From 906356dde3f2cbde2ebcbda658c8eeebb78d8fa6 Mon Sep 17 00:00:00 2001 From: Ankur Sundara Date: Sun, 12 Mar 2017 03:26:33 -0500 Subject: [PATCH 01/16] add soln --- doubly-dangerous/doubly_dangerous.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/doubly-dangerous/doubly_dangerous.c b/doubly-dangerous/doubly_dangerous.c index cd7b874..44e9af9 100644 --- a/doubly-dangerous/doubly_dangerous.c +++ b/doubly-dangerous/doubly_dangerous.c @@ -1,6 +1,8 @@ //compile with: //gcc -m32 -std=c99 -Wall -fno-stack-protector doubly_dangerous.c -o doubly_dangerous +//sol: input "A"*40+"\x00\x80\x34\x41" + #define _GNU_SOURCE #include #include From e58d3b97c880c165d2ecc57ff4076b8b59c778a1 Mon Sep 17 00:00:00 2001 From: Michael Zhang Date: Sun, 12 Mar 2017 03:58:11 -0500 Subject: [PATCH 02/16] Change ciphertext_rsa2.txt -> ciphertext.txt --- rsa2/grader.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rsa2/grader.py b/rsa2/grader.py index bca12b2..6afccaf 100644 --- a/rsa2/grader.py +++ b/rsa2/grader.py @@ -38,7 +38,7 @@ def generate_ciphertext(random): def generate(random): return dict(files={ - "ciphertext_rsa2.txt": generate_ciphertext + "ciphertext.txt": generate_ciphertext }) def grade(random, key): From bb254f936c3a66af24b806bf906be7232fd7e27a Mon Sep 17 00:00:00 2001 From: Ankur Sundara Date: Sun, 12 Mar 2017 04:04:45 -0500 Subject: [PATCH 03/16] Update messages.txt --- diffie-cult/messages.txt | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/diffie-cult/messages.txt b/diffie-cult/messages.txt index 1ab81e3..f876bd6 100644 --- a/diffie-cult/messages.txt +++ b/diffie-cult/messages.txt @@ -1,3 +1,4 @@ -g^a mod p = 421049228295820 -g^b mod p = 105262307073955 -p=442101689710611 \ No newline at end of file +g^a mod p = 791868216278 +g^b mod p = 722955066776 + +p = 986314922069 From f48d830b91ab5448aa4955eeb38378d3c9088777 Mon Sep 17 00:00:00 2001 From: Ankur Sundara Date: Sun, 12 Mar 2017 04:05:16 -0500 Subject: [PATCH 04/16] Update problem.yml --- diffie-cult/problem.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/diffie-cult/problem.yml b/diffie-cult/problem.yml index 0fb7ea4..0316dea 100644 --- a/diffie-cult/problem.yml +++ b/diffie-cult/problem.yml @@ -1,9 +1,9 @@ title: Diffie-cult author: nicebowlofsoup -hint: Wikipedia explains Diffie-hellman pretty well. There is a also a very easy way to do this. +hint: Wikipedia explains Diffie-hellman pretty well. category: Cryptography autogen: false programming: false -value: 50 +value: 140 files: - messages.txt From a31f20fecde51c044b5a063760590a1cddf4eb5b Mon Sep 17 00:00:00 2001 From: Ankur Sundara Date: Sun, 12 Mar 2017 04:08:13 -0500 Subject: [PATCH 05/16] Update problem.yml --- diffie-cult/problem.