1 of 3

BSides Delhi

Thanks for Attending

Thanks for attending BSides, have a nice day!

Resources

Analysis

As soon as we get the file, we see we can cause a segmentation fault:

Using a , we calculate the offset until the saved return pointer to be 40.

As there is no PIE, our approach will be a standard followed by a .

Exploitation

First for the basic setup:

Now we can start the initial ret2plt. Interestingly, the elf.plt dotdict does not work for some reason (some kind of parsing bug, I assume) so I had to hardcode in the PLT entries (which is fine, since there's no PIE):

Pretty simple - 40 characters up until the saved return pointer, a call to puts@plt and we set puts@got as the parameter to this as a way of leaking libc. Finally we set the return address to the location of main - allowing us to have another run with the ret2libc.

Now we just need to parse the output:

Now we can finish it off with the ret2libc:

Final Exploit

Delivering it

Flag: BSDCTF{3xpl0r1ng_th3_unkn0wn}

Cookie Robot

You know what to do, collect them all.

Initial Recon

As the title suggested, first check out robots.txt:

Now head over to cookie.php:

Nothing interesting, but again, the name of the page is a huge hint. Using Inspect Element, we can check document.cookie and find out that we have cookies:

The Piece=1 cookie implies that there are more, so we can refresh the page. As expected, we get another cookie.

Dumping all the cookies

We can create a super simple python script to dump them all:

The Piece cookies go up to 39 before starting again from 0, so we assume there are 39. We now dump all 39 of them and save them to a file.

Decoding

As they are hex, we first attempt some hex decoding, but that is unsuccessful. The next idea is to check if they are valid hashes, which they are! It appears as if each cookie is simply a hash of a letter of the flag, and we can dump all of the hashes .

Now we can save this in cracked and use some basic bash to isolate the individual letters and print them all out.

And we get the output

This looks a lot like ROT13, and once decoded from it we get the flag.

Flag: BSDCTF{C00k135_ar3_b35t_pl4c3_70_ch3ck}

Thanks for Attending

Thanks for attending BSides, have a nice day!

Resources

Analysis

As soon as we get the file, we see we can cause a segmentation fault:

Using a , we calculate the offset until the saved return pointer to be 40.

As there is no PIE, our approach will be a standard followed by a .

Exploitation

First for the basic setup:

Now we just need to parse the output:

Now we can finish it off with the ret2libc:

Final Exploit

Delivering it

Flag: BSDCTF{3xpl0r1ng_th3_unkn0wn}

Cookie Robot

You know what to do, collect them all.

Initial Recon

As the title suggested, first check out robots.txt:

User-agent: * 
Disallow: /cookie.php

Now head over to cookie.php:

Nothing interesting, but again, the name of the page is a huge hint. Using Inspect Element, we can check document.cookie and find out that we have cookies:

The Piece=1 cookie implies that there are more, so we can refresh the page. As expected, we get another cookie.

Dumping all the cookies

We can create a super simple python script to dump them all:

The Piece cookies go up to 39 before starting again from 0, so we assume there are 39. We now dump all 39 of them and save them to a file.

Decoding

Now we can save this in cracked and use some basic bash to isolate the individual letters and print them all out.

And we get the output

This looks a lot like ROT13, and once decoded from it we get the flag.

Flag: BSDCTF{C00k135_ar3_b35t_pl4c3_70_ch3ck}

BSides Delhi

Thanks for Attending

hashtagResources

hashtagAnalysis

hashtagExploitation

hashtagFinal Exploit

hashtagDelivering it

Cookie Robot

hashtagInitial Recon

hashtagDumping all the cookies

hashtagDecoding

Thanks for Attending

hashtagResources

hashtagAnalysis

hashtagExploitation

hashtagFinal Exploit

hashtagDelivering it

BSides Delhi

Cookie Robot

hashtagInitial Recon

hashtagDumping all the cookies

hashtagDecoding

Resources

Analysis

Exploitation

Final Exploit

Delivering it

Initial Recon

Dumping all the cookies

Decoding

Resources

Analysis

Exploitation

Final Exploit

Delivering it

Initial Recon

Dumping all the cookies

Decoding