Pandora Box – Taso 5

Kyseessä näyttää olevan Pandora Boxin viimeinen taso. Sillä level5 binäärin näyttää omistavan root.

level4@pb0x:~$ ls -l
-rwsr-xr-x 1 root   level4 596244 Jan  3  2015 level5

Tällä kertaa ohjelmalla näyttäisi pystyvän säilömään kymmenen eri numeroa.

level4@pb0x:~$ ./level5 
# Simple Number Manager #
This tool allows you to store and view upto 10 numbers
in a array.
Type exit to close or help for a command list
> help
exit        : Close number manager
set         : Store a number
get         : View a number
> set
> id: 1
> value: 10
Value stored
> get
> id: 1
value: 10

Tallennusslotin valinnassa näyttäisi olevan jotain jännyyksiä. Koska seuraavanhan ei pitäisi toimia.

> set
> id: 99 
The array only has 10 entry's, use index 0..9
> set
> id: -1
> value: 15
Value stored
> get
> id: -1
value: 15

Eli pystymme jollain tapaa kirjoittamaan yli muistin, mutta minne? Aika kaivaa IDA ja alkaa selvittämään, mitä konepellin alla tapahtuu. Ongelma löytyy aika nopeasti. Koska ohjelma tarkistaa ainoastaan onko luku pienempi tai yhtäsuuri kuin 9.

int tmp = (int)strtoul(&buf, 0, 10);
uint8_t idnum = (uint8_t)tmp;
if ( tmp <= 9 ) { 	if ( readline(&buf, 16, "> value: ") )
	  store[idnum] = strtoul(&buf, 0, 10);
	  fwrite("Value stored\n", 1, 13, stderr);
	  fwrite("Bad value\n", 1, 10, stderr);

Toinen huomio on, että varsinainen indeksi on vain tavun mittainen. Joten käyttämällä negatiivisia lukuja pystymme kirjoittamaan numerosäilön yli indekseihin store[10] – store[255]. Nämä arvothan sijaitsee pinossa, joten voimme kirjoittaa funktion paluuosoitteen yli ja muodostaa shellcoden normaalilla ROP kikkailulla, joka oikeestaan on ihan sama kun tasolla 4. Joten en tässä kohtaa varmasti turha käydä uudestaan läpi.

Ratkaisu kokonaisuudessaan löytyy tästä.

Kaikki ei kuitenkaan ollut vielä tässä. Vaikka koko systeemi on nyt rootattu, niin itse flagi on kryptattu.

Goobjob! It seems like you r00ted Pandora's box I hope you liked the challenges as much as I enjoyed making them.
 It's time for you to collect your flag, the only thing is that it's encrypted with RSA 256 bits, can you crack it?

 encrypted_flag: 0x41a31d931bd8c7dd1707942484075b4ae98a6e98c40a9b21f7424c7e91ac1fca

 PublicKey info
 E: 0x10001
 N: 0xD4572CED12D668BC34A4F36311B9A80AB212D7986AA9417B6FD9D474076605F9

 Special thanks to Barrebas and Jelle for testing the challenges and the feedback, you guys r0ck!

Salauksessa on käytetty 256 bittistä RSA:ta ja tiedossa on julkinen avain. Joten tehtäväksi jää enää jakaa tekijöihin itse N. Näin lyhyellä avaimella tämä on onneksi vielä mahdollista käyttäen ihan raakaavoimaa.

Nyt kun selvillä on myös yksityinen avain, niin pystymme purkamaan salauksen ja flagi on napattu: {1_h4ck3d_4nd_r00t3d_pb0x!}.

This entry was posted in Jotain aivan muuta and tagged , , , , , . Bookmark the permalink.

14 Responses to Pandora Box – Taso 5

  1. HubertBom says:

    Hi Look what we have for you! a goodoffering
    Just click on the link below to qualify

  2. BarryRab says:

    Hey Look what we moored looking in the course of you! tactfulpresent
    Upstanding click

  3. Calvincog says:

    Young girls want sex in your city:

