The Gomium Browser - Exploits

In my last blog post, I described The Gomium Browser, a pwn challenge of the Google CTF 2019 finals that 4 teams (pasten, 5BC, p4, A*0*E) solved.

The challenge was framed as a command-line browser, but basically boiled down to answering this question: if you control Go source code but can only import the fmt package, can you get enough code execution to execute xcalc?

In this blog post let's look at some of the exploits that teams came up with, either during the CTF or after.

The Gomium Browser - Google CTF 2019 finals challenge

Last weekend were the Google CTF 2019 finals in London with 10 invited teams, part of a larger event named ESCAL8 with VRP researchers (BugSWAT), students (init.g), etc.

I wrote a CTF challenge for the event: The Gomium Browser. Out of 10 teams 4 teams solved it (pasten, 5BC, p4, A*0*E) and a 5th team (Balsn) was really close, unfortunately their exploit was unreliable.

In this blog post I won't spoil too much and just introduce the challenge, if you'd like to try it yourself. Then in another post, I'll explain what it was all about, present my exploit and links to some of the other teams write-ups. There were some really interesting ones.

Defcon 21 quals - blackbox write-up

It was DEFCON 21 quals last week-end, with new organizers. It went well, good organization and good challenges. If you're curious about the results, here is a fancy top15 graph. Apparently it was too easy for PPP who finished all of the challenges... insane! :)

There were 5 categories:

• 3dub: web-based challenges
• 0x41414141: exploitation
• \xff\xe4\xcc: shellcode
• OMGACM: guerilla programming
• gnireenigne: reverse engineering

I liked the exploitation ones with ARM under Linux/FreeBSD. Reverse was nice, shellcoding interesting but some painful, web was way too easy and OMGACM just annoying.
If you want to have a look, @JonathanSalwan saved some of the binaries on his repo.

Ghost in the Shellcode 2012 Teaser - Hackquest

Again this year was ShmooCon's Ghost in the Shellcode warm-up round or Teaser (@ShellGhostCode). Congrats to Eindbazen for winning!

There was three challenges: crypto (Tel Aviv), crackme (AL's revenge) and exploitation (Hackquest). You will notice strong references to Hackers (1995) movie. Write-ups can be found on FixMe wiki, Leet More blog or Eindbazen blog.

Hack in the Box Amsterdam 2011 CTF

May 19th-20th was Hack in the Box Amsterdam 2011 security conference in the Netherlands, also holding a CTF. To participate, you had to qualify to one of the two qualification rounds that involved web security and reverse engineering.

We passed qualifications with team CoP so I went there with teammate sh4ka to play, and we were lucky enough to end in the first place. Congrats to all teams, it was intense! In addition to a nice HITBSecNews jacket, staff generously awarded us two training and conference tickets to HITB Kuala-Lumpur (Malaysia) 2011. So, see you there :)

final scoreboard

pCTF 2011 #18 A small bug

Challenge #18 "A small bug" was a common TOCCTOU bug very interesting to exploit reliably.

@hellman already did a write-up on this challenge. His exploit reads the file name on stderr and hopes to win the race on symlink creation. But actually there is a way to win the race every time! Let's see that.

pCTF 2011 #19 Another small bug

Challenge #19 "Another small bug" was a stack-based buffer overflow.

Djo (@shell_storm) has already published a write-up (english) on Nibbles' blog, as well as @hellman on Leet More's blog, and Agix (@Agixid) on shell-storm. Just like hashcalc1 or hashcalc2, there was no NX. However, ASLR was enabled. Djo and hellman both used a big nopsled + brute-force to circumvent ASLR, Agix used a nice ret2ret, while I chose ROP to mmap rwx. Good thing is that it would also have worked if NX had been effectively enabled.

Not familiar with ROP? Have a look at the references posted on this exploit writing tutorial by @corelanc0d3r.

pCTF 2011 #26 Hashcalc2

Challenge #26 "Hashcalc2" was very similar to Hashcalc1.

Again, a good write-up is already available on sleepya's blog. He made an exploit bypassing any ASLR/NX using ROP.

Again since NX was not enabled, I used a similar exploitation with a few adjustements.

pCTF 2011 #22 Hashcalc1

Challenge #22 "Hashcalc 1" was binary exploitation over the network.

A good write-up is already available on sleepya's blog. He made an exploit bypassing any ASLR/NX using ROP.

However, NX was not enabled on the wargame machine... Organizers thought they did, but it was not effective :( Good for us it means only ASLR, and the binary was not even PIE. One could exploit it quickly by writing a shellcode in the GOT, let's see that.

Plaid Parliament of Pwning CTF 2011

As @dinodaizovi nicely put on twitter, CTF team Plaid Parliament of Pwning have gone from winning everyone else's CTFs to hosting their own, namely the plaid CTF or pCTF (@pctf2011). It was 48 hours of intense challenge-based CTF like Defcon quals.

I expected a lot of fun challenges for this CTF because PPPs are highly skilled in areas such as binary exploitation. And I wasn't disappointed! Expect a few write-ups from me in the following posts :)

As you can see on the final scoreboard, more than 400 teams registered and 155 teams scored points. Since I no longer play with Nibbles guys, this time I played with a new team called CoP. We got the 2nd place, 1st place being taken at the last moment by our CTF friends HFS (Hacking for Soju). Good game, it was intense!

Congratulations to everyone for playing, and especially to PPP members who made this CTF possible. Very good challenges, organization, and IRC presence for support. You pwn guys!

