Skip to content

Commit b7aa234

Browse files
arch-errarch-err
committed
[AUTO] $ mctf sync
1 parent 82d3736 commit b7aa234

File tree

18 files changed

+487
-32
lines changed

18 files changed

+487
-32
lines changed

‎README.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
**Team:** none
1414

1515

16-
**Flags:** (18/47)
16+
**Flags:** (22/47)
1717

1818
![ ](assets/scoreboard.png)
1919
![ ](assets/team-score.png)
@@ -23,8 +23,8 @@
2323
- [x] [Verify](challenges/Verify)
2424
- [x] [Scan_Surprise](challenges/Scan_Surprise)
2525
- [x] [Binary_Search](challenges/Binary_Search)
26-
- [ ] [heap_0](challenges/heap_0)
27-
- [ ] [format_string_0](challenges/format_string_0)
26+
- [x] [heap_0](challenges/heap_0)
27+
- [x] [format_string_0](challenges/format_string_0)
2828
- [x] [WebDecode](challenges/WebDecode)
2929
- [x] [Unminify](challenges/Unminify)
3030
- [x] [Time_Machine](challenges/Time_Machine)
@@ -44,10 +44,10 @@
4444
- [x] [Trickster](challenges/Trickster)
4545
- [ ] [No_Sql_Injection](challenges/No_Sql_Injection)
4646
- [ ] [heap_3](challenges/heap_3)
47-
- [ ] [heap_1](challenges/heap_1)
47+
- [x] [heap_1](challenges/heap_1)
4848
- [ ] [dont-you-love-banners](challenges/dont-you-love-banners)
4949
- [ ] [SansAlpha](challenges/SansAlpha)
50-
- [ ] [heap_2](challenges/heap_2)
50+
- [x] [heap_2](challenges/heap_2)
5151
- [ ] [format_string_1](challenges/format_string_1)
5252
- [ ] [Blast_from_the_past](challenges/Blast_from_the_past)
5353
- [ ] [WinAntiDbg0x300](challenges/WinAntiDbg0x300)

‎challenges/format_string_0/README.md

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,9 @@
11
# format_string_0
2-
*<++>*
2+
*Can you use your knowledge of format strings to make the customers happy?*
33

44
## Solution
5-
1. <++>
6-
2. `<++>`
7-
3. `./solve.sh`
5+
1. Just connect to the server and do what the program says...
86

97

108
## Flag
11-
**Flag:** `<++>`
9+
**Flag:** `picoCTF{7h3_cu570m3r_15_n3v3r_SEGFAULT_63191ce6}`