    Popular tags: visa dating, overlappers dating, should know about dating a british man, dating a fireman, dating red flags, secretly dating a coworker, internet dating and players, miumeet chat flirt dating app, totally free mobile dating sites, writing first email online dating, best hookup app iphone 2015, truth behind dating websites, genderqueer dating site, downloading latest matchmaking data mcc, dating bases list, dating sims pc anime, charlie kelly online dating profile, wot ram 2 matchmaking, things to know dating someone with anxiety, regina free dating sites, dating websites for black people, free private online dating, bangladeshi matchmaking sites, 30 plus dating sites, free online kuwait dating site, dating hairdresser, speed dating kings cross, dinner for eight dating adelaide, christian dating relationship quotes, jamaican dating site, dating service for police officers, churchill iii matchmaking, dating site where friends recommend, narrative essay on online dating, dating and social networking sites, 3 second rule dating, anmeldelser dating, dating sites from 2006, guam online dating, widows dating site, iran dating site, how accurate are dating scans, author of boundaries in dating, match dating site fees, dating antique furniture drawers, casual dating in high school, dating ginger beer bottles, homosexual dating sites, dating basel switzerland, radiocarbon dating is used to estimate the age of, speed dating in jacksonville florida, sweet dating profile headlines, what is the best dating site in india, top 10 free casual dating sites, dating beta male, i am dating a sex offender, best dating sites serious relationships, speed dating glen burnie, how to find if your boyfriend is on dating sites, transman dating app, free online dating sites perth, do online dating sites work, 29 year old woman dating 23 year old man, open dating definition, oasis dating site app for android, no more dating sites, speed dating documentary, zoosk dating site promo code, dating penpals, birthday messages for someone you’re dating, kundali match making lal kitab, interracial dating nebraska, girl dating websites, dating website tips, 27 year old woman dating 24 year old man, hook up warsaw, best descriptions for dating sites, free juggalo dating, african american dating websites, no sign up dating australia, dream about ex boyfriend dating someone else, best dating sims for ps vita, nina dobrev ian somerhalder dating 2013, dating history of nick jonas, good dating sites nyc, best singles dating site, gay dating near you, non sketchy dating sites, hb dating, who is jake from glee dating in real life, conscious dating websites, washing machines that hook up to your kitchen sink, jenna ushkowitz dating 2014, best free canadian dating sites, dating websites bangalore, more fish dating site, who dating who website, dating a rich girl yahoo, dating stoneware jugs, free portland dating sites, free ukraine dating and chat, speed dating events baltimore, dating tips for asian guys, questions you should ask before dating someone, cool fm dating search, dating laws in united states, dating website millionaire matchmaker, exclusive free dating site, nurse dating former patient, chet hanks dating hazel, free dating site that works, matchmaking training, oboo dating site, am i being blown off dating, should i join online dating site, dating app for ipad, online dating for free without credit card, o que Г© um hook up, how soon is too soon to start dating after a death, curzon soho dating, over 40 dating site, what to say on a dating profile examples, stop dating the same guy, castlemaine dating, watch the online dating rituals of the american male, san francisco dating sites free, free dating website scotland, online dating in australia for free, beast dating bbc three, wisconsin dating site, dating sites around jhb, new dating sites for 2013, writing best profile online dating, dating syria, thai kisses international dating service, awesome female dating profiles, expat dating sites amsterdam, gentleman’s guide to online dating password, the top free dating sites, soap opera actors dating, best paid dating site in usa, sayhi dating site, dating site usa, engineer dating website, indian dating black man, dating site in jamshedpur, ketchikan hook up, how to tell your parents you’re dating an older woman, bosnian dating site in usa, nigerian dating sites online, lesbian dating site free uk, free dating rich, sugar mummy dating in ethiopia, dating based on personality type, what to text a girl after a drunken hookup, is it good to take a break from dating, free dating sites for dubai, the best christian dating site in the world, dating in the army, latest free dating sites in canada, muslim speed dating manchester 2014, hiv dating sites sa, dating websites philippines, our time dating site wikipedia, dating of isaiah the prophet, good general online dating profile examples, dating apps for lesbians, free dating sites without premium membership, robert pattinson dating anyone, seniors dating services free, courtney dating old man, azubi speed dating ihk bonn, top dating apps in singapore, dating advice for 14 year olds, dating gillette safety razor, internet dating for over 60’s, funny things dating profile, affiliate dating l, rules for dating younger guys, ezifriends dating site, zo dating, venus williams dating golfer, search dating sites without signing up, dating facial recognition, countryside internet dating, online dating false information, problem with dating a married man, mccoy pottery dating, free speed dating in edinburgh, 100 free dating sites in brazil, i have given up on online dating, 21 girl dating 16 guy, dating site psoriasis, cougar dating websites uk, best gay hookup sites london, girlfriend still using dating site, dating brighton free, dating site, overthinking things dating, dating rules part 1, dating agency financial times, dating in seattle wa, ventura speed dating event, filipina dating free pinalove, 17 year old dating 25 year old, dating coach seattle, private label dating site, dating lds conference talks, senior dating melbourne victoria, millionaire’s club matchmaking agency, dating awkward kiss, what is a good name to use on a dating site, fitness dating free, best canadian dating site, online dating first phone call topics, what does absolute dating mean in biology, online dating sites young adults, funny matchmaking stories, dating antique kerosene lamps, pay monthly dating sites, classic man single, free college online dating, dating room in lahore, mother daughter dating each other, dating love quotes for her, 100 free farmer dating sites, dating a scorpio man long distance, download java dating apps, laws on dating a minor in arizona, quizup hookup, what to say when you message someone on an online dating site, aventura 4 man single skin tent, turkish muslim dating, 16 and 19 year old dating florida, dating site relationships, decoding dating body language, white guy dating jamaican girl, free dating service in london, science of dating sites, chinese dating sites in usa, is he looking for a hookup or relationship quiz, wings inc new york dating, dating in the dark what happened next, hook up in clarksburg wv, cuban dating sites, dating late 30s, online dating app asia, dating events in london tonight, 20 yo dating 16 yo, online filipina dating site, speed dating leo, cherry blossoms dating site sign in, who dating who in wwe

  4. Upon note an top-level design on your team.

  5. KennethSuivy says:

    Hy there, What we secure here is , a agreeableoffers

  6. Richardusats says:

    стоимость металлопроката – металлопрокат, стальные трубы в украине

Leave a Reply

Your email address will not be published. Required fields are marked *