Defcon 2015 Coding Skillz 1 Writeup

Just connecting to the service, a 64bit cpu registers dump is received, and so does several binary code as you can see:

The registers represent an initial cpu state, and we have to reply with the registers result of the binary code execution. This must be automated becouse of the 10 seconds server socket timeout.

The exploit is quite simple, we have to set the cpu registers to this values, execute the code and get resulting registers.

In python we created two structures for the initial state and the ending state.

cpuRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}
finalRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

We inject at the beginning several movs for setting the initial state:

for r in cpuRegs.keys():

    code.append('mov %s, %s' % (r, cpuRegs[r]))

The 64bit compilation of the movs and the binary code, but changing the last ret instruction by a sigtrap "int 3"

We compile with nasm in this way:

os.popen('nasm -f elf64 code.asm')

os.popen('ld -o code code.o ')

And use GDB to execute the code until the sigtrap, and then get the registers

fd = os.popen("gdb code -ex 'r' -ex 'i r' -ex 'quit'",'r')

for l in fd.readlines():

    for x in finalRegs.keys():

           ...

We just parse the registers and send the to the server in the same format, and got the key.

The code:

from libcookie import *

from asm import *

import os

import sys

host = 'catwestern_631d7907670909fc4df2defc13f2057c.quals.shallweplayaga.me'

port = 9999

cpuRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

finalRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

fregs = 15

s = Sock(TCP)

s.timeout = 999

s.connect(host,port)

data = s.readUntil('bytes:')

#data = s.read(sz)

#data = s.readAll()

sz = 0

for r in data.split('\n'):

    for rk in cpuRegs.keys():

        if r.startswith(rk):

            cpuRegs[rk] = r.split('=')[1]

    if 'bytes' in r:

        sz = int(r.split(' ')[3])

binary = data[-sz:]

code = []

print '[',binary,']'

print 'given size:',sz,'bin size:',len(binary)        

print cpuRegs

for r in cpuRegs.keys():

    code.append('mov %s, %s' % (r, cpuRegs[r]))

#print code

fd = open('code.asm','w')

fd.write('\n'.join(code)+'\n')

fd.close()

Capstone().dump('x86','64',binary,'code.asm')

print 'Compilando ...'

os.popen('nasm -f elf64 code.asm')

os.popen('ld -o code code.o ')

print 'Ejecutando ...'

fd = os.popen("gdb code -ex 'r' -ex 'i r' -ex 'quit'",'r')

for l in fd.readlines():

    for x in finalRegs.keys():

        if x in l:

            l = l.replace('\t',' ')

            try:

                i = 12

                spl = l.split(' ')

                if spl[i] == '':

                    i+=1

                print 'reg: ',x

                finalRegs[x] = l.split(' ')[i].split('\t')[0]

            except:

                print 'err: '+l

            fregs -= 1

            if fregs == 0:

                #print 'sending regs ...'

                #print finalRegs

                

                buff = []

                for k in finalRegs.keys():

                    buff.append('%s=%s' % (k,finalRegs[k]))

                print '\n'.join(buff)+'\n'

                print s.readAll()

                s.write('\n'.join(buff)+'\n\n\n')

                print 'waiting flag ....'

                print s.readAll()

                print '----- yeah? -----'

                s.close()

                

fd.close()

s.close()

