본문 바로가기

시스템 해킹59

[Pwnable.kr] input #include #include #include #include #include int main(int argc, char* argv[], char* envp[]){ printf("Welcome to pwnable.kr\n"); printf("Let's see if you know how to give input to program\n"); printf("Just give me correct inputs then you will get the flag :)\n"); // argv if(argc != 100) return 0; if(strcmp(argv['A'],"\x00")) return 0; if(strcmp(argv['B'],"\x20\x0a\x0d")) return 0; printf("Stage 1.. 2021. 7. 27.
[Pwnable.kr] random #include int main(){ unsigned int random; random = rand(); // random value! unsigned int key=0; scanf("%d", &key); if( (key ^ random) == 0xdeadbeef ){ printf("Good!\n"); system("/bin/cat flag"); return 0; } printf("Wrong, maybe you should try 2^32 cases.\n"); return 0; } 문제 코드는 위와 같다. 핵심은 random 함수에 시드 값이 없으므로 random 함수의 결과값이 랜덤이 아닐 것임을 추측할 수 있다. random 함수의 결과값은 gdb로 확인하면 0x6b8b4567이다. 따라서 양쪽에 r.. 2021. 7. 27.
[Pwnable.kr] passcode #include #include void login(){ int passcode1; int passcode2; printf("enter passcode1 : "); scanf("%d", passcode1); fflush(stdin); // ha! mommy told me that 32bit is vulnerable to bruteforcing :) printf("enter passcode2 : "); scanf("%d", passcode2); printf("checking...\n"); if(passcode1==338150 && passcode2==13371337){ printf("Login OK!\n"); system("/bin/cat flag"); } else{ printf("Login Failed!.. 2021. 7. 27.
[Dreamhack] basic_heap_overflow #include #include #include #include #include struct over { void (*table)(); }; void alarm_handler() { puts("TIME OUT"); exit(-1); } void initialize() { setvbuf(stdin, NULL, _IONBF, 0); setvbuf(stdout, NULL, _IONBF, 0); signal(SIGALRM, alarm_handler); alarm(30); } void get_shell() { system("/bin/sh"); } void table_func() { printf("overwrite_me!"); } int main() { char *ptr = malloc(0x20); struct o.. 2021. 7. 20.
[Dreamhack] memory_leakage #include #include #include #include #include FILE *fp; struct my_page { char name[16]; int age; }; void alarm_handler() { puts("TIME OUT"); exit(-1); } void initialize() { setvbuf(stdin, NULL, _IONBF, 0); setvbuf(stdout, NULL, _IONBF, 0); signal(SIGALRM, alarm_handler); alarm(30); } int main() { struct my_page my_page; char flag_buf[56]; int idx; memset(flag_buf, 0, sizeof(flag_buf)); initialize.. 2021. 7. 19.
[Dreamhack] out_of_bound #include #include #include #include #include char name[16]; char *command[10] = { "cat", "ls", "id", "ps", "file ./oob" }; void alarm_handler() { puts("TIME OUT"); exit(-1); } void initialize() { setvbuf(stdin, NULL, _IONBF, 0); setvbuf(stdout, NULL, _IONBF, 0); signal(SIGALRM, alarm_handler); alarm(30); } int main() { int idx; initialize(); printf("Admin name: "); read(0, name, sizeof(name)); p.. 2021. 7. 18.
[Dreamhack] basic_exploitation_002 basic_explotation_002.c #include #include #include #include void alarm_handler() { puts("TIME OUT"); exit(-1); } void initialize() { setvbuf(stdin, NULL, _IONBF, 0); setvbuf(stdout, NULL, _IONBF, 0); signal(SIGALRM, alarm_handler); alarm(30); } void get_shell() { system("/bin/sh"); } int main(int argc, char *argv[]) { char buf[0x80]; initialize(); read(0, buf, 0x80); printf(buf); exit(0); } 코드의 .. 2021. 7. 17.
[Dreamhack] sint 문제에서 주어진 코드는 아래와 같다. sint.c #include #include #include #include void alarm_handler() { puts("TIME OUT"); exit(-1); } void initialize() { setvbuf(stdin, NULL, _IONBF, 0); setvbuf(stdout, NULL, _IONBF, 0); signal(SIGALRM, alarm_handler); alarm(30); } void get_shell() { system("/bin/sh"); } int main() { char buf[256]; int size; initialize(); signal(SIGSEGV, get_shell); printf("Size: "); scanf("%d",.. 2021. 7. 15.
[Dreamhack] basic_exploitation_003 #include #include #include #include void alarm_handler() { puts("TIME OUT"); exit(-1); } void initialize() { setvbuf(stdin, NULL, _IONBF, 0); setvbuf(stdout, NULL, _IONBF, 0); signal(SIGALRM, alarm_handler); alarm(30); } void get_shell() { system("/bin/sh"); } int main(int argc, char *argv[]) { char *heap_buf = (char *)malloc(0x80); char stack_buf[0x90] = {}; initialize(); read(0, heap_buf, 0x80.. 2021. 5. 22.

티스토리툴바