[pwn] You know 0xDiablos

Spoiler Removed

It says on my machine “H*** u* a** t**…” but if I try it on the server it doesn’t work. Is there anything else I have to take care of?

Try to check if it actually works, create a f…g.t.t file localy and see if you can read the content of this file, if you are unable to read the content, investigate why, something dead simple is missing

Oh god, thank you. Didn’t think of checking that.

Try to check if it actually works, create a f…g.t.t file localy and see if you can read the content of this file, if you are unable to read the content, investigate why, something dead simple is missing

Didn’t understand what you said. I can connect to the server via t…n.t but when I type something the host closes the connection.

Thanks

Type your comment> @Ismael034 said:

Try to check if it actually works, create a f…g.t.t file localy and see if you can read the content of this file, if you are unable to read the content, investigate why, something dead simple is missing

Didn’t understand what you said. I can connect to the server via t…n.t but when I type something the host closes the connection.

Thanks

Wdym by t…n.t? I am a noob to this stuff. Any sort of help would be appreciated.

Type your comment> @Ismael034 said:

Try to check if it actually works, create a f…g.t.t file localy and see if you can read the content of this file, if you are unable to read the content, investigate why, something dead simple is missing

Didn’t understand what you said. I can connect to the server via t…n.t but when I type something the host closes the connection.

Thanks

Trying to connect using ssh admin@ip or ssh root@ip doesnt work

@Ismael034 said:

Try to check if it actually works, create a f…g.t.t file localy and see if you can read the content of this file, if you are unable to read the content, investigate why, something dead simple is missing

Didn’t understand what you said. I can connect to the server via t…n.t but when I type something the host closes the connection.

Thanks

netc* ip <port-port> echoes "You know who are 0xD… ", waits for the input and returns the same input. Not sure if I am on the right path

@IR0nIVI4n said:

@Ismael034 said:

Try to check if it actually works, create a f…g.t.t file localy and see if you can read the content of this file, if you are unable to read the content, investigate why, something dead simple is missing

Didn’t understand what you said. I can connect to the server via t…n.t but when I type something the host closes the connection.

Thanks

netc* ip <port-port> echoes "You know who are 0xD… ", waits for the input and returns the same input. Not sure if I am on the right path

Me too, I meant telnet, but i am also stuck in there. Anyone can gives us a clue?

@yota5 said:

Hints

  1. find 1st function
  2. bof it
  3. find 2nd function + args

Thank you. What’s a function in this context? You are trying to run a function on server side? And what exactly do you mean by ‘bof it’?

Can you post a link to some good tutorials on bof-ing?

I see both functions in g**ra and I love how params form words in hex :), but I don’t know the basics I guess, as payload I’m creating does nothing.
Shall I just fill the whole 384 reserved bytes and put params and f
ag function adrress just after it? Or maybe if I just put any string delimiter and some sort of JMP or call just after?

I’m stuck here as well. I created a payload that overrides ESP with the function I want to jump to address and got this when running locally:

“Hurry up and try in on server side.”

When I tried it on the instance, it just disconnects. am I missing something silly here?

Type your comment> @lamorim said:

I’m stuck here as well. I created a payload that overrides ESP with the function I want to jump to address and got this when running locally:

“Hurry up and try in on server side.”

When I tried it on the instance, it just disconnects. am I missing something silly here?

Same here. In addition, if I create the file on my machine and run the exploit again + arguments it crashes with one of the arguments as EIP. I don’t really know how to interpret this.

Whoohoo, this was a nice one! Strange though that it is rated so easy. It took me considerable effort to solve it.

kinda confused because both the printf and puts are returning absolutely no output for some reason :confused:
EDIT: just had to solve it in a probably convoluted and unintended way, but many roads lead to shellcode 8)

Anyone able to get shell via shellcode or rop system(/bin/sh) ?

Did this yesterday, its pretty easy as there is not dynamic addresses or other protections involved.

Type your comment> @laser07 said:

Can you post a link to some good tutorials on bof-ing?

I see both functions in g**ra and I love how params form words in hex :), but I don’t know the basics I guess, as payload I’m creating does nothing.
Shall I just fill the whole 384 reserved bytes and put params and f
ag function adrress just after it? Or maybe if I just put any string delimiter and some sort of JMP or call just after?

dont know where u got that number but its not correct. find the correct number and how does the stack works and u will solve it.

Just solved this problem. Had the right answer for a while but nc was the thing that was throwing me off. As a tip, if you connect with nc, make sure you hang around long enough to get a response from the server. :wink:

I think i have the correct payload but i just can not get it to work. If anybody would be willing to discuss my idea/sample and nudge me into the right direction it would be very much appreciated.

Hi there.
Any resources to start learning pwning? Or any resources to start learning hiw to solve challenges? It is easier for me to solve machines than challenges. Any info is appreciated.

1 Like