Baptiste MOINE Creased

## README.md

      
              2 files
            
          
              0 forks
            
          
              0 comments
            
          
              1 star
            
          
                Creased
                / README.md
            
            
              Created
              March 25, 2021 08:09
            
              
                Create symbol file from kallsyms
              
          
    Generate symbol file:
python kernel_syms.py
as -o kernal_syms.o kernel_syms.s
Load the symbols into gdb:


## README.md

      
              6 files
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                Creased
                / README.md
            
            
              Last active
              November 27, 2020 23:34
            
              
                Dharma.exe short writeup
              
          
    Dharma.exe

This challenge is fairly simple, a first binary (dharma) drops a second one (2O3naSbh, but let's call it stage2) using a well-known in-memory loading technique (please refer to this article for details).
As this is a CTF challenge, we're looking for the shortest path to get the flag: let's just patch the binary to make it drops the binary to a common file descriptor (e.g., stdout, stdin, stderr).
Because I'm lazy, I decided to apply the following patch:
--- dharma

  
## create_users.sh
#!/bin/bash
while IFS=';' read -r USER PASSWORD; do
    echo "Creating ${USER} user..."
    useradd -s /bin/bash -d /home/${USER} -m ${USER}
    usermod -aG sudo ${USER}
    echo "${USER}:${PASSWORD}" | chpasswd
    echo "Default password set to ${PASSWORD} for ${USER} user."
done < users.txt

## chall_left.py
#!/usr/bin/env python3
import requests
import html

creased = 14542

s = requests.Session()

def get_chall_ids():
    finished = False

## exploit.py
from pwn import *

context.clear(arch='amd64', log_level='info')

LOCAL = False
p = None

def create_process():
    global p
    if LOCAL:

## exploit.py
from pwn import *

context.clear(arch='amd64', log_level='info')

PROMPT = b'peterpan@pwnuser:~$ '

LOCAL = False
p = None

def create_process():

## exploit.py
from pwn import *

# Doc: docs.pwntools.com/en/stable/

context.log_level = 'debug'  # debug/info/error/warning.
context.arch = 'i386'  # i386/x64/arm, etc.

## OPEN SOCKET.
sock = remote('challenges.ecsc-teamfrance.fr', 2000)
## OR, OPEN LOCAL PROCESS.

## exploit.py
import base64

from pwn import *

context.log_level = 'info'

PROMPT = '>>> '

def get_con():
    p = remote('ctf.bzh', 11000)

## containerd.io_1.2.2-1_amd64.deb

      
              4 files
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                Creased
                / containerd.io_1.2.2-1_amd64.deb
            
            
              Last active
              April 4, 2019 15:07
            
              
                CVE-2019-5736 exploit
              
          
      This file has been truncated, but you can view the full file.
    

            View raw
        
    
## format_protostar.sh

export TMP=$(mktemp -d)
/bin/cat <<-EOF >${TMP}/exploit.py
#!/usr/bin/env python
# -*- coding:Utf-8 -*-

#==========================================================#
# [+] Title:   Exploitation code for Protostar format 0    #
# [+] Author:  Baptiste M. (Creased)                       #
# [+] Website: bmoine.fr                                   #
	#!/bin/bash
	while IFS=';' read -r USER PASSWORD; do
	echo "Creating ${USER} user..."
	useradd -s /bin/bash -d /home/${USER} -m ${USER}
	usermod -aG sudo ${USER}
	echo "${USER}:${PASSWORD}" \| chpasswd
	echo "Default password set to ${PASSWORD} for ${USER} user."
	done < users.txt
	#!/usr/bin/env python3
	import requests
	import html

	creased = 14542

	s = requests.Session()

	def get_chall_ids():
	finished = False
	from pwn import *

	context.clear(arch='amd64', log_level='info')

	LOCAL = False
	p = None

	def create_process():
	global p
	if LOCAL:
	from pwn import *

	context.clear(arch='amd64', log_level='info')

	PROMPT = b'peterpan@pwnuser:~$ '

	LOCAL = False
	p = None

	def create_process():
	from pwn import *

	# Doc: docs.pwntools.com/en/stable/

	context.log_level = 'debug' # debug/info/error/warning.
	context.arch = 'i386' # i386/x64/arm, etc.

	## OPEN SOCKET.
	sock = remote('challenges.ecsc-teamfrance.fr', 2000)
	## OR, OPEN LOCAL PROCESS.
	import base64

	from pwn import *

	context.log_level = 'info'

	PROMPT = '>>> '

	def get_con():
	p = remote('ctf.bzh', 11000)

	export TMP=$(mktemp -d)
	/bin/cat <<-EOF >${TMP}/exploit.py
	#!/usr/bin/env python
	# -- coding:Utf-8 --

	#==========================================================#
	# [+] Title: Exploitation code for Protostar format 0 #
	# [+] Author: Baptiste M. (Creased) #
	# [+] Website: bmoine.fr #