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/diffie-cult/problem.yml b/diffie-cult/problem.yml index 0316dea..c6d732a 100644 --- a/diffie-cult/problem.yml +++ b/diffie-cult/problem.yml @@ -1,5 +1,5 @@ title: Diffie-cult -author: nicebowlofsoup +author: arxenix hint: Wikipedia explains Diffie-hellman pretty well. category: Cryptography autogen: false From 543505ccdf08b407540dbba6d01719a727b42ecc Mon Sep 17 00:00:00 2001 From: Ankur Sundara Date: Sun, 12 Mar 2017 04:10:42 -0500 Subject: [PATCH 06/16] Update grader.py --- diffie-cult/grader.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/diffie-cult/grader.py b/diffie-cult/grader.py index 442ee76..abec8e0 100644 --- a/diffie-cult/grader.py +++ b/diffie-cult/grader.py @@ -1,4 +1,4 @@ def grade(autogen, answer): - if answer == ("421049228295820"): + if answer == ("906730649345"): return True, "Correct!" - return False, "Nope, try again." \ No newline at end of file + return False, "Nope, try again." From c2555cdf417db1a23300c96205d5ae841e4c2114 Mon Sep 17 00:00:00 2001 From: John W Date: Sun, 12 Mar 2017 04:12:06 -0500 Subject: [PATCH 07/16] Added hexable Simple hex-edit solvable binary problem. --- hexable-autogen/char.inc | 84 +++++++++++++++++++++++++++++++++ hexable-autogen/description.md | 2 + hexable-autogen/elf.inc | 45 ++++++++++++++++++ hexable-autogen/grader.py | 18 +++++++ hexable-autogen/hexable | Bin 0 -> 235 bytes hexable-autogen/hexable.asm | 35 ++++++++++++++ hexable-autogen/problem.yml | 5 ++ hexable-autogen/simple_gen.py | 19 ++++++++ hexable-autogen/std.inc | 32 +++++++++++++ 9 files changed, 240 insertions(+) create mode 100644 hexable-autogen/char.inc create mode 100644 hexable-autogen/description.md create mode 100644 hexable-autogen/elf.inc create mode 100644 hexable-autogen/grader.py create mode 100644 hexable-autogen/hexable create mode 100644 hexable-autogen/hexable.asm create mode 100644 hexable-autogen/problem.yml create mode 100644 hexable-autogen/simple_gen.py create mode 100644 hexable-autogen/std.inc diff --git a/hexable-autogen/char.inc b/hexable-autogen/char.inc new file mode 100644 index 0000000..024ef9f --- /dev/null +++ b/hexable-autogen/char.inc @@ -0,0 +1,84 @@ +;;;;;;;;;;;;;;;;;;;;;;;;;;; +; Character defines + NULL equ 0x00 + BELL equ 0x07 + BSPC equ 0x08 + TAB equ 0x09 + ENDL equ 0x0A + CRET equ 0x0D + + CHAR_0 equ 0x30 + CHAR_1 equ 0x31 + CHAR_2 equ 0x32 + CHAR_3 equ 0x33 + CHAR_4 equ 0x34 + CHAR_5 equ 0x35 + CHAR_6 equ 0x36 + CHAR_7 equ 0x37 + CHAR_8 equ 0x38 + CHAR_9 equ 0x39 + CHAR_A equ 0x41 + CHAR_B equ 0x42 + CHAR_C equ 0x43 + CHAR_D equ 0x44 + CHAR_E equ 0x45 + CHAR_F equ 0x46 + CHAR_G equ 0x47 + CHAR_H equ 0x48 + CHAR_I equ 0x49 + CHAR_J equ 0x4a + CHAR_K equ 0x4b + CHAR_L equ 0x4c + CHAR_M equ 0x4d + CHAR_N equ 0x4e + CHAR_O equ 0x4f + CHAR_P equ 0x50 + CHAR_Q equ 0x51 + CHAR_R equ 0x52 + CHAR_S equ 0x53 + CHAR_T equ 0x54 + CHAR_U equ 0x55 + CHAR_V equ 0x56 + CHAR_W equ 0x57 + CHAR_X equ 0x58 + CHAR_Y equ 0x59 + CHAR_Z