Court of Analysis and Testing

  Its been a while since my last update in this blog, I finally have some time to make another write up of pwn CTF challenge. Thanks to my classmate Christos for sharing this challenge, I hope this blog can help you to understand how to approach this challenge. The challenge was named BabyStack. It was a 64 bit ELF executable and it's expected us to change the flow of program execution in order to spit out the flag At first, if you try to run the app it will show read() open error function this indicates that this binary needs to have some additional file in order to run properly. Since this is a CTF challenge I just try to create like a dummy file called flag to see if this the correct file to be prepared. It turns out it was a correct file and we can see that the binary give us two input first is the "size" and the "data" next, let's try to load the binary to ghidra so we have more detail information about the binary. Examining the p...

In the previous post , we are taking a look at the new approach of how we can utilize ROP without taking too much time selected the necessary gadgets using sigreturn oriented programming. But in the example, we purposely leak the stack address to help us execute mprotect function. what if there is no leaked address? can we still bypass NX and ASLR at the same time using sigreturn? Of course you can! To proof it let's try to solve the pwn challenge from rooters CTF(srop). Binary can be downloaded from this link: https://github.com/abs0lut3pwn4g3/RootersCTF2019-challenges/tree/master/pwn/srop Hmmm, it seems we get a stripped binary. This means the symbol for the function is stripped and it will be harder for us to understand the assembly. When we run the program we can see that it only shows some prompt and expect an input after we enter some value it doesn't give us anything. Let's load the binary to Ghidra. If you got stripped binary, the first thing that...

Time to get serious Over the last couple of months, we do a lot of ROP exploitation to bypass the anti-exploit mechanism that enforces by many modern OS. This approach is good because it gives us the flexibility to craft our own exploit by reusing a specific part of the program. But it needs a lot of work and relatively hard to get it right since the necessary gadget may not available and ASLR will make it harder, not to mention it cannot be implemented cross-platform so it is not really that flexible. so is there any other approach for ROP to make it more compact and able to run cross-platform? introduces Sigreturn ROP (Signal Return Oriented Programming) What is SigROP? Think SigROP as just like another type of ROP attack that you can do besides the regular one. The attack works by abusing the way in which most UNIX systems return from a signal handler so we can forge the signal context to emulate its own stack frame at runtime. In layman term, if we manage to take c...

In the previous post , we are talking about how we can bypass NX and ASLR at the same time in 32 bit but have you ever think that the same attack can be successfully launched at 64 bit. The answer is "NO!" Even though the concept of launching the attack is almost the same but there are some minor change that we need to apply to our exploit You must be aware that the 32-bit and the 64-bit function call is different. 32 bit use the stack to pass the parameter of the function but 64 bit use the register to passing the parameter and we need to utilize ROP to chain to call the function To make it more clear we are going to solve one of the CTF challenge (babypwn) that come from Rooters CTF you can download the binary at this link: https://github.com/abs0lut3pwn4g3/RootersCTF2019-challenges/tree/master/pwn/babypwn Crash... crash...crash....crash First, like any initial stage of exploit development, we need to crash the program in order to find out how many offset tha...