해킹대회(2)
-
[CTF write up] HITCON CTF 2023 qual - Full Chain - Wall Maria : VM escape on Qemu with Sandbox option enabled
#include "hw/hw.h" #include "hw/pci/msi.h" #include "hw/pci/pci.h" #include "qapi/visitor.h" #include "qemu/main-loop.h" #include "qemu/module.h" #include "qemu/osdep.h" #include "qom/object.h" #define TYPE_PCI_MARIA_DEVICE "maria" #define MARIA_MMIO_SIZE 0x10000 #define BUFF_SIZE 0x2000 typedef struct { PCIDevice pdev; struct { uint64_t src; uint8_t off; } state; char buff[BUFF_SIZE]; MemoryReg..
2023.09.12 -
[CTF write up] Just CTF 2023 - notabug2 : Exploitable Feature of sqlite3
굉장히 난이도 있고 Tricky한 문제였지만, 팀원들의 도움으로 풀 수 있었다. It was a very difficult and tricky challenge, but We were able to solve it with the help of my teammates. sqlite3 interactive 쉘을 열어주며, .system과 같은 dot 커맨드를 제한한다. Opens an sqlite3 interactive shell and restricts dot commands such as .system. select Load_extension('/lib/x86_64-linux-gnu/libc.so.6','puts'); sqlite3에는 위와 같이 Load_extension를 이용해서 외부 공유파일의 함..
2023.06.05