Notes on chw㉿world:~$

Calibre CVE: CVE-2024-6782

Tue, 10 Dec 2024 00:00:00 +0000

Calibre CVE: CVE-2024-6782

[TOC]

AIS3 Pre-exam CTF 2024 writeup

Thu, 25 Jul 2024 00:00:00 +0000

AIS3 Pre-exam CTF 2024 writeup

[TOC]

picoCTF: caas Writeup & Patch

Tue, 25 Jun 2024 00:00:00 +0000

picoCTF: caas Writeup & Patch

[TOC]

Topic

Lab

picoCTF:

https://play.picoctf.org/practice/challenge/202?category=1&page=1&search=caas

Initial Enumeration

●Start Machine:
https://caas.mars.picoctf.net/

Solution

1. Attempt

https://caas.mars.picoctf.net/cowsay/chw

2. Code Review

index.js

const express = require('express');
const app = express();
const { exec } = require('child_process');

app.use(express.static('public'));

app.get('/cowsay/:message', (req, res) => {
 exec(`/usr/games/cowsay ${req.params.message}`, {timeout: 5000}, (error, stdout) => {
 if (error) return res.status(500).end();
 res.type('txt').send(stdout).end();
 });
});

app.listen(3000, () => {
 console.log('listening');
});

express 伺服器框架

exec 使用 child_process 執行命令

{req.params.message} 直接丟進Shell 執行

Err 回應 500

3. Command Injection

; 用分號閉合req.params.message，接著注入指令

Cyber Apocalypse 2024: Hacker Royale

Tue, 18 Jun 2024 00:00:00 +0000

Cyber Apocalypse 2024: Hacker Royale

[TOC]

GDB & Binary Exploitation

Mon, 20 May 2024 00:00:00 +0000

GDB & Binary Exploitation

[TOC]

GDB (GNU Debugger)

GNU開發工具 (GNU toolchain) 是Linux作業系統、嵌入式系統 (Embedded System)、與自由及開放原始碼軟體 (Free and Open Source Software, FOSS) 社群中，最常見、使用得最廣泛的程式開發工具。GNU開發工具是由GNU計劃 (GNU Project) 中的數個程式開發工具所集合而成，可以完成編譯、組譯和連結等步驟，還有自動化設定、自動化編譯、除錯工具等功能。GNU計劃是1983年時理查史托曼 (Richard Stallman) 提出的，目的是要建立一個由自由軟體組成的作業系統。1992年時，Linux核心以GNU通用公共授權條款 (GPL) 釋出，與GNU計劃組成GNU/Linux作業系統，而成為最多人使用的自由軟體作業系統家族，GNU開發工具也成為這些系統最主要的開發工具。 Ref: https://www.cc.ntu.edu.tw/chinese/epaper/0020/20120320_2005.html

Conflict CTF writeup

Wed, 10 Apr 2024 00:00:00 +0000

Conflict CTF writeup

[TOC]

Ref: https://github.com/ntut-xuan/ConflictCTF

git clone https://github.com/ntut-xuan/ConflictCTF.git

git checkout master
git merge origin/alice

git merge origin/bob // Solve the conflict.

Topic

script.py

<<<<<<< HEAD
#flag_format = "flag{FLAG_HERE}"

alice = ['0x62', '0x6f', '0x6f', '0x6c', '0x72', '0x6e', '0x63', '0x6e', '0x69', '0x72', '0x76', '0x6e', '0x5f', '0x75', '0x65', '0x75', '0x73', '0x5f', '0x69', '0x7b', '0x61', '0x66']
bob = []

def make_the_list_into_char_list(list: list[str]) -> list[str]:
 array = []
 for i in range(len(list)):
 array.append(chr(int(list[i], base=16)))
 return array

def reverse_the_list(list: list[str]) -> list[str]:
=======
import random

# flag_format = "flag{FLAG_HERE}"

alice = []
bob = ['0x81', '0x6a', '0x7c', '0x66', '0x6f', '0x7b', '0x71', '0x66', '0x77', '0x7b', '0x6e', '0x62', '0x6b', '0x6d', '0x67', '0x79', '0x64', '0x69', '0x75', '0x68', '0x6d', '0x6c']

def make_the_list_into_char_list(array):
 return list(map(chr, [int(x, base=16) for x in array]))

def reverse_the_list(list):
>>>>>>> origin/bob
 array = []
 for i in range(len(list)):
 array.append(list[len(list)-1-i])
 return array

def decrease(list):
 random.seed("bob")
 for i in range(len(list)):
 list[i] = hex(int(list[i], base=16) - int(random.random() * 10))
 return list

def make_flag(alice_key, bob_key):
 for i in range(len(alice_key)):
 print(alice_key[i], end="")
 print(bob_key[i], end="")
 print()

make_flag(
 make_the_list_into_char_list(reverse_the_list(alice)), 
 make_the_list_into_char_list(reverse_the_list(decrease(bob)))
<<<<<<< HEAD
)
=======
)
>>>>>>> origin/bob

python3 script.py

Git 介紹 & 常用操作

Wed, 10 Apr 2024 00:00:00 +0000

Git 介紹 & 常用操作

[TOC]

picoCTF 2024 writeup

Wed, 27 Mar 2024 00:00:00 +0000

picoCTF 2024 writeup

[TOC]

Notes on chw㉿world:~$

Calibre CVE: CVE-2024-6782

Calibre CVE: CVE-2024-6782

Table of Contents

AIS3 Pre-exam CTF 2024 writeup

AIS3 Pre-exam CTF 2024 writeup

Table of Contents

picoCTF: caas Writeup & Patch

picoCTF: caas Writeup & Patch

Table of Contents

Topic

Lab

picoCTF:

Initial Enumeration

Solution

1. Attempt

2. Code Review

3. Command Injection

Cyber Apocalypse 2024: Hacker Royale

Cyber Apocalypse 2024: Hacker Royale

Table of Contents

GDB & Binary Exploitation

GDB & Binary Exploitation

Table of Contents

GDB (GNU Debugger)

Conflict CTF writeup

Conflict CTF writeup

Table of Contents

Ref: https://github.com/ntut-xuan/ConflictCTF

Topic

script.py

Git 介紹 & 常用操作

Git 介紹 & 常用操作

Table of Contents

picoCTF 2024 writeup

picoCTF 2024 writeup

Table of Contents