CTF From Zero To One

7f110257501127300df3f923119ba043?s=47 Inndy
December 17, 2016

CTF From Zero To One

2016 / TDOH Conf

7f110257501127300df3f923119ba043?s=128

Inndy

December 17, 2016
Tweet

Transcript

  1. 18.

    +FPQBSEZ8FC ˙ 岤Ⰵ余乹糵 ˙ $SPTT4JUF4DSJQUJOH 944  ˙ 剓鵜♶㼱8FC鿪銴⯓944ⱄ䖃䖕䩧 ˙

    9.-&OUJUZ*OKFDUJPO 99&  ˙ ⟃+FPQBSEZ⢵铞♶㢵鋅㔔捀〳⟃%P4 #JMMJPOMBVHIT  ˙ 梖忶鷴涸铞Ⰵ涸儘⦬䖎㻜欽
  2. 19.

    +FPQBSEZ8FC ˙ 3BDF$POEJUJPO ˙ 须俲䏨䧴Ⱖ➮乽⡲尝剤欽5SBOTBDUJPO-PDL鸤䧭涸朜䢀♶♧荞 欴欰꟦ꥵ〳⟃ⵄ欽 ˙ &Y鱲颹齅鱀 ˙ 隡《긅겙4&-&$5

    䩾妵JO1)1佖隶긅겙61%"5&  ˙ 㥶卓⠿剪㐼MPBEJOH鯱ꅾ4&-&$5莅61%"5&乽⡲剚剤儘꟦䊴〳⟃ ꅾ醳鱲ⴀ ˙ 㖈155涮欰麕䖎㢵鵜劍涸%JSUZ$08怪峯⛳僽3BDF$POEJUJPO
  3. 21.
  4. 22.

    +FPQBSEZ8FC ˙ 铃鎊暶䚍#VH3VCZ ˙ 3VCZ欽$㻨JOUFQSFUFS罜⚂䎙⛖尝剤MJCSBSZEFQFOEFODZ[MJC  PQFOTTM MJCVOXJOE ˙ 鸏➿邍䖎㢵匌銯鿪荈䎍♶⣜飅㢫鿈玑䒭䏨⟃玑䒭㸞涸錬䏞⢵溏

    ˙ 嵥럊侸贖椚儘剤0WFSPX ˙ #JH%FDJNBM & UP@T '     UP@G ˙ :".-QBSTFS㼬荞3$&$7& ˙ 湱㼩⢵铞3VCZ爢纈岤ꅾ㸞䖤㢵
  5. 23.

    +FPQBSEZ8FC ˙ $SZQUP'BJM ˙ ⡹剚꨾銴增叆须俲剤尝剤鄄佖麕⡹剚 ˙ 欽NE ˙ NE TFDSFU

    EBUB  ˙ -FOHUI&YUFOTJPO"UUBDL ˙ ⡹剚꨾銴⸈㺙须俲⛳鏪僽4FTTJPO ˙ "&4$#$ ˙ 1BEEJOH0SBDMF"UUBDL
  6. 24.

    +FPQBSEZ8FC ˙ 8FC䩧饱⢵⫹僽㖈枤閱 ˙ 锞ꡠ岤须㸞倞耂剓鵜涸ⰗꟚ怪峯 ˙ TUSVDUT ˙ 8FCⴀ겗剚剤崩遤馸⹴ ˙

    ⵹ꤏ㶩剤4FSWFS4JEF5FNQMBUF*OKFDUJPO 1BEEJOH0SBDMF 幋ざ944 ˙ ꡠ岤ⴀ겗㕰꥙涸8FC㼠㹻剓鵜㖈灇瑖➊랃 ˙ ⴀ겗䌢䌢⚥
  7. 25.

