UAM: Reverseando la MOVida malagueña

Introducción

Descargamos el binario de la web del reto, lo descomprimimos y comprobamos su hash. Lo primero que nos llama la atención es la información que nos muestra readelf:

readelf -h Thestral_6ee87b9724dcf5c41ebba4cd578841be ELF Header: Magic: 7f 45 4c 46 01 02 01 00 00 00 00 00 00 00 00 00 […]

tonicas | Monday, 19th of October 2020 | Category: Security | Comments are closed

UAM Futurama 3 parte 2 partial writeup: ROP contra servidor web sin LEAKS

Introducción

Primero de todo, este no es un write-up completo. Describiré mi exploit para lograr la flag en la segunda parte del reto de Futurama 3 de este mes de la UAM. Se considera el reversing del binario “carl” ya completado y las respectivas vulnerabilidades encontradas para provocar el Buffer Overflow.

[…]

tonicas | Wednesday, 22nd of April 2020 | Category: Code, Security | Comments are closed

Defeating an ELF32 binary with absolutely no leaks without using the ret2_dlresolve technique

The binary

I was presented with an ELF32 binary with the following protections:

ch77 protections

Disassembling the binary with r2, I quickly recognized a classic stack overflow by abusing the call to read:

There’s a buffer overflow in the read function.

tonicas | Monday, 1st of July 2019 | Category: analysis, Code, Security | Comments are closed
 
  Older Entries »