Defcon 2015 Coding Skillz 1 Writeup

Just connecting to the service, a 64bit cpu registers dump is received, and so does several binary code as you can see:

The registers represent an initial cpu state, and we have to reply with the registers result of the binary code execution. This must be automated becouse of the 10 seconds server socket timeout.

The exploit is quite simple, we have to set the cpu registers to this values, execute the code and get resulting registers.

In python we created two structures for the initial state and the ending state.

cpuRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}
finalRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

We inject at the beginning several movs for setting the initial state:

for r in cpuRegs.keys():

    code.append('mov %s, %s' % (r, cpuRegs[r]))

The 64bit compilation of the movs and the binary code, but changing the last ret instruction by a sigtrap "int 3"

We compile with nasm in this way:

os.popen('nasm -f elf64 code.asm')

os.popen('ld -o code code.o ')

And use GDB to execute the code until the sigtrap, and then get the registers

fd = os.popen("gdb code -ex 'r' -ex 'i r' -ex 'quit'",'r')

for l in fd.readlines():

    for x in finalRegs.keys():

           ...

We just parse the registers and send the to the server in the same format, and got the key.

The code:

from libcookie import *

from asm import *

import os

import sys

host = 'catwestern_631d7907670909fc4df2defc13f2057c.quals.shallweplayaga.me'

port = 9999

cpuRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

finalRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

fregs = 15

s = Sock(TCP)

s.timeout = 999

s.connect(host,port)

data = s.readUntil('bytes:')

#data = s.read(sz)

#data = s.readAll()

sz = 0

for r in data.split('\n'):

    for rk in cpuRegs.keys():

        if r.startswith(rk):

            cpuRegs[rk] = r.split('=')[1]

    if 'bytes' in r:

        sz = int(r.split(' ')[3])

binary = data[-sz:]

code = []

print '[',binary,']'

print 'given size:',sz,'bin size:',len(binary)        

print cpuRegs

for r in cpuRegs.keys():

    code.append('mov %s, %s' % (r, cpuRegs[r]))

#print code

fd = open('code.asm','w')

fd.write('\n'.join(code)+'\n')

fd.close()

Capstone().dump('x86','64',binary,'code.asm')

print 'Compilando ...'

os.popen('nasm -f elf64 code.asm')

os.popen('ld -o code code.o ')

print 'Ejecutando ...'

fd = os.popen("gdb code -ex 'r' -ex 'i r' -ex 'quit'",'r')

for l in fd.readlines():

    for x in finalRegs.keys():

        if x in l:

            l = l.replace('\t',' ')

            try:

                i = 12

                spl = l.split(' ')

                if spl[i] == '':

                    i+=1

                print 'reg: ',x

                finalRegs[x] = l.split(' ')[i].split('\t')[0]

            except:

                print 'err: '+l

            fregs -= 1

            if fregs == 0:

                #print 'sending regs ...'

                #print finalRegs

                

                buff = []

                for k in finalRegs.keys():

                    buff.append('%s=%s' % (k,finalRegs[k]))

                print '\n'.join(buff)+'\n'

                print s.readAll()

                s.write('\n'.join(buff)+'\n\n\n')

                print 'waiting flag ....'

                print s.readAll()

                print '----- yeah? -----'

                s.close()

                

fd.close()

s.close()

Related articles

1. Pentest Tools Windows
2. Hack Tools For Games
3. Pentest Tools Android
4. Hack Tools For Pc
5. Hacking Tools Hardware
6. Hacking Tools For Games
7. Pentest Automation Tools
8. Hacking Tools For Windows Free Download
9. World No 1 Hacker Software
10. Hackers Toolbox
11. Pentest Tools Bluekeep
12. Physical Pentest Tools
13. Wifi Hacker Tools For Windows
14. Hack Tools For Mac
15. Hacker Tools For Mac
16. Pentest Tools Android
17. Hacker Techniques Tools And Incident Handling
18. Hacker Security Tools
19. Pentest Tools Free
20. Hacking Apps
21. Hacking Tools Kit
22. Hack Tools
23. Pentest Tools For Android
24. Pentest Tools For Ubuntu
25. Pentest Tools Windows
26. Hacking Tools Windows
27. Hacking Tools
28. Hacking Tools Github
29. Pentest Tools Alternative
30. Pentest Tools Tcp Port Scanner
31. Hacking Tools Windows
32. Ethical Hacker Tools
33. Nsa Hack Tools Download
34. New Hacker Tools
35. Nsa Hack Tools
36. Blackhat Hacker Tools
37. Hacker Tools
38. Hack Tools For Windows
39. Hack Tools Github
40. Github Hacking Tools
41. Physical Pentest Tools
42. Hacking Tools For Windows 7
43. Physical Pentest Tools
44. Pentest Tools Download
45. Hack Tools For Windows
46. Pentest Tools Framework
47. Hacking Tools For Beginners
48. Hack Tools Online
49. Pentest Tools Open Source
50. Black Hat Hacker Tools
51. New Hack Tools
52. Pentest Tools Url Fuzzer
53. Hacker Tools Free Download
54. How To Hack
55. Bluetooth Hacking Tools Kali
56. Install Pentest Tools Ubuntu
57. Hack Tools Online
58. Pentest Tools Find Subdomains
59. Hacker Tools Software
60. Hacker Tools Free Download
61. Tools 4 Hack
62. Pentest Tools Website
63. Nsa Hacker Tools
64. Hacker Tools
65. New Hack Tools
66. Nsa Hacker Tools
67. Hackers Toolbox
68. Hacking Tools For Windows
69. Hack Tools
70. Hacking Tools For Mac
71. Hack Tools For Windows
72. Hacker Tools Free Download
73. Hack Apps
74. Pentest Tools Framework
75. Wifi Hacker Tools For Windows
76. Pentest Tools Online
77. Hackrf Tools
78. Termux Hacking Tools 2019
79. Hacking Tools Kit
80. Android Hack Tools Github
81. Hacker Tools Apk Download
82. Hack Tool Apk
83. Nsa Hacker Tools
84. Pentest Tools Framework
85. Hacking Tools Download
86. Pentest Tools Free
87. Hacker Tools Windows
88. Pentest Tools Apk
89. Hack Tools Download
90. What Is Hacking Tools
91. Nsa Hack Tools
92. Pentest Tools Review
93. Hacker Tools List
94. New Hacker Tools
95. Pentest Tools Apk