    +FPQBSEZ#JOBSZ3FWFSTF ˙ 窍⡹♧⦐#JOBSZ䟝鳵岁䵆䥢➮㖈⨞➊랃 ˙ Ⱙ㘗涸3FWFSTJOH겗湡剚僽OBUJWFDPEF鸒䌢欽$铃鎊㻨 ˙ ꨾銴隡穉ざ铃鎊涸腋⸂ ˙ 겗湡㣐嚌剤䎙珏Ꟁ湱 ˙

    鱒ⰅBH겗湡剚デ鏰⡹僽♶僽㼩涸 ˙ 鱒Ⰵ㺙焺鍑㺙BH䖕⽫ⴀ⢵ ˙ 窍⡹⸈㺙涸BHㄤ⸈㺙玑䒭剤儘⦬剚剤♧穉䊺濼僈俒涸㺙俒 ˙ 鏽ⱁ堥䍲䭸㹁涸6TFS皿ⴀ➮涸䎸贫
  8. 27.

    +FPQBSEZ#JOBSZ3FWFSTF ˙ 鹎ꥣ♧럊涸겗湡 ˙ ⸈媽幋差麕涸玑䒭ⴕ區⵹銴⯓膨媽%FPCGVTDBUF ˙ 䩛䊨穉ざ涸㛂遤墂䩛㻨BTTFNCMZ♶僽넞ꥣ铃鎊管陼ⴀ⢵涸 ˙ $ 㛂遤墂⸈管陼剓⢕⻋

    ˙ TUSJOH涸贖椚㽠㣁ꨈ溏✫PQUJNJ[FꟚ♴⿡刿䟝娦 ˙ 㣼䚓涸铃鎊管陼ⴀ⢵涸CJOBSZ㥶HPMBOH TXJGU IBTLFMM ˙ 7JSUVBM.BDIJOF⫹僽(#"&NVMBUPS齡겳涸匌銯 ˙ TUBUJDDPNQJMFEBOETUSJQFECJOBSZ85' 
  9. 28.

    +FPQBSEZ#JOBSZ3FWFSTF ˙ ⨋Ꟍ♧럊涸겗湡 ˙ 厥❉管陼䧭CJOBSZDPEF⡎♶僽OBUJWFDPEF涸CJOBSZ鸒䌢尝剤 EFDPNQJMFS〳⟃欽㽠皿剤⛳剚䟝鳵岁䵆㡏EFDPNQJMFS ˙ 7#1$PEF 4&$$0/SFUSPTQFDUJWF 

    ˙ 4RVJSSFMMBOH #$5'TJG  ˙ ⯕僽䪪ⴀ➮僽➊랃铃鎊㽠蔅✫䧮㥪⛉涸儘꟦22 ˙ 1ZUIPOCZUFDPEF QZD +BWBDMBTT PCGVTDBUFE/&5 ˙ 䩛㻨♧❉㣼䚓涸CZUFDPEFQBUUFSO剚䵆㡏EFDPNQJMFS
  10. 29.

    +FPQBSEZ#JOBSZ3FWFSTF ˙ ⨋Ꟍ♧럊涸겗湡糵 ˙ ⲈꟌ䎂〵涸OBUJWFCJOBSZ ˙ "3. .*14鿪皿㼭✲✫欽2&.6㽠〳⟃駵 ˙ 尝剤EFDPNQJMFS〳⟃欽22

    ˙ 㻨♧㣐㛜DPEF搭䖕ꟚDPNQJMFSPQUJNJ[F⿶僽$ 㻨涸 ˙ 峤峤漗嫲鯱䘰鿪䚓植➿$5'涮㾝㣖〳䙲22 ˙ ꬌ䌢䏁㾵涸CJOBSZ ˙ #*0430. %SJWFS %04CJOBSZ
  11. 30.

