CSAW 2013 Exploit 400

Credit to Ryan

The first thing we did for this challenge was to look at the program headers:

From the headers we can see that the stack is given read, write, and execute permission therefore assuming the stack has enough space and we can overflow the buffer we should be able to place and execute shell code on the stack. By looking at the assembly in IDA pro we discovered that the executable does not contain linking information. Rather than finding the function that reads in user input we found the length to return address through trial and error. The input length to return address is 417 bytes as shown in the screenshot below.

Now that we have control of EIP we need to return to our shell luckily upon further inspection of the stack addresses we noticed that the stack is using memory addresses from the executable. This means the STACK ADDRESSES ARE STATIC. From here we wrote a script to send the shellcode that opens a bind shell on the remote server, connect to the server and cat the key.

Flag = key{And_all_I_got_was_this_stupid_key}

Link to solution code: https://github.com/IAryan/CTFSolutions/tree/master/CSAW/2013/Exploit_400

CSAW 2013 Exploit 100

Credit to Ryan

For this challenge we are given two files exploit1 and exploit1.c (code snip it from program). Exploit1.c code snip it is as follows:

[snip]

void handle(int newsock) {

        int backdoor = 0;

        char buffer[1016];

        memset(buffer, 0, 1016);

        send(newsock, "Welcome to CSAW CTF.", 21, 0);

        recv(newsock, buffer, 1020, 0);

        buffer[1015] = 0;

        if ( backdoor ) {

               fd = fopen("./key", "r");

               fscanf(fd, "%s\n", buffer);

               send(newsock, buffer, 512, 0);

        }

        close(newsock);

}

[snip]

From the code snip it we can clearly tell the program allocates 1016 bytes for the buffer but reads in 1020 bytes. This can be confirmed in Ida Pro:

As the screen shot from Ida Pro shows the code will read in four more bytes then what is allocated for buf. This will cause the program to overwrite the values in var_D and var_C. The diagram of the stack is as follows:

To make the program print the key we need to make the value of var_C not equal zero. To do this we simply need to give the program an input string that is at least 1020 bytes long. This will overwrite var_C and force the program to run the logic that prints the key.

 We've lost the key since yesterday, will edit if we find it