<commit_before>---
layout: post
title: openCTF 2016 - apprentice_cgc
category: [Exploitation]
tags: [Exploitation, openCTF]
comments: true
---

**Points:** 300
**Solves:** 
**Category:** Exploitation, CRS
**Description:** So, neophyte_cgc was pretty straightforward.
This isn't.
Server: 172.31.1.47:1624

> [apprentice_cgc]({{site.url}}/assets/apprentice_cgc)

Statically compiled, stripped binary this challenge was about Automatic Exploit Generation (AEG). The server sends us a binary with two different passwords on every run. We have to send the correct passwords in order to reach the vulnerable function.

![vuln]({{site.url}}/assets/screen-openctf-3.png)

The `vulnerable` function had a classic stack overflow with no canaries, NX disabled and ASLR disabled.

![vuln2]({{site.url}}/assets/screen-openctf-4.png)

The local stack size of the vulnerable function was also different on each run.

# Ghetto Solution

Solution steps:  

1. Connect to the server and get the binary
2. Drop the binary on disk and analyze it with objdump, storing the output in a variable
3. Since the 2 password strings were exactly 32 bytes each and lowercase alphanum chars I used strings to find them
4. Used the objdump output to find the size of the `vulnerable` function
5. Send the payload and get the flag

{% highlight python %}
#!/usr/bin/env python

from pwn import *
import sys, re

# flag itoldyou__IT_WOULD_GET_W0rse_imnotangrybro

def filterPick(list,filter):
    return [ ( l, m.group(1) ) for l in list for m in (filter(l),) if m]


def exploit(r):
  if len(sys.argv) > 1:   # if remote get the binary and store on disk
    r.recvuntil("Apprentice CRS - (Cyber Reasoning System)\n")
    binary = r.recvuntil('Can you exploit me in under 10 seconds?\n')

    ofile = open('apprentice_cgc_drop', 'wb')<commit_msg>openctf apprentice-cgc 300<commit_after>---
layout: post
title: openCTF 2016 - apprentice_cgc
category: [Exploitation]
tags: [Exploitation, openCTF]
comments: true
---

**Points:** 300
**Solves:** 
**Category:** Exploitation, CRS
**Description:** So, neophyte_cgc was pretty straightforward.
This isn't.
Server: 172.31.1.47:1624

> [apprentice_cgc]({{site.url}}/assets/apprentice_cgc)

Statically compiled, stripped binary this challenge was about Automatic Exploit Generation (AEG). The server sends us a binary with two different passwords on every run. We have to send the correct passwords in order to reach the vulnerable function.

![vuln]({{site.url}}/assets/screen-openctf-3.png)

The `vulnerable` function had a classic stack overflow with no canaries, NX disabled and ASLR disabled.

![vuln2]({{site.url}}/assets/screen-openctf-4.png)

The local stack size of the vulnerable function was also different on each run.

# Ghetto Solution

Solution steps:  

1. Connect to the server and get the binary
2. Drop the binary on disk and analyze it with objdump, storing the output in a variable
3. Since the 2 password strings were exactly 32 bytes each and lowercase alphanum chars I used strings to find them
4. Used the objdump output to find the size of the stack frame of the `vulnerable` function
5. Send the payload and get the flag

{% highlight python %}
#!/usr/bin/env python

from pwn import *
import sys, re

# flag itoldyou__IT_WOULD_GET_W0rse_imnotangrybro

def filterPick(list,filter):
    return [ ( l, m.group(1) ) for l in list for m in (filter(l),) if m]


def exploit(r):
  if len(sys.argv) > 1:   # if remote get the binary and store on disk
    r.recvuntil("Apprentice CRS - (Cyber Reasoning System)\n")
    binary = r.recvuntil('Can you exploit me in under 10 seconds?\n')

    ofile = open('apprentice_cgc_drop', 'wb')
{'fraction_non_alphanumeric': 0.09650082012028431, 'fraction_numerical': 0.019956260251503554, 'mean_word_length': 4.412721893491124, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6428391', 'n_tokens_mistral': 1239, 'n_tokens_neox': 1138, 'n_words': 469}