    +FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝 ˙ 㷸绢䊨Ⱘ僽䖎ꅾ銴涸䩞腋麕殹♧⦐珖耷涸䊨Ⱘ➃ ˙ 㥪涸䊨Ⱘ䌟⡹♳㣔㛔㡏涸䊨Ⱘ雊⡹䄶惓22 ˙ ⹛䢀ⴕ區䊨Ⱘ%FCVHHFS ˙ 0MMZ%CH YECH

    HEC FWBOTEFCVHHFS (6*EFCVHHFSGPS-JOVY  ˙ 剤❉겗湡鏤㹁㥪CSFBLQPJOU㺙焺꼛♳㽠ⴀ植㖈⡹꬗⵹✫ ˙ 剤❉겗湡〳⟃CZUFCZCZUF涸凐⸂灶鍑 ˙ 㷸绢䙦랃㻨EFCVHHFSTDSJQU ˙ TUSBDF MUSBDF錚㻌玑䒭涸TZTUFNDBMM MJCSBSZDBMM遤捀
  12. 31.

    +FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝 ˙ ꬆ䢀ⴕ區䊨Ⱘ ˙ PCKEVNQ〳⟃溏穉ざ铃鎊 ˙ *%"1SPXJUI)FYSBZEFDPNQJMFS ˙ 馄馄馄馄馄秹顜顜顜顜娦➃⺫わEFDPNQJMFS涸䱇奚銴䱺鵜⼧蠝荩䍤 ˙

    馄秹䓽㣐䎙⛖僽垦彋ꂂ⪔ ˙ SBEBSF ˙ 䖎䓽㣐涸䊨Ⱘ*%"1SP⛓倴SBEBSF㽠⫹僽7JTVBM4UVEJP⛓倴WJN ˙ 㷸绢刼箁䖎〳䙲剤❉㣼䚓涸CVH22
  13. 33.
  14. 34.
  15. 35.

    +FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝 ˙ ⹛䢀ⴕ區䊨Ⱘ鹎ꥣ ˙ #JOBSZJOTUSVNFOUBUJPO*OUFMQJOUPPMT ˙ 㻨玑䒭⹛䢀涸錚㻌)PPL〥♧⦐玑䒭 ˙ 〳⟃欽⢵⨞TJEFDIBOOFMBUUBDL UJNJOHBUUBDL

     ˙ 箁䚍嫲㼩㶶⚮涸儘⦬鎙皿䭸⟂侸ꆀ㽠〳⟃濼麥枤㼩✫䎙⦐㶶 ˙ 4.5TPMWFS;CZ.JDSPTPGU ˙ 9 9  9  9  ˙ 牟㣼涸荈⹛凐⸂灶鍑
  16. 37.

    +FPQBSEZ#JOBSZ3FWFSTF䊱遯眝 ˙ 4ZNCPMJD&YFDVUJPO ˙ LMFF ˙ 㛇倴MMWN卺圓♴⾲㨥焺㾵秹涸TZNCPMJDFYFDVUJPO ˙ $$ PUIFSMBOHVBHF̔DPNQJMFEUPMMWN*3̔LMFF

    ˙ 㻨♧⦐$玑䒭〭LMFFデ鏰⡹銴怏駈➊랃哭⟝䩞腋鍸涮BTTFSU ˙ 〳⟃䭭IFYSBZEFDPNQJMFSⴀ⢵涸DPEF鹎⿡駵9% ˙ -B[Z,-&&CZ-BZTIUUQTHJUIVCDPN-ZT-B[Z,-&&
  17. 40.

    1XOBCMF (low address) AAAAAAAA <--- esp 00000000 00000000 <--- buffer

    00000000 00000000 00000000 00000000 0083af3c <--- stack canary ffeeddcc <--- ebp, saved ebp 00401234 <--- return address abcdabcd (high address) int main() { ... printf("your name:"); scanf("%s", name); ... return 0; }
  18. 41.

    1XOBCMF (low address) AAAAAAAA <--- esp 00000000 41414141 <--- buffer

    41414141 41414141 41414141 41414141 41414141 <--- stack canary 41414141 <--- ebp, saved ebp 41414141 <--- return address 41414141 (high address) int main() { ... printf("your name:"); scanf("%s", name); ... return 0; }
  19. 42.

