# hxp 2017 CTF
**sandb0x**
- There's gcc compile available with user.s assembly code.- only 80byte length is allowed.- Remote Binary is blind, and PIE and ASLR are on.- No way to 2round Exploitation to get shell except for launching shellcode.- And prctl is used for seccomp filter.- user.s can overwrite prctl call with `.global prctl;prctl:~~~`- So, I write shellcode on some stack, and jmp to that address
**dont_panic**
- check argv[1] length
```[----------------------------------registers-----------------------------------]RAX: 0x8RBX: 0x4fb090 --> 0x0RCX: 0x7fffffffe570 ("AAAABBBB")RDX: 0x4ab760 --> 0x47b8a0 (mov    rcx,QWORD PTR fs:0xfffffffffffffff8)RSI: 0x10RDI: 0x490e80 --> 0x10RBP: 0xc42003bf78 --> 0xc42003bfd0 --> 0x0RSP: 0xc42003be90 --> 0x0RIP: 0x47b90a (cmp    rax,0x2a)R8 : 0x208R9 : 0x0R10: 0xc420058170 --> 0x4a8976 ("syntax error scanning booleantoo many open files in systemtraceback has leftover defers locals stack map entries for 227373675443232059478759765625MHeap_AllocLocked - bad npagesSIGPROF: profiling alar"...)R11: 0xc420058170 --> 0x4a8976 ("syntax error scanning booleantoo many open files in systemtraceback has leftover defers locals stack map entries for 227373675443232059478759765625MHeap_AllocLocked - bad npagesSIGPROF: profiling alar"...)R12: 0x1R13: 0x18R14: 0x170R15: 0x200EFLAGS: 0x202 (carry parity adjust zero sign trap INTERRUPT direction overflow)[-------------------------------------code-------------------------------------]   0x47b8fc:	mov    QWORD PTR [rsp+0x50],rcx   0x47b901:	mov    rax,QWORD PTR [rax+0x18]   0x47b905:	mov    QWORD PTR [rsp+0x48],rax=> 0x47b90a:	cmp    rax,0x2a   0x47b90e:	jl     0x47ba23```
- 0x47ba23 is fail routine. Feature of Fail.- Find Success Routine- make script for automation ( check fail or success ) -> Brute force- success statement is here```loc_47B998:lea     rax, unk_4A8374mov     [rsp+0F0h+var_48], raxmov     [rsp+0F0h+var_40], 1Chmov     [rsp+0F0h+var_98], 0mov     [rsp+0F0h+var_90], 0lea     rax, unk_489D80```
- `unk_4a8374` : -> `Seems like you got a flag...`- This is final Success routine.- So, check `rip` if success address or not.- result
```root@ubuntu:/mnt/hgfs/shared/hxp/dont_panic# python solve.py[*] '/mnt/hgfs/shared/hxp/dont_panic/main_strip'    Arch:     amd64-64-little    RELRO:    No RELRO    Stack:    No canary found    NX:       NX enabled    PIE:      No PIE (0x400000)[+] Starting local process '/usr/bin/gdb': pid 4985find hAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxpAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{kAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3ePAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AAAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnAAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnDAAAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_AAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_DAAAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0AAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0nAAAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n'AAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n'tAAAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_AAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_PAAAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4AAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4nAAAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1AAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1cAAAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1c_AAAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1c__AAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1c__GAAAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1c__G0AAAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1c__G0_AAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1c__G0_iAAAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1c__G0_i5AAAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1c__G0_i5_AAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1c__G0_i5_SAAAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1c__G0_i5_S4AAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1c__G0_i5_S4FAAfind hxp{k3eP_C4lM_AnD_D0n't_P4n1c__G0_i5_S4F3Afind hxp{k3eP_C4lM_AnD_D0n't_P4n1c__G0_i5_S4F3}hxp{k3eP_C4lM_AnD_D0n't_P4n1c__G0_i5_S4F3}[*] Stopped process '/usr/bin/gdb' (pid 4985)```
**revenge_of_the_zwiebel**
- Flag : `hxp{1_5m3ll_l4zyn355}`- Anti-debug detection -> binary patch or dynamically set return value- There are so many Encrypted code chunk -> Need to Decrypt it- Need to make some automation script- Figure out flag's index and bit