Defcon 2015 Coding Skillz 1 Writeup

Just connecting to the service, a 64bit cpu registers dump is received, and so does several binary code as you can see:

The registers represent an initial cpu state, and we have to reply with the registers result of the binary code execution. This must be automated becouse of the 10 seconds server socket timeout.

The exploit is quite simple, we have to set the cpu registers to this values, execute the code and get resulting registers.

In python we created two structures for the initial state and the ending state.

cpuRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}
finalRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

We inject at the beginning several movs for setting the initial state:

for r in cpuRegs.keys():

    code.append('mov %s, %s' % (r, cpuRegs[r]))

The 64bit compilation of the movs and the binary code, but changing the last ret instruction by a sigtrap "int 3"

We compile with nasm in this way:

os.popen('nasm -f elf64 code.asm')

os.popen('ld -o code code.o ')

And use GDB to execute the code until the sigtrap, and then get the registers

fd = os.popen("gdb code -ex 'r' -ex 'i r' -ex 'quit'",'r')

for l in fd.readlines():

    for x in finalRegs.keys():

           ...

We just parse the registers and send the to the server in the same format, and got the key.

The code:

from libcookie import *

from asm import *

import os

import sys

host = 'catwestern_631d7907670909fc4df2defc13f2057c.quals.shallweplayaga.me'

port = 9999

cpuRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

finalRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

fregs = 15

s = Sock(TCP)

s.timeout = 999

s.connect(host,port)

data = s.readUntil('bytes:')

#data = s.read(sz)

#data = s.readAll()

sz = 0

for r in data.split('\n'):

    for rk in cpuRegs.keys():

        if r.startswith(rk):

            cpuRegs[rk] = r.split('=')[1]

    if 'bytes' in r:

        sz = int(r.split(' ')[3])

binary = data[-sz:]

code = []

print '[',binary,']'

print 'given size:',sz,'bin size:',len(binary)        

print cpuRegs

for r in cpuRegs.keys():

    code.append('mov %s, %s' % (r, cpuRegs[r]))

#print code

fd = open('code.asm','w')

fd.write('\n'.join(code)+'\n')

fd.close()

Capstone().dump('x86','64',binary,'code.asm')

print 'Compilando ...'

os.popen('nasm -f elf64 code.asm')

os.popen('ld -o code code.o ')

print 'Ejecutando ...'

fd = os.popen("gdb code -ex 'r' -ex 'i r' -ex 'quit'",'r')

for l in fd.readlines():

    for x in finalRegs.keys():

        if x in l:

            l = l.replace('\t',' ')

            try:

                i = 12

                spl = l.split(' ')

                if spl[i] == '':

                    i+=1

                print 'reg: ',x

                finalRegs[x] = l.split(' ')[i].split('\t')[0]

            except:

                print 'err: '+l

            fregs -= 1

            if fregs == 0:

                #print 'sending regs ...'

                #print finalRegs

                

                buff = []

                for k in finalRegs.keys():

                    buff.append('%s=%s' % (k,finalRegs[k]))

                print '\n'.join(buff)+'\n'

                print s.readAll()

                s.write('\n'.join(buff)+'\n\n\n')

                print 'waiting flag ....'

                print s.readAll()

                print '----- yeah? -----'

                s.close()

                

fd.close()

s.close()