    1XOBCMF (low address) AAAAAAAA <--- esp 00000000 41414141 <--- buffer

    41414141 41414141 41414141 41414141 41414141 <--- stack canary 41414141 <--- ebp, saved ebp 41414141 <--- return address 41414141 (high address) int main() { ... printf("your name:"); scanf("%s", name); ... return 0; } *** stack smashing detected ***
  20. 44.

    1XOBCMF ˙ OBNF㖈㛜毕♳ ˙ EBUB㖈ꬆ䢀涸⡙㖧 ˙ TDBOG T OBNF 

    ˙ 鸤䧭CVFSPWFSPX ˙ 濼麥TUBDL僽䙦랃麌⡲涸䖎ꅾ銴
  21. 45.

    1XOBCMF ˙ TDBOG T OBNF  ˙ """"""""""""""""""""""""" """"""""""""""""""""""""" """""""""""""""""""""""""

    """"""""""""""""""""""""" """"""""""""""""""""""""" """"""""""""""""""""""""" """"""""""""""""""""""""" ababcdcd <- esp 00000000 41414141 <- &name 41414141 41414141 41414141 41414141 41414141 <- ebp 41414141 <- ret addr 41414141 41414141
  22. 46.

    1XOBCMF ˙ SFU ˙ &*1Y ˙ $SBTI ˙ &*1〳⟃䱾ⵖ ˙

    齡䧮⦛〳♶〳⟃〭CBTIⴀ⢵ ˙ %FNP ababcdcd <- esp 00000000 41414141 <- &name 41414141 41414141 41414141 41414141 41414141 <- ebp 41414141 <- ret addr 41414141 41414141
  23. 48.

    1XOBCMF$5'䌢欽余乹䩛岁 ˙ 3FUVSOUP4UBDL ˙ 䪾TIFMMDPEF㻨㖈TUBDL♳䟝鳵岁SFUVSOⵌTUBDL♳㛂遤 ˙ 䪪ⵌKNQFTQ ˙ 3FUVSOUPMJCD ˙

    欽301㛂遤MJCD酭꬗涸GVODUJPO ˙ 3FUVSOUPEMSFTPMWF ˙ ⵄ欽%ZOBNJD-JOLJOH雊➮湬䱺䌟䧮⦛⿡TZTUFN
  24. 49.

    1XOBCMF$5'䌢欽余乹䩛岁 ˙ GPSNBUTUSJOH怪峯 ˙ QSJOUG EEE    

    ˙ ⡹濼麥O Q㌨ ˙ QSJOUG T EBUB  ˙ QSJOUG EBUB  00401234 <- esp, ret addr 2016 <- arg1 1 <- arg2 1 <- arg3 aaaaaaaa <- int a bbbbbbbb <- int b 41414141 <- char data[8] 41414141 00ae5d25 <- stack canary cccccccc <- saved ebp 00405566 <- ret addr
  25. 50.

    1XOBCMF$5'䌢欽余乹䩛岁 ˙ GPSNBUTUSJOH怪峯 ˙ QSJOUG EEE    

    ˙ ⡹濼麥O Q㌨ ˙ QSJOUG T EBUB  ˙ QSJOUG EBUB  ˙ QQQQQQQQQQ ˙ %FNP 00401234 <- esp, ret addr 2016 <- arg1 1 <- arg2 1 <- arg3 aaaaaaaa <- arg4 bbbbbbbb <- arg5 41414141 <- arg6 41414141 <- arg7 00ae5d25 <- arg8 cccccccc <- arg9 00405566 <- arg10
  26. 52.

    $SZQUP ˙ 管焺ꦡ询⸈㺙 ˙ ⸈㺙♧㹁剤♧䪾ꚤ⻑ ˙ 管焺 ˙ ⡹♧㹁聃麕)FY CBTF

    VSMFODPEF ˙ 嫲鯱㼱鋅VVFODPEF CBTF CBTF ˙ ꦡ询 ˙ 騈管焺♧垺⡎僽湡涸♶ず ˙ SPU ˙ /VF,:@.
  27. 53.