equ 0x5a + CHAR_a equ 0x61 + CHAR_b equ 0x62 + CHAR_c equ 0x63 + CHAR_d equ 0x64 + CHAR_e equ 0x65 + CHAR_f equ 0x66 + CHAR_g equ 0x67 + CHAR_h equ 0x68 + CHAR_i equ 0x69 + CHAR_j equ 0x6a + CHAR_k equ 0x6b + CHAR_l equ 0x6c + CHAR_m equ 0x6d + CHAR_n equ 0x6e + CHAR_o equ 0x6f + CHAR_p equ 0x70 + CHAR_q equ 0x71 + CHAR_r equ 0x72 + CHAR_s equ 0x73 + CHAR_t equ 0x74 + CHAR_u equ 0x75 + CHAR_v equ 0x76 + CHAR_w equ 0x77 + CHAR_x equ 0x78 + CHAR_y equ 0x79 + CHAR_z equ 0x7a +;;;;;;;;;;;;;;;;;;;;;;;;;;; + +macro resv c_size +{ + db c_size dup (0) +} + +macro resv_stuff c_size +{ + repeat c_size + db % and 0xff + end repeat +} diff --git a/hexable-autogen/description.md b/hexable-autogen/description.md new file mode 100644 index 0000000..5030dfb --- /dev/null +++ b/hexable-autogen/description.md @@ -0,0 +1,2 @@ +I tried to hide a flag sneakily, can you find it? +[Download](${hexable}) \ No newline at end of file diff --git a/hexable-autogen/elf.inc b/hexable-autogen/elf.inc new file mode 100644 index 0000000..c19743a --- /dev/null +++ b/hexable-autogen/elf.inc @@ -0,0 +1,45 @@ +;;;;;;;;;;;;;;;;;;;;;;;;;;; +; ELF header for stuff + + RLIMIT_AS equ 0x09 + +macro reserve name,size +{ + name db 0 + repeat size-1 + db 0 + end repeat +} + +macro print message +{ + mov eax, message +@@: + cmp byte [eax], 0 + jz @f + inc eax + jmp @b +@@: + mov edx, eax + sub edx, message + mov eax, 4 + mov ebx, 1 + mov ecx, message + int 0x80 +} + +macro read out_buff, cnt +{ + mov ebx, 0 + mov eax, 3 + mov ecx, out_buff + mov edx, cnt + int 0x80 +} + +macro exit exitcode +{ + mov ebx, exitcode + mov eax, 1 + int 0x80 +} diff --git a/hexable-autogen/grader.py b/hexable-autogen/grader.py new file mode 100644 index 0000000..07b067d --- /dev/null +++ b/hexable-autogen/grader.py @@ -0,0 +1,18 @@ +def gen_flag(random, length): + x = '' + for i in range(0,length): + x += random.choice(list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQSTUVWXYZ0123456789')) + return x + +def grade(random, key): + if key.find(gen_flag(random, 14)) != -1: + return True, "Correct!" + return False, "Nope." + +def generate(random): + dat = b'\x7fELF\x01\x01\x01\x03\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x03\x00\x01\x00\x00\x00\x91\x80\x04\x084\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x00 \x00\x02\x00(\x00\x00\x00\x00\x00\x01\x00\x00\x00t\x00\x00\x00t\x80\x04\x08t\x80\x04\x08G\x00\x00\x00G\x00\x00\x00\x07\x00\x00\x00\x00\x10\x00\x00\x01\x00\x00\x00\xbb\x00\x00\x00\xbb\x90\x04\x08\xbb\x90\x04\x080\x00\x00\x000\x00\x00\x00\x06\x00\x00\x00\x00\x10\x00\x00\x89\xc8\x808\x00t\x03@\xeb\xf8\x89\xc2)\xca\xb8\x04\x00\x00\x00\xbb\x01\x00\x00\x00\x89\xc9\xcd\x80\xc3\xb9\xbb\x90\x04\x08\xe8\xd9\xff\xff\xff\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Can you find the flag?