Related links

1. What Is Hacking Tools
2. Hacking Tools Windows 10
3. Pentest Tools Bluekeep
4. Hacking Tools For Windows
5. Hacking Tools Windows 10
6. Hacking Tools Windows
7. Install Pentest Tools Ubuntu
8. Hacker Tools Software
9. Hacker Tools Linux
10. Pentest Tools Review
11. Nsa Hack Tools
12. Pentest Box Tools Download
13. Hacker Tool Kit
14. Top Pentest Tools
15. Hacker Tools List
16. Hacker Tools Github
17. Pentest Tools Kali Linux
18. Hacking Tools Github
19. Hacker Tools Linux
20. Hacking Tools For Pc
21. Hacking Tools Download
22. How To Hack
23. Hack Tools For Games
24. Pentest Tools Github
25. Hack Tools Mac
26. Hack Tools Mac
27. Hacking Tools Free Download
28. Hacking Tools Online
29. Hacker Tools For Pc
30. Hacking Tools For Mac
31. Hacking Tools Windows 10
32. Pentest Tools Linux
33. What Are Hacking Tools
34. Best Hacking Tools 2020
35. Kik Hack Tools
36. Hacker Tools Free
37. New Hacker Tools
38. Hacker Tools Online
39. Hack Tools For Games
40. Hacking Tools Download
41. Hack Tools Mac
42. What Are Hacking Tools
43. Hacking Tools For Windows 7
44. Hacker Tools For Pc
45. Hacking Apps
46. Pentest Tools
47. Hacker Tool Kit
48. Hacker Tool Kit
49. Hack App
50. Pentest Tools Subdomain
51. Hacker Tool Kit
52. Hacking Tools For Windows
53. Pentest Tools Framework
54. Best Hacking Tools 2020
55. Hack Tools For Games
56. Hacking Tools For Windows
57. Hacker Tools Free Download
58. Hacking Tools And Software
59. Hacking Tools Windows
60. Hacker Tools Software
61. Pentest Tools Github
62. What Is Hacking Tools
63. Hacker Tools Online
64. Hacking Tools For Windows
65. Pentest Tools Github
66. New Hack Tools
67. Pentest Tools Framework
68. Hak5 Tools
69. Hacker Tools Windows
70. Hacking Tools For Windows
71. Hack Tools For Windows
72. Pentest Tools Alternative
73. Hacker Tools For Windows
74. Hacking Tools
75. Pentest Tools Framework
76. Hacking Tools Pc
77. Pentest Recon Tools
78. Hacking Tools Hardware
79. Pentest Tools Subdomain
80. What Is Hacking Tools
81. Hacker Tools Mac
82. Hacking Tools Github
83. Pentest Tools Apk
84. Hacking Tools For Windows Free Download
85. Hacker Tools Github
86. How To Make Hacking Tools
87. Hack Tools Github
88. Hacker Security Tools
89. Kik Hack Tools
90. Underground Hacker Sites
91. What Is Hacking Tools
92. Hacking Tools 2020
93. Pentest Tools For Windows
94. How To Hack
95. Hacks And Tools
96. Pentest Tools
97. Pentest Tools Download
98. Pentest Tools
99. Nsa Hack Tools Download
100. Hacker Techniques Tools And Incident Handling
101. Hacking Tools Usb
102. Hacker Tools For Pc
103. Hacking Tools Free Download
104. Top Pentest Tools
105. Pentest Tools Free
106. Hacker Tools Apk
107. Hacker Tools 2019
108. World No 1 Hacker Software
109. Pentest Tools Android
110. Pentest Tools Linux
111. Pentest Tools For Ubuntu
112. Tools For Hacker
113. Hacking Tools For Kali Linux
114. Pentest Tools For Android
115. Usb Pentest Tools
116. Hacking Tools Online
117. Hacking Tools And Software
118. Pentest Tools For Android
119. Hack Tools For Ubuntu
120. Hack Tools Download
121. Hacker Tools Hardware
122. Hack App
123. Hack Tools For Games
124. Hack Tools For Pc
125. Hacking Tools Name
126. Pentest Tools Port Scanner
127. Bluetooth Hacking Tools Kali
128. Hack Tools 2019
129. What Are Hacking Tools
130. Pentest Tools For Ubuntu
131. Growth Hacker Tools
132. Pentest Tools Github
133. Nsa Hack Tools Download
134. Hacker Tools Apk
135. Nsa Hack Tools Download
136. Hacker Search Tools