have to run the program without a debugger to get level04 permissions. (Disclaimer: I haven't succeeded yet.)

I mostly live inside a Java world or XCode world, so GDB is almost a totally foreign concept to me - and I definitely welcome the challenge. Never really had to look at assembly before either, so this is a fun learning experience.

Re: Hack your way through Stripe's Capture the Flag

#146

Post by _cbsz »

tlb wrote: post #29
tlb wrote: post #26

Earlier quoted context omitted.

Damn Linux stack randomization. Some amount of brute force seems to be required.

Spoke too soon, there's a non-brute-force solution.

It's nearly impossible to debug my should-be-reliable-but-doesn't-work-at-all-and-by-the-way-gdb-affects-memory-layout solution with all the brute forcing going on though. :(

Re: Hack your way through Stripe's Capture the Flag

#148

Post by fatbat »

tzs wrote: post #136

The asshole who fork bombed it is boasting on Reddit: http://www.reddit.com/r/programming/comments/q1qii/want_to_t... Anyone else not at all surprised who it is?

This person? http://www.linkedin.com/in/teddziuba I don't get the "not surprised" part? :\

Re: Hack your way through Stripe's Capture the Flag

#150

Post by look_lookatme »

tzs wrote: post #136

The asshole who fork bombed it is boasting on Reddit: http://www.reddit.com/r/programming/comments/q1qii/want_to_t... Anyone else not at all surprised who it is?

Ugh, this sucks. Got to #3 and which looks pretty challenging for me and took some time to document my steps there and now someone has pulled this again. It just seems childish.
Post reply on HN