‎challenges/format_string_0/original_files/format-string-0

16.2 KB
Binary file not shown.

‎challenges/format_string_0/original_files/format-string-0.c

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
#include <stdio.h>
2+
#include <stdlib.h>
3+
#include <string.h>
4+
#include <signal.h>
5+
#include <unistd.h>
6+
#include <sys/types.h>
7+
8+
#define BUFSIZE 32
9+
#define FLAGSIZE 64
10+
11+
char flag[FLAGSIZE];
12+
13+
void sigsegv_handler(int sig) {
14+
printf("\n%s\n", flag);
15+
fflush(stdout);
16+
exit(1);
17+
}
18+
19+
int on_menu(char *burger, char *menu[], int count) {
20+
for (int i = 0; i < count; i++) {
21+
if (strcmp(burger, menu[i]) == 0)
22+
return 1;
23+
}
24+
return 0;
25+
}
26+
27+
void serve_patrick();
28+
29+
void serve_bob();
30+
31+
32+
int main(int argc, char **argv){
33+
FILE *f = fopen("flag.txt", "r");
34+
if (f == NULL) {
35+
printf("%s %s", "Please create 'flag.txt' in this directory with your",
36+
"own debugging flag.\n");
37+
exit(0);
38+
}
39+
40+
fgets(flag, FLAGSIZE, f);
41+
signal(SIGSEGV, sigsegv_handler);
42+
43+
gid_t gid = getegid();
44+
setresgid(gid, gid, gid);
45+
46+
serve_patrick();
47+
48+
return 0;
49+
}
50+
51+
void serve_patrick() {
52+
printf("%s %s\n%s\n%s %s\n%s",
53+
"Welcome to our newly-opened burger place Pico 'n Patty!",
54+
"Can you help the picky customers find their favorite burger?",
55+
"Here comes the first customer Patrick who wants a giant bite.",
56+
"Please choose from the following burgers:",
57+
"Breakf@st_Burger, Gr%114d_Cheese, Bac0n_D3luxe",
58+
"Enter your recommendation: ");
59+
fflush(stdout);
60+
61+
char choice1[BUFSIZE];
62+
scanf("%s", choice1);
63+
char *menu1[3] = {"Breakf@st_Burger", "Gr%114d_Cheese", "Bac0n_D3luxe"};
64+
if (!on_menu(choice1, menu1, 3)) {
65+
printf("%s", "There is no such burger yet!\n");
66+
fflush(stdout);
67+
} else {
68+
int count = printf(choice1);
69+
if (count > 2 * BUFSIZE) {
70+
serve_bob();
71+
} else {
72+
printf("%s\n%s\n",
73+
"Patrick is still hungry!",
74+
"Try to serve him something of larger size!");
75+
fflush(stdout);
76+
}
77+
}
78+
}
79+
80+
void serve_bob() {
81+
printf("\n%s %s\n%s %s\n%s %s\n%s",
82+
"Good job! Patrick is happy!",
83+
"Now can you serve the second customer?",
84+
"Sponge Bob wants something outrageous that would break the shop",
85+
"(better be served quick before the shop owner kicks you out!)",
86+
"Please choose from the following burgers:",
87+
"Pe%to_Portobello, $outhwest_Burger, Cla%sic_Che%s%steak",
88+
"Enter your recommendation: ");
89+
fflush(stdout);
90+
91+
char choice2[BUFSIZE];
92+
scanf("%s", choice2);
93+
char *menu2[3] = {"Pe%to_Portobello", "$outhwest_Burger", "Cla%sic_Che%s%steak"};
94+
if (!on_menu(choice2, menu2, 3)) {
95+
printf("%s", "There is no such burger yet!\n");
96+
fflush(stdout);
97+
} else {
98+
printf(choice2);
99+
fflush(stdout);
100+
}
101+
}

‎challenges/heap_0/README.md

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,10 @@
11
# heap_0
2-
*<++>*
2+
*Are overflows just a stack concern?*
33

44
## Solution
5-
1. <++>
6-
2. `<++>`
7-
3. `./solve.sh`
5+
1. Uugh, binary... I hate this... Let's learn some basic binary exploitation I guess...
6+
2. So, I connect to a server that has a few options to interact with it. I can view the heap, get the flag (which won't work if a certain value on the heap is set) and I can write to "my own personal space" on the heap. I can be a naughty boy and write a huge string to the heap, which will overwrite this "secret value" that needs to be set to a particular value. Doing this will let me use the "get flag" functionality to get the flag.
87

98

109
## Flag
11-
**Flag:** `<++>`
10+
**Flag:** `picoCTF{my_first_heap_overflow_76775c7c}`

