Skip to content

Instantly share code, notes, and snippets.

Avatar
🎯
deadlocking the reality

Disconnect3d disconnect3d

🎯
deadlocking the reality
View GitHub Profile
@disconnect3d
disconnect3d / README.md
Last active Aug 10, 2022
Pwndbg sprint tasks (10.08.2022)
View README.md

Sprint Pwndbg (10.08.2022)

Hi! Witaj na stronie sprintu Pwndbg. Poniżej możesz przeczytać opisy przykładowych rzeczy, które można by dodać lub usprawnić w Pwndbg :).

Zadania mają różną trudność i wymagają różnej wiedzy. Prostsze zadania mogą pomóc w rozeznaniu się w strukturze projektu lub różnych schematach, np. jak wygląda "komenda".

PS: Na samym dole dodałem kilka przykładów róznych API w Pwndbg, które mogą się przydać oraz informacji o samym GDB.

@disconnect3d
disconnect3d / Working GDB on macOS 11.md
Created Jul 1, 2021 — forked from mike-myers-tob/Working GDB on macOS 11.md
Steps to get GDB actually working in April 2021 on macOS
View Working GDB on macOS 11.md

Debug with GDB on macOS 11

The big reason to do this is that LLDB has no ability to "follow-fork-mode child", in other words, a multi-process target that doesn't have a single-process mode (or, a bug that only manifests when in multi-process mode) is going to be difficult or impossible to debug, especially if you have to run the target over and over in order to make the bug manifest. If you have a repeatable bug, no big deal, break on the fork from the parent process and attach to the child in a second lldb instance. Otherwise, read on.

Install GDB

Don't make the mistake of thinking you can just brew install gdb. Currently this is version 10.2 and it's mostly broken, with at least two annoying bugs as of April 29th 2021, but the big one is https://sourceware.org/bugzilla/show_bug.cgi?id=24069

$ xcode-select install  # install the XCode command-line tools
@disconnect3d
disconnect3d / subprocess.py
Created Jun 20, 2021 — forked from thomasballinger/subprocess.py
Using a pseudo-terminal to interact with interactive Python in a subprocess
View subprocess.py
from subprocess import Popen, PIPE
import pty
import os
from select import select
import sys
import tty
master, slave = pty.openpty()
p = Popen(['python'], stdin=slave, stdout=PIPE, stderr=PIPE)
pin = os.fdopen(master, 'w')
@disconnect3d
disconnect3d / uql_solver.py
Last active Apr 8, 2021
Solver for the UQL (Universal Query Language) task from Angstrom CTF 2021
View uql_solver.py
#!/usr/bin/env python
from pwn import *
if args.MOD:
exe = context.binary = ELF('./a.out') # my modified version # the leak below works only on original
else:
exe = context.binary = ELF('./uql')
def start(argv=[], *a, **kw):
@disconnect3d
disconnect3d / README.md
Created Jan 31, 2021
justCTF [*] 2020 writeups to Go-fs and D0cker by Disconnect3d
View README.md

D0cker

In this challenge, we connect to a server which spawns us a Docker container. On the filesystem, there is an oracle.sock with which we have to communicate and we have to find answers to its questions.

➜  pwn_docker git:(master) nc docker-ams32.nc.jctf.pro 1337

Access to this challenge is rate limited via hashcash!
Please use the following command to solve the Proof of Work:
@disconnect3d
disconnect3d / explanation.md
Last active Dec 21, 2020
Pfoten chall solution from hxp 2020 ctf; tl;dr: swap was RW and we had to get privesc through it (we swapped out the pid=1 busybox page; ofc its not super deterministic so we kinda brute this)
View explanation.md

1) Linux with globally read & write swapfile There was a minimal linux kernel with not many features in the task and we had a non-privileged shell in it. The init script, which ran busybox, enabled swap, but the swapfile permissions allowed others to read/write it. The init then launched a non-user (uid=1) shell (so, another busybox). The flag file was owned and only readable by root. There was ~80MB of ram and 10MB of swap.

Ofc first idea is "force kernel to read the flag file and swap it" and then read it - but I don't think it is possible. Another idea: make privilege escalation through writable swapfile.

So how do you do it? Kernel memory pages can't be swapped, so you allocate a lot memory in kernel space to fill in available memory and force kernel to swap the init process memory pages. You can allocate kernel memory with its ipc framework available for userspace. You do msgsend(msgget(..)) and each call allows you to allocate ~4kB and you can do 32000 such allocations (usually, depends on

@disconnect3d
disconnect3d / hacklu2020_backdoor_pwn_solver.py
Last active Oct 26, 2020
Solution to Hacklu CTF 2020 "Through the Backdoor" pwn task
View hacklu2020_backdoor_pwn_solver.py
# Sadly, solved 5min after CTF :(
# Flag: flag{banging_with_my_big_bag_of_backdoors}
import datetime
from pwn import *
from cint import U64
if args.REMOTE:
p = remote(args.HOST or 'flu.xxx', int(args.PORT or 2030))
else:
p = process('./run-qemu.sh')
@disconnect3d
disconnect3d / release-android-debuggable.md
Created Sep 19, 2020 — forked from nstarke/release-android-debuggable.md
How to make a Release Android App debuggable
View release-android-debuggable.md

How to make a Release Android App debuggable

Let's say you want to access the application shared preferences in /data/data/com.mypackage.
You could try to run adb shell and then run-as com.mypackage ( or adb shell run-as com.mypackge ls /data/data/com.mypackage/shared_prefs), but on a production release app downloaded from an app store you're most likely to see:

run-as: Package 'com.mypackage' is not debuggable
@disconnect3d
disconnect3d / compiling_asm.md
Created Sep 5, 2020 — forked from yellowbyte/compiling_asm.md
how to assemble assembly with NASM assembler to 32-bit or 64-bit ELF binary with or without libc
View compiling_asm.md

32-bit ELF binary

how to assemble and link:

nasm -f elf32 -o <filename>.o <filename>.asm
ld -m elf_i386 -o <filename> <filename>.o

template code (hello world):

section .text
global _start
@disconnect3d
disconnect3d / spam.cpp
Last active Jun 14, 2020
An attempt to make RDRAND step to fail
View spam.cpp
// g++ spam.cpp -O3 -lpthread -std=c++14 && ./a.out
#include <stdio.h>
#include <stdint.h>
#include <thread>
#include <immintrin.h>
__attribute__ ((target ("rdrnd")))
void exec(int id) {
printf("[thread %d]\n", id);