\n\x00easyctf{abcdef__123456}\x00' + output = bytearray(dat[:0xdb]) + flag = gen_flag(random,14) + output.extend(flag.encode('utf-8')) + output.extend(dat[0xdb+14:]) + return dict(files={"hexable":output}) diff --git a/hexable-autogen/hexable b/hexable-autogen/hexable new file mode 100644 index 0000000000000000000000000000000000000000..22538c24c580c8fc4f5100593e2dbbf061bb161b GIT binary patch literal 235 zcmb<-^>JflWMpQ50wxA#21X!zVgn0@2}}@3n=mLaFfnL=ML_Z;APiIk!tOve2(tq* zg8&0q|85|2_XHLW5HpjK=scu(Y6lBYbT`P%&XZ>w4(|l% zcyaUp|NkH(7PVmH_}?)h}59 literal 0 HcmV?d00001 diff --git a/hexable-autogen/hexable.asm b/hexable-autogen/hexable.asm new file mode 100644 index 0000000..8e6d54b --- /dev/null +++ b/hexable-autogen/hexable.asm @@ -0,0 +1,35 @@ +format ELF executable 3 +entry start + +;;;;;;;;;;;;;;;;;;;;;;;;;;; +; Buffer macros + BUFF_SIZE equ 32 +;;;;;;;;;;;;;;;;;;;;;;;;;;; + +;;;;;;;;;;;;;;;;;;;;;;;;;;; +; Includes of macros +include 'elf.inc' +include 'char.inc' +;;;;;;;;;;;;;;;;;;;;;;;;;;; + +;;;;;;;;;;;;;;;;;;;;;;;;;;; +; Code +segment executable writeable readable +put: + print ecx + ret + +start: + mov ecx, msg + call put + exit 0 +reserve no_code,20 +;;;;;;;;;;;;;;;;;;;;;;;;;;; + +;;;;;;;;;;;;;;;;;;;;;;;;;;; +; Data +segment readable writeable +msg db 'Can you find the flag?',ENDL,0 +flag db 'easyctf{abcdef__123456}' +reserve temp,1 +;;;;;;;;;;;;;;;;;;;;;;;;;;; diff --git a/hexable-autogen/problem.yml b/hexable-autogen/problem.yml new file mode 100644 index 0000000..3199c27 --- /dev/null +++ b/hexable-autogen/problem.yml @@ -0,0 +1,5 @@ +title: Hexable +category: Reverse Engineering +value: 10 +author: r3ndom +autogen: true diff --git a/hexable-autogen/simple_gen.py b/hexable-autogen/simple_gen.py new file mode 100644 index 0000000..aaaf618 --- /dev/null +++ b/hexable-autogen/simple_gen.py @@ -0,0 +1,19 @@ +import random + +dat = b'\x7fELF\x01\x01\x01\x03\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x03\x00\x01\x00\x00\x00\x91\x80\x04\x084\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x00 \x00\x02\x00(\x00\x00\x00\x00\x00\x01\x00\x00\x00t\x00\x00\x00t\x80\x04\x08t\x80\x04\x08G\x00\x00\x00G\x00\x00\x00\x07\x00\x00\x00\x00\x10\x00\x00\x01\x00\x00\x00\xbb\x00\x00\x00\xbb\x90\x04\x08\xbb\x90\x04\x080\x00\x00\x000\x00\x00\x00\x06\x00\x00\x00\x00\x10\x00\x00\x89\xc8\x808\x00t\x03@\xeb\xf8\x89\xc2)\xca\xb8\x04\x00\x00\x00\xbb\x01\x00\x00\x00\x89\xc9\xcd\x80\xc3\xb9\xbb\x90\x04\x08\xe8\xd9\xff\xff\xff\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Can you find the flag?