‎challenges/heap_0/original_files/chall

20.2 KB
Binary file not shown.

‎challenges/heap_0/original_files/chall.c

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
#include <stdio.h>
2+
#include <stdlib.h>
3+
#include <string.h>
4+
5+
#define FLAGSIZE_MAX 64
6+
// amount of memory allocated for input_data
7+
#define INPUT_DATA_SIZE 5
8+
// amount of memory allocated for safe_var
9+
#define SAFE_VAR_SIZE 5
10+
11+
int num_allocs;
12+
char *safe_var;
13+
char *input_data;
14+
15+
void check_win() {
16+
if (strcmp(safe_var, "bico") != 0) {
17+
printf("\nYOU WIN\n");
18+
19+
// Print flag
20+
char buf[FLAGSIZE_MAX];
21+
FILE *fd = fopen("flag.txt", "r");
22+
fgets(buf, FLAGSIZE_MAX, fd);
23+
printf("%s\n", buf);
24+
fflush(stdout);
25+
26+
exit(0);
27+
} else {
28+
printf("Looks like everything is still secure!\n");
29+
printf("\nNo flage for you :(\n");
30+
fflush(stdout);
31+
}
32+
}
33+
34+
void print_menu() {
35+
printf("\n1. Print Heap:\t\t(print the current state of the heap)"
36+
"\n2. Write to buffer:\t(write to your own personal block of data "
37+
"on the heap)"
38+
"\n3. Print safe_var:\t(I'll even let you look at my variable on "
39+
"the heap, "
40+
"I'm confident it can't be modified)"
41+
"\n4. Print Flag:\t\t(Try to print the flag, good luck)"
42+
"\n5. Exit\n\nEnter your choice: ");
43+
fflush(stdout);
44+
}
45+
46+
void init() {
47+
printf("\nWelcome to heap0!\n");
48+
printf(
49+
"I put my data on the heap so it should be safe from any tampering.\n");
50+
printf("Since my data isn't on the stack I'll even let you write whatever "
51+
"info you want to the heap, I already took care of using malloc for "
52+
"you.\n\n");
53+
fflush(stdout);
54+
input_data = malloc(INPUT_DATA_SIZE);
55+
strncpy(input_data, "pico", INPUT_DATA_SIZE);
56+
safe_var = malloc(SAFE_VAR_SIZE);
57+
strncpy(safe_var, "bico", SAFE_VAR_SIZE);
58+
}
59+
60+
void write_buffer() {
61+
printf("Data for buffer: ");
62+
fflush(stdout);
63+
scanf("%s", input_data);
64+
}
65+
66+
void print_heap() {
67+
printf("Heap State:\n");
68+
printf("+-------------+----------------+\n");
69+
printf("[*] Address -> Heap Data \n");
70+
printf("+-------------+----------------+\n");
71+
printf("[*] %p -> %s\n", input_data, input_data);
72+
printf("+-------------+----------------+\n");
73+
printf("[*] %p -> %s\n", safe_var, safe_var);
74+
printf("+-------------+----------------+\n");
75+
fflush(stdout);
76+
}
77+
78+
int main(void) {
79+
80+
// Setup
81+
init();
82+
print_heap();
83+
84+
int choice;
85+
86+
while (1) {
87+
print_menu();
88+
int rval = scanf("%d", &choice);
89+
if (rval == EOF){
90+
exit(0);
91+
}
92+
if (rval != 1) {
93+
//printf("Invalid input. Please enter a valid choice.\n");
94+
//fflush(stdout);
95+
// Clear input buffer
96+
//while (getchar() != '\n');
97+
//continue;
98+
exit(0);
99+
}
100+
101+
switch (choice) {
102+
case 1:
103+
// print heap
104+
print_heap();
105+
break;
106+
case 2:
107+
write_buffer();
108+
break;
109+
case 3:
110+
// print safe_var
111+
printf("\n\nTake a look at my variable: safe_var = %s\n\n",
112+
safe_var);
113+
fflush(stdout);
114+
break;
115+
case 4:
116+
// Check for win condition
117+
check_win();
118+
break;
119+
case 5:
120+
// exit
121+
return 0;
122+
default:
123+
printf("Invalid choice\n");
124+
fflush(stdout);
125+
}
126+
}
127+
}

‎challenges/heap_0/solve.sh

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎challenges/heap_1/README.md

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,9 @@
11
# heap_1
2-
*<++>*
2+
*Can you control your overflow?*
33

44
## Solution
5-
1. <++>
6-
2. `<++>`
7-
3. `./solve.sh`
5+
1. We just gotta overwrite the "secret key" with something, I just correctly guessed that we should set it to `pico`, this can be done by inserting `aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaapico` into our writeable buffer. This will overflow our buffer and write over the "secret key".
86

97

108
## Flag
11-
**Flag:** `<++>`
9+
**Flag:** `picoCTF{starting_to_get_the_hang_b9064d7c}`

‎challenges/heap_1/original_files/chall

20.2 KB
Binary file not shown.

0 commit comments

Comments
 (0)