Related news

1. Ethical Hacker Tools
2. Hacker Tools 2019
3. Pentest Recon Tools
4. Hacking Tools Pc
5. Hacker Tools For Pc
6. Termux Hacking Tools 2019
7. Hacking Tools 2019
8. Best Hacking Tools 2020
9. Hacking Tools Download
10. Hacking App
11. Hack Tools Mac
12. Pentest Tools Find Subdomains
13. How To Hack
14. Hackers Toolbox
15. Best Pentesting Tools 2018
16. Blackhat Hacker Tools
17. Pentest Tools Tcp Port Scanner
18. Hack Tools For Pc
19. Hack Rom Tools
20. Hack And Tools
21. Hacker Tools 2020
22. Hacking Tools 2020
23. Nsa Hack Tools Download
24. Pentest Tools
25. Growth Hacker Tools
26. Hack Tool Apk No Root
27. Pentest Tools Kali Linux
28. Hacker Security Tools
29. Hacker Tools
30. Pentest Tools Nmap
31. How To Install Pentest Tools In Ubuntu
32. Pentest Tools Url Fuzzer
33. Hack Tools
34. Free Pentest Tools For Windows
35. Hacker Hardware Tools
36. Black Hat Hacker Tools
37. Pentest Tools Linux
38. Hacker Techniques Tools And Incident Handling
39. Pentest Tools Url Fuzzer
40. Hacking Tools Mac
41. Hack Tools For Mac
42. How To Hack
43. Hacking Tools
44. Tools 4 Hack
45. Hacking Tools Windows 10
46. Nsa Hacker Tools
47. Hacking Tools For Kali Linux
48. Wifi Hacker Tools For Windows
49. Hacker Tools Free
50. Pentest Tools Framework
51. Hacker Tool Kit
52. Pentest Reporting Tools
53. Pentest Tools Kali Linux
54. Tools 4 Hack
55. Hacker Tools Free
56. Black Hat Hacker Tools
57. Github Hacking Tools
58. Hak5 Tools
59. Hacking Tools Mac
60. Hackers Toolbox
61. Android Hack Tools Github
62. Hacker Tools Software
63. Pentest Tools List
64. Tools For Hacker
65. Github Hacking Tools
66. Hack And Tools
67. Pentest Tools Linux
68. Hack Tools For Mac
69. Hacker Hardware Tools
70. Hacking App
71. Hacker Tools Free
72. Hacker Tools Hardware
73. Pentest Tools Subdomain
74. Hack Tools 2019
75. Pentest Tools Free
76. Hack Tools For Windows
77. Hacking Tools Kit
78. Pentest Tools Find Subdomains
79. Hack Tool Apk
80. Computer Hacker
81. Ethical Hacker Tools
82. Hacker Tool Kit
83. Pentest Tools Tcp Port Scanner
84. Hacker Tools
85. Pentest Tools Alternative
86. Hacker Tools List
87. Hacking Tools Name
88. Hacking Tools Download
89. World No 1 Hacker Software
90. Hacker Tools Apk
91. New Hacker Tools
92. Best Pentesting Tools 2018
93. Pentest Tools Windows
94. Pentest Tools Alternative
95. Hacking Tools Pc
96. Hacker
97. How To Install Pentest Tools In Ubuntu
98. Pentest Automation Tools
99. Hack Tools For Games
100. Hacker Tools 2019
101. Github Hacking Tools
102. Pentest Tools Nmap
103. Underground Hacker Sites
104. New Hacker Tools
105. Pentest Tools Alternative
106. Pentest Tools Apk
107. Hacker Tools Free
108. Wifi Hacker Tools For Windows
109. Pentest Reporting Tools
110. What Is Hacking Tools
111. Easy Hack Tools
112. Hacking Tools Mac
113. Tools 4 Hack
114. Bluetooth Hacking Tools Kali
115. Hacking Tools For Pc
116. Pentest Tools Review
117. Pentest Tools Bluekeep
118. Hack Tools
119. Hacking Tools Hardware
120. Pentest Tools For Android
121. Pentest Tools Free
122. Game Hacking
123. Pentest Tools Alternative
124. Hacker Techniques Tools And Incident Handling
125. Hack Tools For Ubuntu
126. Hacking Tools For Windows Free Download
127. Top Pentest Tools
128. Pentest Tools Bluekeep
129. Hack And Tools
130. Hackers Toolbox
131. Hacking Tools For Games
132. Pentest Tools Website Vulnerability
133. Hacking Tools For Mac
134. Nsa Hack Tools
135. What Are Hacking Tools
136. Hack And Tools
137. Hacking Tools Github
138. Hack Tools For Ubuntu
139. Pentest Tools Framework
140. Hack Tools Pc
141. Ethical Hacker Tools
142. Hacking Tools For Windows Free Download
143. Hacking Tools Software