Thursday, April 16, 2020

ASIS CTF Quals 2015 - Sawthis Writeup - Srand Remote Prediction


The remote service ask for a name, if you send more than 64 bytes, a memory leak happens.
The buffer next to the name's is the first random value used to init the srand()


If we get this value, and set our local srand([leaked] ^ [luckyNumber]) we will be able to predict the following randoms and win the game, but we have to see few details more ;)

The function used to read the input until the byte \n appears, but also up to 64 bytes, if we trigger this second condition there is not 0x00 and the print shows the random buffer :)

The nickname buffer:



The seed buffer:



So here it is clear, but let's see that the random values are computed with several gpu instructions which are decompiled incorrectly:







We tried to predict the random and aply the gpu divisions without luck :(



There was a missing detail in this predcitor, but there are always other creative ways to do the things.
We use the local software as a predictor, we inject the leaked seed on the local binary of the remote server and got a perfect syncronization, predicting the remote random values:




The process is a bit ugly becouse we combined automated process of leak exctraction and socket interactive mode, with the manual gdb macro.




The macro:



















Related posts
  1. Hacking Tools Windows
  2. Android Hack Tools Github
  3. Hacking Tools For Windows Free Download
  4. Hacking Tools For Mac
  5. Top Pentest Tools
  6. Hacking Tools And Software
  7. Pentest Tools Website
  8. Hacking Tools And Software
  9. Hack Tools
  10. Pentest Tools Find Subdomains
  11. Hacks And Tools
  12. Pentest Tools Github
  13. Hack Tools For Pc
  14. Pentest Tools Website Vulnerability
  15. Hacking Tools And Software
  16. Hacking Tools For Windows 7
  17. Hacker Tools Hardware
  18. How To Make Hacking Tools
  19. Hack Tools Download
  20. Hak5 Tools
  21. Hacker Tools 2019
  22. Hacker Tools 2020
  23. Best Pentesting Tools 2018
  24. Computer Hacker
  25. Hack Tools For Pc
  26. Tools For Hacker
  27. Hacking Apps
  28. How To Install Pentest Tools In Ubuntu

No comments: