CTF(25)
-
[CTF] DEF CON CTF Qualifier 2024 - dotcom : Exploitinig Crash Handler
1. Overview2. Analysis3. Vulnerabilities 3-1. Uninitialized Memory 3-2. Stack Overflow4. Exploit5. Finish 1. Overview This challenge was a pwnable challenge presented at the DEF CON CTF Qualifier 2024. Thanks to my teammate quickly finding the vulnerability, I achieved the First Blood for this challenge during the competition. Generally, this problem is considered to be of an easier difficult..
2024.05.08 -
[CTF Write Up] ASIS CTF Final 2023 - isWebP.js : Exploiting QuickJS by Webp Vulnerability
1. Overview 2. CVE-2023-4863 3. Patch Analysis 3-1. libwebp.patch 3-2. quickjs.patch 3-2-1. Disable System Module 3-2-2. Add isWebP Function 4. Exploiting QuickJS 4-1. VP8LHuffmanTablesAllocate Analysis 4-2. Make OOB Read / Write Primitive by Heap Spraying 4-3. Hijack RIP 5. Finish Full Write Up https://velog.io/@0range1337/CTF-ASIS-CTF-Final-2023-isWebP.js-Exploiting-QuickJS-by-Webp-Vulnerabili..
2024.01.06 -
[CTF Write Up] m0lecon CTF final 2023 - kEASY : Cross-Cache UAF + Dirty Pagetable + Escaping nsjail
1. Overview 2. Vulnerabilty 3. Cross-Cache UAF 4. Dirty Pagetable 4-1. Dirty Pagetable VIA flie UAF 4-2. /dev/dma_heap/system 4-3. Arbitrary Physical Address Read / Write 5. Escaping nsjail 6. Finish Full Write Up https://velog.io/@0range1337/CTF-m0lecon-CTF-final-2023-kEASY-Cross-Cache-UAF-Dirty-Pagetable-Escaping-nsjail [CTF] m0lecon CTF final 2023 - kEASY : Cross-Cache UAF + Dirty Pagetable +..
2023.12.28 -
[CTF write up] BlackHat MEA CTF 2023 - JIT-8 : Exploit the CHIP-8 JIT Compiler
뭔가 복잡해보이지만, CHIP-8 시스템을 그대로 구현한 것이므로 거의 분석할 필요가 없다. https://en.wikipedia.org/wiki/CHIP-8 해당 Wikipedia에서 opcode와 동작을 알 수 있으며, IDA에서도 Symbol이 어느정도 남아 있어 분석 자체는 어렵지 않다. Although it seems pretty complicated, there is almost no need to analyze it since it is a direct implementation of the CHIP-8 system. https://en.wikipedia.org/wiki/CHIP-8 You can find out the opcode and operation in Wikipedia, and t..
2023.11.23 -
[CTF write up] N1CTF 2023 - n1proxy : Exploit UAF in Proxy Binary developed with RUST
https://github.com/Nu1LCTF/n1ctf-2023/blob/main/pwn/n1proxy/server/src/main.rs 문제 소스코드는 출제자의 Github에서 확인할 수 있다. 솔버가 1명 밖에 없는 문제였고, 대회 당시에 끝내지 못했지만, 굉장히 퀄리티가 높은 챌린지였기 때문에 대회 후에 마저 풀었다. You can check provided source code of challenge in author's github. It was a challenge with only one solver, and I couldn't finish it at the time of the competition, but it was a good challenge, so I finished it af..
2023.10.24 -
[CTF write up] HITCON CTF 2023 qual - Full Chain - Wall Maria : VM escape on Qemu with Sandbox option enabled
#include "hw/hw.h" #include "hw/pci/msi.h" #include "hw/pci/pci.h" #include "qapi/visitor.h" #include "qemu/main-loop.h" #include "qemu/module.h" #include "qemu/osdep.h" #include "qom/object.h" #define TYPE_PCI_MARIA_DEVICE "maria" #define MARIA_MMIO_SIZE 0x10000 #define BUFF_SIZE 0x2000 typedef struct { PCIDevice pdev; struct { uint64_t src; uint8_t off; } state; char buff[BUFF_SIZE]; MemoryReg..
2023.09.12