K-atc

Secret Holder (HITCON 2016 Quals)

https://github.com/ctfs/write-ups-2016/tree/master/hitcon-ctf-2016/pwn/secret-holder-100

• Part1 (using fastbins+rop): SecretHolder.py
• Part2 (without fastbins+rop): SecretHolder2.py
• Part3 (without fastbins+One-gadget RCE): SecretHolder3.py
• libc identification part: SecretHolder-libc.py

K-atc

<?php
print_r(scandir('/var/www/flag4'));
?>

K-atc

tp の環境構築を簡便にする方法

cf. ATND - katagaitai CTF勉強会 #5 - 関東|med

Requirements

• vagrant

報告

• この環境でExploitできるようです！！
  • https://twitter.com/bata_24/status/749127224968646656

K-atc

SECCON 2015 Online - Individual Elebin

1.bin

$ ./1.bin
SECCON{AaA

2.bin

K-atc

{
	"binary_file_patterns":
	[
		"*.tga",
		"*.dds",
		"*.ico",
		"*.eot",
		"*.pdf",
		"*.psd",
		"*.swf",

K-atc

#!/usr/bin/env python2
# -*- coding: utf-8 -*

import run
import json
import time

def mtime():
    return time.time() * 1000

K-atc

#coding: utf-8
'''
ctf4b 奈良 (2015)
形式: Attack&Defense
チーム: 友利奈緒キャンプ
参加者名: 友利奈緒
問題: Webアプリケーションの脆弱性を突いて顧客情報をcsv形式のテキストで提出する
脆弱性の場所: http://<ipaddr>/admin/customers/detail/<num> (?)
スクリプトの機能: curlで取ってきたhtmlから必要な情報をスクレイピング
'''

K-atc

#target photoshop

//main
// in case we double clicked the file
//app.bringToFront();
app.displayDialogs = DialogModes.NO;
//ドキュメントが開かれているかどうか判別
if (app.documents.length ==0)
{
	//ドキュメントが開かれていない場合処理なし

K-atc

def is_prime(source):
  primes = [2,3,5,7,11,13,17,19,23,29,31,37,41,43,47,53,59,61,67,71,73,79,83,89,97,101,103,107,109,113,127,131,137,139,149,151,157,163,167,173,179,181,191,193,197,199,211,223,227,229,233,239,241,251,257,263,269,271,277,281,283,293,307,311,313,317,331,337,347,349,353,359,367,373,379,383,389,397,401,409,419,421,431,433,439,443,449,457,461,463,467,479,487,491,499,503,509,521,523,541,547,557,563,569,571,577,587,593,599,601,607,613,617,619,631,641,643,647,653,659,661,673,677,683,691,701,709,719,727,733,739,743,751,757,761,769,773,787,797,809,811,821,823,827,829,839,853,857,859,863,877,881,883,887,907,911,919,929,937,941,947,953,967,971,977,983,991,997,1009,1013,1019,1021,1031,1033,1039,1049,1051,1061,1063,1069,1087,1091,1093,1097,1103,1109,1117,1123,1129,1151,1153,1163,1171,1181,1187,1193,1201,1213,1217,1223,1229,1231,1237,1249,1259,1277,1279,1283,1289,1291,1297,1301,1303,1307,1319,1321,1327,1361,1367,1373,1381,1399,1409,1423,1427,1429,1433,1439,1447,1451,1453,1459,1471,1481,1483,1487,1489,14

K-atc

{
	"binary_file_patterns":
	[
		"*.tga",
		"*.dds",
		"*.ico",
		"*.eot",
		"*.pdf",
		"*.psd",
		"*.swf",