ctf-writeups

KO | EN

gitlite — search

#javascript #python #hacktoberfest #ai #llm #go #android #deep-learning #nodejs #java #cli #vue #pytorch #mcp

(★ 92)

No description available.

File Explorer

Download Latest Version (.zip)

- - check_win.py
  - test_tsp.py
  - tsp-solver
  - win.py
- - .gdb_history
  - bitterman
  - libc.so.6
  - README.md
  - win.py
- .envrc
- bomb
- flag2.py
- flake.lock
- flake.nix
- - moms_spaghetti
  - win.py
  - writeup0.py
  - writeup1.py
  - writeup2.py
  - writeup3.py
- - README.md
  - runic
  - runic.png
  - win.py
- - .gdb_history
  - README.md
  - sigil
  - sigil.png
  - win.py
- - index.html
  - log-all.js
  - main.js
  - README.md
  - test.wasabi.js
  - test.wasm
- - magic000
  - magic001
  - magic002
  - magic003
  - magic004
  - magic005
  - magic006
  - magic007
  - magic008
  - magic009
  - README.md
  - reconstruct.py
  - small_win.py
  - small_win2.py
  - small_win3.py
  - small_win4.py
  - small_win5.py
- - camera_feed.png
  - factory_cam_1.png
  - factory_cam_2.png
  - factory_cam_3.png
  - factory_cam_4.png
  - factory_cam_5.png
  - xor_images.py
  - xored.png
- - base64.png
  - gnome.pcap
  - output
  - output2
  - parse_pcap.py
  - picture.jpg
  - response_1337.png
  - test.py
- .DS_Store
- firmware.bin
- notes
- response
- - check.py
  - dialer.cs
  - make-prefixes.py
- - admin-panel.png
  - cap.png
  - xss-1.png
- README.md
- - libc-2.19.so
  - moneygame
  - moneygame-patched
  - patch.py
  - README.md
  - srand.png
  - win.py
- - rps
  - test.py
  - win.py
- - cookies.php
  - index.php
  - root_data.php
  - Steve.png
- hlextend.py
- hlextend.pyc
- phpscript.php
- README.md
- steves_list_backup.zip
- win.py
- - johns-library
  - README.md
  - win.py
- - .gdb_history
  - johns-shuffle
  - README.md
  - win.py
- cryptex.jpg
- hc4.pdf
- README.md
- tumblers.png
- win.py
- - find_language.py
  - README.md
  - win.py
- - cryptor-buff1.png
  - cryptor-buff2.png
  - make-pwnmsg.py
  - msg_admin_gadgets
  - README.md
  - repo-directory.png
  - win.py
- - libc-2.19.so
  - readfile
  - win_1.py
  - win_2.py
  - win_3.py
  - win_4.py
  - win_5.py
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Quick writeups

#### Haxdump 2015 - pwnxy
Requests a page via a given GET request. The request results is placed directly into a printf, resulting in a string format vuln. From the vuln, overwrite the `exit` entry in the GOT with a static stack address to execute code from the GET request

#### P_KR
"My first overflow" style. Simply give `0xCAFEBABE` 14 times in order to overwrite the local variable

Client/Server problem to implement a binary search in order to find a random number in a range of numbers

Input a username and two passcodes in order to "login". Using the username field, overwrite the pointer to where the first passcode writes. Use the first passcode field to overwrite the `exit` entry in the GOT with the address of the `system('/bin/sh')` provided in the binary

Input a password, it is xor'ed with a key and if it matches the password from a file, you win. Logic error in setting a file descriptor while comparing the result. Missing parentheses allowed the attacker to control both the input password and the password used to check against.

Give a base64 encoded message, and get the md5 sum of the original message. Stack canaries are on. There is a "captcha" before sending your message that is calculated with the stack canary. Random is also seeded with time(), which we also know because we have access to the server itself. Knowing this, we can calculate the calculate the stack canary ourselves. The base64 decode function allows an overflow to happen. The decoded message contains the canary at the correct location, and then a ret2system was easy peasy.

Implementation of the brainfuck language. Use the pointer to leak the address of `puts` then overwrite `puts` with the address of a few instructions after `puts` in `main`. Send a second `bf` instruction with our rop payload of `system('/bin/sh')` from their libc. Overwrite `puts` a second time with a stack pivot to add to esp and reach our `system` call. `PROFIT!`

ctf-writeups

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

ctf-writeups

File Explorer

Today's picks

Was this content helpful?

Recent Feedback

Download README