Exploit exercises - Protostar - Net 1

Next level requires to convert binary integer to its string representation. All we have to do is read 4 bytes, convert bytes to int then convert it into string. Ruby have unpack method of String class to do required transformation.

Exploit exercises - Protostar - Net 0

In this task we have to work with byte ordering and ways to send/receive them. I wouldn't tell about endianness because there are a lot of good internet sources that cover it. (e.g. wiki ).

Task binary sends a number and waits when we will provide little endian version of it. Our task is to get number from incoming message, convert it into binary form and then send it backwards. To get numbet you will probably want to use regular expression which will cut out contiguous digit string between quotation marks. Then there is a fast solution in Ruby to use pack method of the Array class which allows to convert integer from string to binary. Then we will just send it and receive congratulation message.

Exploit exercises - Protostar - Heap 3

In the heap 3 task 3 portions of memory are allocated on the heap. Then 3 command-line arguments are copied without bounds checking and later the allocated memory is freed. We are supposed to exploit Doug Lea way of allocation and deallocation of memory. There is a nice online page with a description of the way how to exploit it.

Exploitation is based on the fact that while memory is being freed, if there is a free block next to the one that is being freed, free function merges two blocks and write some metadata at the calculated addresses. That means that we can make free function overwrite value at the user provided address after corrupting metadata of the allocated blocks. We should make free think that previous block is free and change metadata to influence address calculation. In the task blocks are allocated in a way that is pictured on the image:

Exploit exercises - Protostar - Heap 2

In this task we are able to control the sequence of malloc and free operations. Also the binary seems to be different from the source because binary allocates not enough memory for the auth struct. If you write auth 1, only 4 bytes are allocated for a whole 36 bytes auth structure. So if we are able to create another structure that has nonzero byte at 32-byte offset we will get a flag. Let's allocate service struct that has unlimited size and therefore can overwrite auth at offset 32 from auth pointer.

Exploit exercises - Protostar - Heap 1

In this task there is a bit more calls to malloc function. As we can see first strcpy is able to overwrite all other allocated data except first allocation. Data allocated in a way that is shown on the picture.

Next strcpy gets address from the allocated memory and write there second argument. So we can overwrite an arbitrary place in memory.
Since main function uses puts function to print something after second strcpy was finished and the fact that winner function doesn't use puts function, we can overwrite address in GOT for puts to move execution flow to the winner.

ASIS CTF 2013 - Reverse 200 - Masterpiece

Task:

file

ASIS CTF 2013 - Forensics 100 - pcap

Task:

Find the flag. file

You can download the missing parts of pcap forensic challenge from here:
053dc897d3e154dd5ed27c46b738850d
21eae902cf5b82c7b207e963a130856d