顯示具有 DEFCON 標籤的文章。 顯示所有文章
顯示具有 DEFCON 標籤的文章。 顯示所有文章

2013年6月23日 星期日

DEFCON 21 CTF Write Up：gnireengine 1

gnireengine 1：policebox

In this problem, we got two files, one executable named policebox and a core dump file of policebox.
As we observe the core dump, we found that this core dump file is generated when few instructions after main function. While we need to get some information of getchar(), it seem no clue to continue.
Then we use readelf to check what is inside the core file.
We noticed the section named precord exists, which indicate the core dump contain a program execution record logged by gdb's Process Record feature.
Therefore we first replay this record with gdb, and disassemble the program. Function getchar() is located at 0x08048690, where we can set the break point latter.
 After setting break point, we continue the replay. Then program will halt in getchar() and we can print value of eax, which is the user's input.
Collecting all the input value, the key will showed.
The key is : w0rlds.w0rst.k3yl0gger! 

reference

張貼者： 於 沒有留言:
標籤： , ,

2013年6月19日 星期三

DEFCON 21 CTF Writeup：3dub 1

3dub 1：badmedicine

In this problem, we only see a login form.








After we login with some username. We get the login successful page.
But it show that "the key is only for the admin"
And if we try to login with admin. The message "admin login disabled" showed.
Then we return to login by other account and observe the behavior of web page by tamper data.
With tamper data, we observe the cookie "username" was set.

After try to login with different username
admin1 : 09c8259ca01f
admiN  : 09c8259c80
We can find that most part of cookie are the same and only differ lightly.
Therefore we can guess that cookies are encrypt by xor operator.
Finally we can find the cookie of admin
admin : 09c8259ca0
Then we change the value of cookie and resend the page to get the key.

張貼者： 於 沒有留言:
標籤： , ,
訂閱： 文章 (Atom)