If you want to have a look at the challenges, I mirrored them here (except remote/web of course), along with screenshots of problems, scoreboard, etc.

Honeynet Project Public Conference

Last week was held the first-ever Honeynet project public conference in Paris at ESIEA. Great speakers, interesting conferences (slides online, CV+O notes) and nice people to meet at the social event.

During the conferences was also a small capture-the-flag (CTF) competition, which I played. It was composed of 8 challenges by Mark Schloesser and Felix Leder, including a forensic one by Guillaume Arcas. This is how the challenge board looked:

ShmooCon CTF Warmup Contest - JavaScrimpd

Last week-end was ShmooCon CTF Warmup Contest (aka Ghost in the Shellcode 2011). Three challenges, the last one being an ELF binary + hostname of a server.

Congrats to awesie/zoaedk & tylerni7 of team PPP for solving it pretty quickly. And since they explained the level pretty well, I really invite you to read their solution.

Some news...

Recently I've been playing with gdb 7.2 and python. It extends what we can have with a great .gdbinit such as gdbinit73. As examples, read the following articles presenting some of the features, or just browse the Python API offered by gdb. A good introduction to gdb and python is also this article by sha on Nibbles blog (english here).

Last week-end were given nice challenges to win a ticket for ShmooCon security conference later this month. Congrats to awesie/zoaedk & tylerni7 of team PPP for solving #3 (see their writeup), a cool network binary involving JS code, a stack-based buffer overflow and some memory leak. I wasn't fast nor good enough but learned a lot!

Speaking of which, get ready for Paradox Conference this week-end in Korea: they provide an online CTF contest, should be challenge-based like defcon quals.
Update: this week-end there is also Wargame SbD I organized by our spanish friends at Security by Default (SbD). Unlike Padocon, there is a nice prize (amazon gift card which is worth an iPad). Thanks @aramosf for reminding me.

Realized again Ubuntu security features. Ptrace scope for instance, protects against same-user ptraces to peek into another process memory.

Made a very small idadif.py to patch a binary from a DIF file produced by IDA. Did not find any better method to do that :/

Also, 27c3 was great. And I love Berlin :)

Last but not least, hacky new year!

Hack.lu CTF - Challenge 19 "magicwall" writeup, double strcpy

I did not solve challenge 19 "magicwall" during the CTF - my friend Ivanlef0u (@Ivanlef0u) did - but since Fluxfingers (@fluxfingers) kept the CTF online, I had the chance to pwn it too! Just like challenge 20 "sscat", it was binary exploitation.

Hellman (@hellman1908) already made a very good writeup, I just wanted to share my different method.

Hack.lu CTF - Challenge 9 "bottle" writeup, extracting data from an iodine DNS tunnel

Challenge #9 entitled "bottle" was original and worth its 500 points. We were given the following network capture and instructed to find a message.

Opening the capture in Wireshark reveals a lot of DNS traffic (and 4 ARP requests): it definitely looks like a DNS tunnel.

Hack.lu CTF - sscat writeup

Last week was hack.lu 2010 security conference as well a high quality CTF organized by fluxfingers CTF team. Again I played with Nibbles and we ended 2nd as you can see on the final scoreboard and my usual graphs (made possible thanks to fluxfingers).

Challenge 20 was a very nice exploitation level. We were given an SSH with a setuid binary called sscat (standing for Serious Substition Cipher Analysis Tool) - with source. We had to exploit the program in order to read the flag file.

CSAW CTF - Forensics Write-up

The forensics challenge given at CSAW CTF weren't exactly what I was expecting, but still we achieved to solve most of it. Here are my write-ups for the 4 challenges.

Challenges were made by Efstratios Gavas (@xtrat), Director of cyber security labs at NYU Poly! Awesome :)

CSAW Exploit 3 Write-up - FreeBSD local root

For exploit3, we were given the following instructions:

Get Root. Get the key. If only I can jump over the mountain without being normal
ssh://128.238.66.100:40010
chal3:$+1zX*(
2048 51:41:94:32:cf:b1:3f:d9:74:c1:d2:08:aa:e3:49:2b /etc/ssh/ssh_host_rsa_key.pub (RSA)
1024 22:7f:72:93:93:7e:9a:3d:01:b9:58:ea:74:1a:c5:af /etc/ssh/ssh_host_dsa_key.pub (DSA)

Vulnerable FreeBSD kernel

We ssh and notice an old FreeBSD kernel. We can try to use @kingcope's freebsd sendfile cache local root. Sadly it does not work out of the box because we do not have /tmp writable: we have to customize a bit the shellcode to use a different one. Also, we can remove the 64-bit part since we are on 32-bit.

CSAW Exploit 1 Write-up - FreeBSD remote stack based buffer overflow

A few weeks ago was held Leet More CTF where Nibbles ended 1st! Didn't have the time to put some write-ups, but you can find some on nibbles blog or by sh4ka, auntitled and hellman.

Last week-end was held the well-known CSAW CTF (quals) by NYU-Poly. Last year and this year winners are none but our awesome friends PPP! We took 2nd place just behind them, see top15 graph.

They gave us interesting exploit challenges and I had the opportunity to look at exploit1: a remote stack based buffer overflow under FreeBSD 8.0.

smpCTF challenge #5 write-up - Forensic

smpCTF challenge #5 was forensics: we were given the file forensic1-image and instructed to find a flag.

As usual, we start our analysis with file command:

$ file forensic1-image
forensic1-image: rzip compressed data - version 2.1 (15185973 bytes)