\n\x00easyctf{abcdef__123456}\x00' + +def gen_flag(length): + x = '' + for i in range(0,length): + x += random.choice(list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQSTUVWXYZ0123456789')) + return x + +output = bytearray(dat[:0xdb]) +flag = gen_flag(14) +output.extend(flag.encode('utf-8')) +output.extend(dat[0xdb+14:]) + +print(output) +#o = open(flag, 'wb') +#o.write(output) +#o.close() diff --git a/hexable-autogen/std.inc b/hexable-autogen/std.inc new file mode 100644 index 0000000..4e57c54 --- /dev/null +++ b/hexable-autogen/std.inc @@ -0,0 +1,32 @@ +;;;;;;;;;;;;;;;;;;;;;;;;;;; +; Standard Includes of my +; code +include 'char.inc' + +;;;;;;;;;;;;;;;;;;;;;;;;;;; +; File descriptor macros + STDIN equ 0 + STDOUT equ 1 + STDERR equ 2 +;;;;;;;;;;;;;;;;;;;;;;;;;;; + + +; Standard prologue of a function +macro prologue +{ + push ebp + mov ebp, esp +} + +; Standard epilogue of a function +macro epilogue +{ + mov esp, ebp + pop ebp +} + +; Allocates space on the stack for something +macro local_alloc size +{ + sub esp,size +} \ No newline at end of file From 183332cd92eaaf5ec56efdfcbbe66cc925d26832 Mon Sep 17 00:00:00 2001 From: Michael Zhang Date: Sun, 12 Mar 2017 04:21:00 -0500 Subject: [PATCH 08/16] Update --- easy-re/description.md | 2 +- hexable-autogen/grader.py | 20 ++++++++++++-------- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/easy-re/description.md b/easy-re/description.md index 4233bdc..5607dec 100644 --- a/easy-re/description.md +++ b/easy-re/description.md @@ -1 +1 @@ -This binary has a rather unhelpful message, can you find what it's hiding? [easy-re](easy_re) \ No newline at end of file +This binary has a rather unhelpful message, can you find what it's hiding? [easy-re](${easy_re}) \ No newline at end of file diff --git a/hexable-autogen/grader.py b/hexable-autogen/grader.py index 07b067d..a8243e9 100644 --- a/hexable-autogen/grader.py +++ b/hexable-autogen/grader.py @@ -1,18 +1,22 @@ +from cStringIO import StringIO + def gen_flag(random, length): - x = '' - for i in range(0,length): - x += random.choice(list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQSTUVWXYZ0123456789')) - return x + x = '' + for i in range(0, length): + x += random.choice(list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQSTUVWXYZ0123456789')) + return x + def grade(random, key): if key.find(gen_flag(random, 14)) != -1: return True, "Correct!" return False, "Nope." + def generate(random): dat = b'\x7fELF\x01\x01\x01\x03\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x03\x00\x01\x00\x00\x00\x91\x80\x04\x084\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x004\x00 \x00\x02\x00(\x00\x00\x00\x00\x00\x01\x00\x00\x00t\x00\x00\x00t\x80\x04\x08t\x80\x04\x08G\x00\x00\x00G\x00\x00\x00\x07\x00\x00\x00\x00\x10\x00\x00\x01\x00\x00\x00\xbb\x00\x00\x00\xbb\x90\x04\x08\xbb\x90\x04\x080\x00\x00\x000\x00\x00\x00\x06\x00\x00\x00\x00\x10\x00\x00\x89\xc8\x808\x00t\x03@\xeb\xf8\x89\xc2)\xca\xb8\x04\x00\x00\x00\xbb\x01\x00\x00\x00\x89\xc9\xcd\x80\xc3\xb9\xbb\x90\x04\x08\xe8\xd9\xff\xff\xff\xbb\x00\x00\x00\x00\xb8\x01\x00\x00\x00\xcd\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00Can you find the flag?