    $SZQUP ˙ 〢Ⱙ㺙焺㷸 ˙ %#'5#4%+2*'4'0%4;26+10$BFTBS$JQIFS LFZ"   ˙ 7FHFOFSF$JQIFS⳯且⸈㺙鹎ꥣ晝劥

    ˙ ➿䳖⸈㺙4VCTUJUVUJPO$JQIFS ˙ 䪾嫦⦐㶶嫢♧㼩♧涸鱲䳖ⵌ〥♧穉㶶嫢 ˙ 걽桧ⴕ區余乹ꆚ㼩僈俒涸暶䚍⨞ⴕ區
  28. 54.

    $SZQUP ˙ 植➿㺙焺㷸 ˙ #MPDL$JQIFS䪾须俲ⴗ䧭♧㝆♧㝆⨞⸈鍑㺙 ˙ %&4 "&4 #MPXTI ˙

    㥶卓须俲䖎Ꟁ ˙ #MPDL$JQIFS0QFSBUJPO.PEF ˙ 1,$4 $#$.PEF剤1BEEJOH0SBDMF"UUBDL ˙ 4UFBN$JQIFS ˙ 欽13/(✥侸欴欰㐼呏亙,FZ欴欰鸮糵涸4USFBN,FZ⨞9PS ˙ 0'#.PEF䖎⫹僽4USFBN$JQIFS
  29. 56.

    $SZQUP ˙ ꬌ㼩珖㺙焺㷸 ˙ 铭劥♳♧㹁剤涸34"/QR ˙ 34"꨾銴㸞涸QBEEJOH0"&1 ˙ 堬㕩刼箁㺙焺㷸&$$ ˙

    &M(BNBM3BCJO ˙ 㛇倴ꨆ侕侸㷸涸⸈㺙禺窡 ˙ 34"禺窡㛇倴顥꼛㼭㹁椚ㄤ'JOJUF'JFME"SJUINFUJD ˙ 澗鍑34"涸麌⡲♶剚阮僈荛㼱〳⟃胝ⴀ欴欰,FZㄤ⸈鍑㺙涸倰䒭
  30. 58.

    'PSFOTJD ˙ 侸⡙Ꙥ陏䖰♶剚⹛涸.FNPSZ%VNQ%JTL*NBHF䮕须俲 ˙ .FNPSZ'PSFOTJD ˙ 濼麥LFSOFM酭꬗剤❉➊랃穡圓넓銴㥶⡦㹁⡙䪪ⴀ鸏❉穡圓넓 ˙ ➊랃僽7JSUVBM.FNPSZ5-# ˙

    8JOEPXT&130$&44-JOVYUBTL@TUSVDU NN@TUSVDU ˙ 䖰1SPDFTT-JTUꟚ㨥 ˙ %VNQ〳毠涸QSPDFTT鼩⾲ⴀFYFDVUBCMFMF鹎遤ⴕ區 ˙ 'JMF$BDIF/FUXPSL$POOFDUJPOT
  31. 60.

    'PSFOTJD5PPM ˙ WPMBUJMJUZ ˙ ♧⦐馄䓽涸.FNPSZGPSFOTJDGSBNFXPSL ˙ ꤑ✫㉂噠鮿넓⛓㢫剓㥪涸'SFFTPGUXBSF鼇乵 ˙ 〳⟃⸈䱦QMVHJO⢵仍⯏⸆腋 ˙

    QTMJTU EVNQQSPDFTTNFNPSZ EVNQNPEVMFMF EVNQESJWFSMF  EVNQDBDIFEMF EVNQSFHJTUSZ EVNQQBTTXPSEIBTI NJNJLBU[  EVNQ"&4LFZ
  32. 61.
  33. 62.

    .JTD4UFHP5PPM ˙ &EJUPS ˙ #JOBSZUFNQMBUF馄㥪欽 ˙ PQFOTUFHP ˙ TUFHPTPMWFS ˙

    㕬晚겗〳⟃欽鸏⦐溏-4# ˙ TOPX IUUQXXXEBSLTJEFDPNBVTOPX
  34. 67.