HackyEaster was awesome again. From a technical point of view there weren’t too much new things, but the creativity of the provided challenges made it really fun. Including the little teaser challenge there were a total amount of 37 challenges. These challenges were divided into different levels. You could only proceed to the next level, if you have earned enough points in the current level. I really liked that new idea.
Continue reading “Hacky Easter 2021 writeup”HACKvent20 writeup
This year’s HACKvent hosted on competition.hacking-lab.com has been as great as every year. There was a total amount of 28 awesome challenges with varying difficulties. |
Hack The Box – Rope
This article contains my writeup on the machine Rope
from Hack The Box. I really enjoyed the box, since it provides a total of three custom binaries, which are supposed to be exploited 🙂
The article is divided into the following parts:
→ User
    – Initial Recon
    – httpserver
    – Leak Memory Address
    – Exploit Format String Vulnerability
    – Escalating from john to r4j (readlogs)
→ Root
    – Local Recon
    – contact
    – Bruteforce
    – Libc Leak
    – Final Exploit
Hacky Easter 2019 writeup
As every year hacking-lab.com carried out the annual Hacky Easter event with 27 challenges. As usual the variety of the challenges was awesome. I actually got full score this year 🙂 Many thanks to daubsi, who gave me a nudge once in a while on the last challenges (you can find his writeup here). |
Easy | |
01 Twisted 02 Just Watch 03 Sloppy Encryption 04 Disco 2 05 Call for Papers 06 Dots 07 Shell we Argument 08 Modern Art 09 rorriM rorriM |
|
Medium | |
10 Stackunderflow 11 Memeory 2.0 12 Decrypt0r 13 Symphony in HEX 14 White Box 15 Seen in Steem 16 Every-Thing 17 New Egg Design 18 Egg Storage |
|
Hard | |
19 CoUmpact DiAsc 20 Scrambled Egg 21 The Hunt: Misty Jungle 22 The Hunt: Muddy Quagmire 23 The Maze 24 CAPTEG |
|
Hidden | |
25 Hidden Egg #1 26 Hidden Egg #2 27 Hidden Egg #3 |
nullcon HackIM 2019 – babypwn
The nullcon HackIM 2019 CTF (ctftime.org) ran from 01/02/2019, 16:30 UTC to 03/02/2019 04:30 UTC.
I did the pwn challenge babypwn, which was really fun to do. The following article contains my writeup being divided into the following sections:
→ Challenge description
→ Security mechanisms and disassembly
→ Signedness vulnerabilitiy
→ Format string vulnerabilitiy
→ Final exploit
Hack The Box – Dab
This article contains my first writeup on a machine from Hack The Box. If you have not checked out Hack The Box yet, I really suggest you do. Aside from providing classical CTF-style challenges, the plattform hosts plenty of vulnerable machines (boxes), which are supposed to be exploited. The boxes tend to be geared to realistic scenarios and are thus an awesome opportunity to increase your own pen testing skills.
In order to prove the exploitation of a machine, there are two different flag files stored on each machine. The first one to acquire is a file called user.txt
, which can be read by a low privileged user. The next step after initially exploiting the machine is to escalate privileges gaining access to an administrative user (root access). With this high privileged user a second file called root.txt
can be read. Both files contain a flag (an md5sum), which is supposed to be submitted on the Hack The Box website rewarding you with the corresponding points for this machine.
According to those two steps/files the article is divided into the following sections:
→ User
– Port Scan
– FTP (Port 21)
– SSH (Port 22)
– HTTP nginx (Port 80)
– HTTP nginx (Port 8080)
– Back to SSH
→ Root
– Initial Enumeration
– SUID binaries
– myexec
– libseclogin.so
– myexec’s password
– ldconfig
– Compile own shared Library
Codegate CTF 2019 Preliminary – KingMaker
The Codegate CTF 2019 Preliminary (ctftime.org) ran from 26/01/2019, 00:00 UTC to 27/01/2019 00:00 UTC.
Within this article I want to share my quick writeup on the challenge KingMaker.
Continue reading “Codegate CTF 2019 Preliminary – KingMaker”
Heap Exploitation: Off-By-One / Poison Null Byte
The goal of this article is to explain in detail how an off-by-one vulnerability on the heap also known as poison null byte can be exploited. Although this technique does not work with the latest libc, I think it can be used very good in order to demonstrate how exploits based on heap-metadata corruption work (also check out shellphish’s how2heap).
In order to do this I created a vulnerable program, which we will use as an example to create such an exploit. If you like to, you can start by analyzing and exploiting the program on your own (at least check out Environment):
–> heap.zip
Though it is not required to the exploit the program, the source-code might be helpful:
–> heap.c
The article is divided into the following sections:
–> Environment
–> Vulnerable Program
–> Heap Basics
–> Libc-Leak
–> Control Instruction Pointer
–> One Gadget
–> Final Exploit
Continue reading “Heap Exploitation: Off-By-One / Poison Null Byte”
Hacky Easter 2018 writeup
As every year hacking-lab.com carried out the annual Hacky Easter event with 27 challenges. I could not spend as much time as I would have liked to on solving the challenges, but after all I managed to collect 25 of the 27 eggs and focused on this writeup. |
Easy | |
01 Prison Break 02 Babylon 03 Pony Coder 04 Memeory 05 Sloppy & Paste (mobile) 06 Cooking for Hackers 07 Jigsaw 08 Disco Egg 09 Dial Trial (mobile) |
|
Medium | |
10 Level Two 11 De Egg you must (not solved) 12 Patience (mobile) 13 Sagittarius… 14 Same same… 15 Manila greetings 16 git cloak –hard 17 Space Invaders 18 Egg Factory |
|
Hard | |
19 Virtual Hen 20 Artist: No Name Yet (not solved) 21 Hot Dog 22 Block Jane 23 Rapbid Learning 24 ELF |
|
Hidden | |
25 Hidden Egg #1 26 Hidden Egg #2 27 Hidden Egg #3 |
angstromCTF 2018 – writeup hellcode
The angstromCTF 2018 (ctftime.org) ran from 16/03/2018, 20:00 UTC to 23/03/2018 00:00 UTC.
As the description on ctftime.org states, the ctf is primarily geared towards high school students but with a very wide range of challenge difficulty.
There have been a lot of interesting challenges which have been fun to do. I decided to make a writeup for the pwn challenge hellcode.