Unintended CPython101 From May 5th to 7th the second edition of the PWNME CTF was held**. Our team participated in the student category. For this write-up, I will explain how I was able to bypass the intended way to flag the Pwn CPython101 challenge. CPython101 What if you could do memory corruption in Python ? Well this is an opportunity for you to discover that ! Find a way to read the flag on the remote service....
Reverse - JeanLouis Analyse En ouvrant le binaire dans Ghidra et apr猫s avoir renomm茅 les variables, on tombe sur une sorte de memcpy d鈥檜n shellcode qui sera xor茅 avec une cl茅 statique ensuite par le programme. Figure 1: Copie du shellcode et XOR de celui-ci. SHELLCODE = "4F274DEB5442071D4F075746544F530743424F42074A484F425D074B4F624953559F232727279C26272727AEC69D3F272727EAA79F242727279C27272727AA6B03C79D37272727EAA7AEE8AD30A7D56AA7DD3928A2CC27272760AD30A7D548A7DD1C28A2FB27272760AD30A7D553A7DD1B28A2EA27272760AD30A7D543A7DD0228A29927272760AD30A7D542A7DD0128A28827272760AD30A7D557A7DD1C28A28727272760AD30A7D546A7DD3D28A2B627272760AD30A7D554A7DD0D28A2A527272760AD30A7D554A7DD31525060AD30A7D542A7DD3B524B60AD30A7D514A7DD71524660AD30A7D514A7DD6D527160AD30A7D545A7DD20526C60AD30A7D546A7DD75526760AD30A7D543A7DD70521260AD30A7D543A7DD3E520D604F0E0E2D274F0042071D4F074D48524F654E42499F232727279C26272727AEC69D28272727EAA7CC1D4D2D4F090909094F544209094F075746544F530743424F54074A484F5251464E4F6A4627279F232727279C26272727AEC69D07272727EAA7CC279F262727279C27272727EAA700" SHELLCODE = bytes.fromhex(SHELLCODE) final_shellcode = bytearray(len(SHELLCODE)) for k in range(0, 0x18b): final_shellcode[k] = SHELLCODE[k] ^ 0x27 print(bytes(final_shellcode)) Il suffit de prendre le shellcode en m茅moire de le copier et de placer la valeur hexa dans un site comme defuse....
Global Pandemic This challenge give us the c code and the compiled binary. Figure 1: Global_Pandemic.c The Vulnerability First, at looking at the c code we can see the printf(pass); line. That is a Format Bug String. We can check that if we try to compile with clang. Figure 2: Compilation of the c code with clang. Pre-requirements To obtain the flag, we need to change the admin variable value. To do that, we need to write 0xb4dbabe3 were the address of admin is....
Why not a Sandbox? Points : 490 (dynamique) Votre but est d'appeler la fonction print_flag pour afficher le flag. Service : nc challenges1.france-cybersecurity-challenge.fr 4005 Analyse Avec la description du challenge je me doute qu鈥檌l doit y avoir une fonction cach茅e que je vais devoir trouver. La description 茅tant assez courte et contenant peu d鈥檌nformations, je me concentre sur l鈥檈nvironnement. En se connectant au challenge, je sais que j鈥檃i affaire 脿 la version 3....