Defcon 2015 Coding Skillz 1 Writeup

Just connecting to the service, a 64bit cpu registers dump is received, and so does several binary code as you can see:

The registers represent an initial cpu state, and we have to reply with the registers result of the binary code execution. This must be automated becouse of the 10 seconds server socket timeout.

The exploit is quite simple, we have to set the cpu registers to this values, execute the code and get resulting registers.

In python we created two structures for the initial state and the ending state.

cpuRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}
finalRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

We inject at the beginning several movs for setting the initial state:

for r in cpuRegs.keys():

    code.append('mov %s, %s' % (r, cpuRegs[r]))

The 64bit compilation of the movs and the binary code, but changing the last ret instruction by a sigtrap "int 3"

We compile with nasm in this way:

os.popen('nasm -f elf64 code.asm')

os.popen('ld -o code code.o ')

And use GDB to execute the code until the sigtrap, and then get the registers

fd = os.popen("gdb code -ex 'r' -ex 'i r' -ex 'quit'",'r')

for l in fd.readlines():

    for x in finalRegs.keys():

           ...

We just parse the registers and send the to the server in the same format, and got the key.

The code:

from libcookie import *

from asm import *

import os

import sys

host = 'catwestern_631d7907670909fc4df2defc13f2057c.quals.shallweplayaga.me'

port = 9999

cpuRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

finalRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

fregs = 15

s = Sock(TCP)

s.timeout = 999

s.connect(host,port)

data = s.readUntil('bytes:')

#data = s.read(sz)

#data = s.readAll()

sz = 0

for r in data.split('\n'):

    for rk in cpuRegs.keys():

        if r.startswith(rk):

            cpuRegs[rk] = r.split('=')[1]

    if 'bytes' in r:

        sz = int(r.split(' ')[3])

binary = data[-sz:]

code = []

print '[',binary,']'

print 'given size:',sz,'bin size:',len(binary)        

print cpuRegs

for r in cpuRegs.keys():

    code.append('mov %s, %s' % (r, cpuRegs[r]))

#print code

fd = open('code.asm','w')

fd.write('\n'.join(code)+'\n')

fd.close()

Capstone().dump('x86','64',binary,'code.asm')

print 'Compilando ...'

os.popen('nasm -f elf64 code.asm')

os.popen('ld -o code code.o ')

print 'Ejecutando ...'

fd = os.popen("gdb code -ex 'r' -ex 'i r' -ex 'quit'",'r')

for l in fd.readlines():

    for x in finalRegs.keys():

        if x in l:

            l = l.replace('\t',' ')

            try:

                i = 12

                spl = l.split(' ')

                if spl[i] == '':

                    i+=1

                print 'reg: ',x

                finalRegs[x] = l.split(' ')[i].split('\t')[0]

            except:

                print 'err: '+l

            fregs -= 1

            if fregs == 0:

                #print 'sending regs ...'

                #print finalRegs

                

                buff = []

                for k in finalRegs.keys():

                    buff.append('%s=%s' % (k,finalRegs[k]))

                print '\n'.join(buff)+'\n'

                print s.readAll()

                s.write('\n'.join(buff)+'\n\n\n')

                print 'waiting flag ....'

                print s.readAll()

                print '----- yeah? -----'

                s.close()

                

fd.close()

s.close()

More articles

• Pentest Tools For Android
• Pentest Tools Framework
• Pentest Reporting Tools
• Nsa Hack Tools
• Tools 4 Hack
• Pentest Recon Tools
• Hacking Tools For Games
• Pentest Tools For Mac
• Hacking Tools Software
• Hacking Tools For Pc
• Game Hacking
• Computer Hacker
• Pentest Tools Linux
• Hacker Tools For Pc
• Hacking Tools For Windows 7
• What Is Hacking Tools
• Pentest Tools Framework
• Hack Apps
• Underground Hacker Sites
• Hacking Tools Hardware
• Tools 4 Hack
• Hacker Tools For Ios
• Hack Tools For Ubuntu
• Pentest Tools Website
• Hacking Tools Hardware
• Game Hacking
• Hack Tools Github
• Hacking App
• Github Hacking Tools
• Hack Tools Github
• Kik Hack Tools
• Hack Tools
• How To Make Hacking Tools
• Hacker Tools Free Download
• Hacker Tools Mac
• Hacking Tools Mac
• Pentest Recon Tools
• What Are Hacking Tools
• Pentest Tools For Mac
• Hacker Tools Apk Download
• Hacking Tools 2020
• Best Hacking Tools 2019
• Pentest Tools Website
• Black Hat Hacker Tools
• Hacking Tools Hardware
• Black Hat Hacker Tools
• Hacker Tools Mac
• Hacking Tools For Pc
• Hacking Tools Hardware
• Pentest Recon Tools
• Hacker Techniques Tools And Incident Handling
• Hacker Search Tools
• Tools For Hacker
• Hacker Tools Windows
• Tools For Hacker
• Beginner Hacker Tools
• Nsa Hacker Tools
• Hacker Tools 2020
• Hack Tools For Mac
• Pentest Tools Framework
• Hack App
• Pentest Tools Android
• Pentest Tools Url Fuzzer
• Usb Pentest Tools
• Hack Tools Mac
• Pentest Tools Open Source
• Hack Website Online Tool
• Nsa Hacker Tools
• Hacking Tools Github
• Hacker Tools For Windows
• Hacker Tools Hardware
• Hack Tools For Ubuntu
• Hacker Tools For Pc
• Pentest Tools Find Subdomains
• Pentest Tools Framework