| import pefile | |
| """ | |
| $ python test_reloc_pefile.py | |
| Test with ntdll.dll - with bytearray and custom setter | |
| Parse PE : 0.054 seconds | |
| 574 relocs to handle ! | |
| Relocate it : 0.048 seconds | |
| Test with ntdll.dll - with classic buffer | |
| Parse PE : 0.053 seconds |
| from ctypes import * | |
| from ctypes import wintypes | |
| from collections import namedtuple | |
| import os | |
| import tempfile | |
| # CONFIG SYMBOLS | |
| SYMBOLS_PATH = os.environ.get('_NT_SYMBOL_PATH') | |
| if not SYMBOLS_PATH: | |
| CACHE_PDB_PATH = os.path.join(tempfile.gettempdir(), "symbols") |
| #include "stdafx.h" | |
| #include <windows.h> | |
| #include <Winbase.h> | |
| #include <Wtsapi32.h> | |
| #include <Userenv.h> | |
| #include <malloc.h> | |
| #pragma comment(lib, "Wtsapi32.lib") | |
| #pragma comment(lib, "Userenv.lib") |
| import sys | |
| import windows | |
| import windows.winproxy | |
| import windows.generated_def as gdef | |
| # List distro: wslconfig /l | |
| class WSLAPIProxy(windows.winproxy.ApiProxy): | |
| APIDLL = "wslapi" | |
| default_error_check = staticmethod(windows.winproxy.no_error_check) |
| import sys | |
| import windows | |
| import windows.winproxy | |
| import windows.generated_def as gdef | |
| class AMSIProxy(windows.winproxy.ApiProxy): | |
| APIDLL = "Amsi" | |
| default_error_check = staticmethod(windows.winproxy.no_error_check) | |
| """ |
| import os, binascii | |
| from flask import Flask, Response, abort | |
| def random_etag(): | |
| return "1000-" + binascii.b2a_hex(os.urandom(6)) | |
| app = Flask(__name__) | |
| PORT = 80 | |
| DLL_ETAG = random_etag() |
This challenge is a reverse / exploit composed of 5 binaries (ELF 64 bits).
We were unable to launch it locally (wrong libboost version) so, we solved the challenge directly on the remote side.
When you connect to the challenge, it send you a 32 bytes hex-encoded random string.
By looking at Stumbler binary, we found and reversed the generation and verification of the proof of work.
| -------------------------------------------------------------------------------- | |
| <WinProcess "smss.exe" pid 520 at 0x5db0c50L> | |
| 64 | |
| [!!] Invalid rpcrt4 base: 0x0 vs 0x7ff868230000 | |
| -------------------------------------------------------------------------------- | |
| <WinProcess "csrss.exe" pid 776 at 0x5db0908L> | |
| 64 | |
| Interfaces : | |
| Endpoints : |
| -------------------------------------------------------------------------------- | |
| <WinProcess "smss.exe" pid 368 at 0x5306908L> | |
| 64 | |
| [!!] Invalid rpcrt4 base: 0x0 vs 0x7ffec24f0000 | |
| -------------------------------------------------------------------------------- | |
| <WinProcess "csrss.exe" pid 472 at 0x5306e48L> | |
| 64 | |
| Interfaces : | |
| Endpoints : |
| // CygEOP.cpp : Defines the entry point for the console application. | |
| // | |
| #include "stdafx.h" | |
| #include <Windows.h> | |
| #include <psapi.h> | |
| #pragma comment(lib, "ntdll.lib") | |
| #define STATUS_SUCCESS 0 |