\n\x00easyctf{abcdef__123456}\x00' - output = bytearray(dat[:0xdb]) - flag = gen_flag(random,14) + output = bytearray(dat[:0xdb]) + flag = gen_flag(random, 14) output.extend(flag.encode('utf-8')) - output.extend(dat[0xdb+14:]) - return dict(files={"hexable":output}) + output.extend(dat[0xdb + 14:]) + return dict(files={"hexable": (lambda r: StringIO(output))}) From 2a3a1bd463e9ac9415f13fb811274f811a265779 Mon Sep 17 00:00:00 2001 From: Michael Zhang Date: Sun, 12 Mar 2017 04:26:54 -0500 Subject: [PATCH 09/16] Description for risky business. --- risky-business/description.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/risky-business/description.md b/risky-business/description.md index e0285df..70c2c8a 100644 --- a/risky-business/description.md +++ b/risky-business/description.md @@ -1 +1,3 @@ -We wanted to branch into the casino business, but human employees are too expensive so we decided to automate it. I feel like we missed something obvious though... Oh well! Here's the binary: [casino](casino) (MZ SHELL SERVER THING) \ No newline at end of file +We wanted to branch into the casino business, but human employees are too expensive so we decided to automate it. I feel like we missed something obvious though... Oh well! Here's the binary: [casino](${casino}) + +Solve this problem by logging into the shell server and navigating to `/problems`. \ No newline at end of file From 7c0a290d79a6fca7257643c5083f7198e8730006 Mon Sep 17 00:00:00 2001 From: John W Date: Sun, 12 Mar 2017 04:31:14 -0500 Subject: [PATCH 10/16] Removed easy-re, increased points of hexable --- easy-re/description.md | 1 - easy-re/easy-re | Bin 13968 -> 0 bytes easy-re/grader.py | 4 ---- easy-re/problem.yml | 9 --------- hexable-autogen/problem.yml | 2 +- 5 files changed, 1 insertion(+), 15 deletions(-) delete mode 100644 easy-re/description.md delete mode 100644 easy-re/easy-re delete mode 100644 easy-re/grader.py delete mode 100644 easy-re/problem.yml diff --git a/easy-re/description.md b/easy-re/description.md deleted file mode 100644 index 5607dec..0000000 --- a/easy-re/description.md +++ /dev/null @@ -1 +0,0 @@ -This binary has a rather unhelpful message, can you find what it's hiding? [easy-re](${easy_re}) \ No newline at end of file diff --git a/easy-re/easy-re b/easy-re/easy-re deleted file mode 100644 index 36c507c4262b4a0404a432948e7ba98bb84a225f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 13968 zcmeHOeQZ&ANBGb3LufA@1U5z`Pbgz)}Ci^72di_Q@635X6ism;PAKC-dfBu8Lk3H|W zdF`&~cm7cO=HVra{`g9W`e-S6-9+U)vBXv>hbR6ld|t0vJG$hvOH-->Z#B<8JiW2M zY3GYz7X|XiRitNe3I10x(ltfo=VBto_)|*ot4r8_qJ;eoCFJS)DK>5l^2PX%m*D@p z1m9D_{+~+lH!A*xDLz;nhfmQYe_ZPP;GSKIf5IYv8g^!h1>%TnhZHqdScqqpe2c}7 zz`jfCk??J|(O#<)n%32mOlWC6l+ra#Xlr(9tj*0yAu z79e-}`n29?DxFM(;xWBn+vPE|@6fbxU!T|OT>%rZFg#Ah5?xKb9U15ZSmeVV=jfvf{L2Nx2_|u;ZMf(}+&6a(vrye%Zxj`Aw8@>e_Hp zy@9>V=S<5@{nG@bsz?oBgXBl5-vfGfEQS-lTzJq=I+^*gDRd&tl8p39x`AlyB{8x?