|This year’s HACKvent hosted on competition.hacking-lab.com has been as great as every year.
There was a total amount of 28 awesome challenges with varying difficulties.
This article contains my writeup on the machine
Rope from Hack The Box. I really enjoyed the box, since it provides a total of three custom binaries, which are supposed to be exploited 🙂
The article is divided into the following parts:
– Initial Recon
– Leak Memory Address
– Exploit Format String Vulnerability
– Escalating from john to r4j (readlogs)
– Local Recon
– Libc Leak
– Final Exploit
|As every year hacking-lab.com carried out the annual Hacky Easter event with 27 challenges. As usual the variety of the challenges was awesome. I actually got full score this year 🙂 Many thanks to daubsi, who gave me a nudge once in a while on the last challenges (you can find his writeup here).|
I did the pwn challenge babypwn, which was really fun to do. The following article contains my writeup being divided into the following sections:
This article contains my first writeup on a machine from Hack The Box. If you have not checked out Hack The Box yet, I really suggest you do. Aside from providing classical CTF-style challenges, the plattform hosts plenty of vulnerable machines (boxes), which are supposed to be exploited. The boxes tend to be geared to realistic scenarios and are thus an awesome opportunity to increase your own pen testing skills.
In order to prove the exploitation of a machine, there are two different flag files stored on each machine. The first one to acquire is a file called
user.txt, which can be read by a low privileged user. The next step after initially exploiting the machine is to escalate privileges gaining access to an administrative user (root access). With this high privileged user a second file called
root.txt can be read. Both files contain a flag (an md5sum), which is supposed to be submitted on the Hack The Box website rewarding you with the corresponding points for this machine.
According to those two steps/files the article is divided into the following sections:
Within this article I want to share my quick writeup on the challenge KingMaker.
For the sixth time in a row now hacking-lab.com carried out the annual HACKvent. Each day from the 1st of december until the 24th a new challenge is published. I would have loved to spend more time on it, but time is a rare resource especially on the days before christmas 😉 After all I managed to solve 21 of 24 tasks:
|Day 01: Just Another Bar Code
Day 02: Me
Day 03: Catch me
Day 04: pirating like in the 90ies
Day 05: OSINT 1
Day 06: Mondrian
Day 07: flappy.pl
|Day 08: Advent Snail
Day 09: fake xmass balls
Day 10: >_ Run, Node, Run
Day 11: Crypt-o-Math 3.0
Day 12: SmartWishList
Day 13: flappy’s revenge
Day 14: power in the shell
|Day 15: Watch Me
Day 16: Pay 100 Bitcoins
Day 17: Faster KEy Exchange
Day 18: Be Evil
Day 19: PromoCode
Day 20: I want to play a game
Day 21: muffinCTF (Day 1)
Day 22: muffinCTF (Day 2)
Day 23: muffinCTF (Day 3)
|Day 24: Take the red pill, take the blue pill|
|As every year hacking-lab.com carried out the annual Hacky Easter event with 27 challenges. I could not spend as much time as I would have liked to on solving the challenges, but after all I managed to collect 25 of the 27 eggs and focused on this writeup.|
As the description on ctftime.org states, the ctf is primarily geared towards high school students but with a very wide range of challenge difficulty.
There have been a lot of interesting challenges which have been fun to do. I decided to make a writeup for the pwn challenge hellcode.
In the last lab we focused on Misc and Stack Cookies. In this next to last lab some characteristics when dealing with C++ are introduced.