(svO}OEA(R=@mp%=tq2#zLjVS z`G`l-Hxf-D9dSu|KG77)kxEJLo#PUnhd@j4e%Lhh#`fUQpM!&c8Et8AI(=evx=#d8 zpB#|r^sZ?>G5oiy+3cmxnTzq`=cQ*6@QuOchk=5FW6t2v#a#L0?X}<=SM@nLYtz`;%*A5cDP#PB zul8d;A~S0v6o(U-(YDvhJHfJjB1bwd@B=Y8c#p`GzyB2Ua>hO;h3wgFBYU7j?PC=) zeB$^KxHG&O^E*a&%;3=J;XNRv*0xh5)`p!_HT2N=q0G5R@IcwJDw^t0VAy+N@S*dz znfv#He)yqt*({v;=J5+lVD6>Qvf1Apg5hIC9;aLG@T=ej4+h?)5rP=OXuoo-o}4&A zS~upnr-$FkS)i`tbdw+63*P(lgF~m-%t>VT5mr>MIJpEtyZ}Jai{Tu!5%?Foln&rac99+H~xUFgEa?{XT&9_{X*V4() z9K%1k0+ahc)Lq`Uc|Dtl-fJGZyb>0&v(EWqiFZce)rN!`_rp9^1h#dMJAWKVQA(XMDb9hJiPiiXnt zVZHM~Z>Q!-#QU|Hcw9?WYrAXGT6Imj{~?mIEpXiJ1Ez~>DO`VyFru;*cs?RVzs3B( zmw=}rCJParrNCbSej0cm@ND!E*!HvvTVJJZ!Su-$hisE8iBHc)Ct&wh5>QZF9(K`B z@`wJB&5n|+vvQSl-kO=yc2^9Dd*GRDiFvWe$yXidOG1STRd5rK&aOhjNJ0uvFKh`>Yy zCL%Bqfr$uAMBx8B0xig+5k!$zBk(9%68OR+vIHxpoHhaTDThrk-9Tb9QbPosE4`%b zUoW{x_Ne!)3lv?c@O*{GR6pkxD91qX>D6qK@L{`;Q0|@Y(K3VPcb#YL2Fjg-^Dae{Qltv)>*iM+s8`9v|rk zIiH}CM|wxn?8m607pi_k`+xt<@3E~TeNV0Hj}?AV;nx)Yy~6J(d|Ba1NCpwiRrn@_ z>l9w4@Fs;j6_!e-FTB6G%T=|pBa_fGu3EgC@hq>)NXq*yZ=Ksy+s<@Tl7m;<|%_hUYPlHh%t&z~%ct+zu|2;L|8 z@>2xww|xH8+`i1`Ps?4O`TXf(K&@9ke}?ESvK|iM%+-VB%g+>iz320Bl_Rfg1qa^r zavg)Y&w)2lM~cc{D=2+v1qZTve6E=L9JtE)Jjv(J6_l2@f=OgdJ$Z|kL~i-(m#hnQ;0Dz!?UUb~s00erbGYQ3VWvlaYG*sUpA6nc@!j_R8{?=6X$wB}oQkjaQ@U6&-~^ z#EGGHXb&hgEj%{${9TIh$Wep;i_c!HHF^{&fK@ zuzn>~M9E-q8|8LdAgBa_D_e7>Hmq9J7C_mMzo9umN_oCV@)@$&N@y$ZTkl`j)QCP= zd=pM*WN<+L`;x4}dMYYJ^7&-Bj!})nc8$_53Z3dkH4oMBmBgIY3dpG3 zDo+X`k#th)#ulSexbbB)Hl@~)PP12pP1RS*jI68T3bP_1#yXg*<1B-J;i5LH9n|K1 z-iVp1>+-D0z(r|2L zP`B7C+$ceax>2FFTn}|AswF!E`L_Hn8>5zj^QU<~u?N-NHcLYY5f_2pGMf<|hUR}dH zu!W>CdDj0oU-bJIw?6!aG=QJ? zxX#@A%bR4)@FfuRY|r}qT*!6YF0(M&xJ~7O7nE6_pC5H)aA}@&q5ewrUq&u~$3JZM zNsYsbQ7@_Sd`N|&8LdZS8a}Mg&!cA*b4l4aaN}v2EKiPl97W8~VuChKq zFP~HT9wk_=FzfUD_bL4b?pOJq3MI(-A=0O3FsuIK;89FCKgId6%_@3>takEByhbpW?tO1s<36 ze`L|;{J&DyvYC0u*Tau{=3kbi4W^@K4feW zSsUN4231IZf)4VD^>cX>{{IUrDr_Bp41B&eNrdx@6-s|pO_;9_*5`R0hK_lB&clo? zCToTMvOZ(_E0bA2m#=Y2b@8Zya^I}Sc&bI8^E!_zefEWFjH%|D$2NNqe+A|qA>oSNjb&k?< b(0^Na{(OGY^<8ZIGgXHE&ny?5b^Lz Date: Sun, 12 Mar 2017 04:28:33 -0500 Subject: [PATCH 11/16] Create description.md --- doubly-dangerous/description.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 doubly-dangerous/description.md diff --git a/doubly-dangerous/description.md b/doubly-dangerous/description.md new file mode 100644 index 0000000..c45f1ff --- /dev/null +++ b/doubly-dangerous/description.md @@ -0,0 +1 @@ +There seems to be an issue with this binary. Can you exploit it? View the problem in the shell server /problems/ directory. From 428cd8d2805cef0dacab6aa6aaf1c5e3f40c2f8a Mon Sep 17 00:00:00 2001 From: Ankur Sundara Date: Sun, 12 Mar 2017 04:28:58 -0500 Subject: [PATCH 12/16] Update problem.yml --- doubly-dangerous/problem.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doubly-dangerous/problem.yml b/doubly-dangerous/problem.yml index 661bb36..7249e0a 100644 --- a/doubly-dangerous/problem.yml +++ b/doubly-dangerous/problem.yml @@ -4,6 +4,6 @@ hint: How are floating-point numbers represented? category: Binary Exploitation autogen: false programming: false -value: 75 +value: 110 files: - doubly_dangerous From e59e9b13adff2086c7676c2985da8bd1f3f27df4 Mon Sep 17 00:00:00 2001 From: John W Date: Sun, 12 Mar 2017 04:32:55 -0500 Subject: [PATCH 13/16] Added hexable hint. --- hexable-autogen/problem.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/hexable-autogen/problem.yml b/hexable-autogen/problem.yml index e5d0310..06176b6 100644 --- a/hexable-autogen/problem.yml +++ b/hexable-autogen/problem.yml @@ -3,3 +3,4 @@ category: Reverse Engineering value: 25 author: r3ndom autogen: true +hint: Try using a hex editor. \ No newline at end of file From b66542a724e2ef72c7e2b1c49aa40a781053c7f0 Mon Sep 17 00:00:00 2001 From: Ankur Sundara Date: Sun, 12 Mar 2017 04:30:07 -0500 Subject: [PATCH 14/16] Create grader.py --- doubly-dangerous/grader.py | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 doubly-dangerous/grader.py diff --git a/doubly-dangerous/grader.py b/doubly-dangerous/grader.py new file mode 100644 index 0000000..981da52 --- /dev/null +++ b/doubly-dangerous/grader.py @@ -0,0 +1,4 @@ +def grade(random, key): + if key.find("bofs_and_floats_are_d0uble_tr0uble!") != -1: + return True, "Correct!" + return False, "Nope :(" From c1a20af2e1c01895088d77a5fa7a69fd0be8dac4 Mon Sep 17 00:00:00 2001 From: Michael Zhang Date: Sun, 12 Mar 2017 04:31:37 -0500 Subject: [PATCH 15/16] Update rsa1 --- rsa1/grader.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/rsa1/grader.py b/rsa1/grader.py index 4f42f65..642dece 100644 --- a/rsa1/grader.py +++ b/rsa1/grader.py @@ -39,7 +39,7 @@ def generate_ciphertext(random): def generate(random): return dict(files={ - "ciphertext_rsa1.txt": generate_ciphertext + "ciphertext.txt": generate_ciphertext }) def grade(random, key): From 7e841043dade9a7a8683a320db9bd1cbd3fab138 Mon Sep 17 00:00:00 2001 From: John W Date: Sun, 12 Mar 2017 04:34:26 -0500 Subject: [PATCH 16/16] Hint and description changes --- r3ndom-67k/problem.yml | 1 + simple-rop/description.md | 2 ++ 2 files changed, 3 insertions(+) diff --git a/r3ndom-67k/problem.yml b/r3ndom-67k/problem.yml index 4c35b24..7428123 100644 --- a/r3ndom-67k/problem.yml +++ b/r3ndom-67k/problem.yml @@ -3,5 +3,6 @@ category: Reverse Engineering value: 450 author: r3ndom autogen: false +hint: Maybe write a script. files: - _67k.zip \ No newline at end of file diff --git a/simple-rop/description.md b/simple-rop/description.md index feda140..dbfd03a 100644 --- a/simple-rop/description.md +++ b/simple-rop/description.md @@ -1,3 +1,5 @@ On the shell there is a folder ``. + Read flag.txt + [Source](${simple-rop.c}) \ No newline at end of file