You have to wait a bit It does take some time to do what you want it to do.
Yeah it took me a while to come to terms with that. I feel I am close to a foothold now though. I just need to stop making syntax errors
I’m at the same spot. Initially I tried setting up a local server, but then found the python module easier to work with for sending, and a socket script for receiving. I’m able to get a response, and based on the clues inside am now trying to send something that will trigger a command.
Gadgets are there. Some are hidden. Ropper will show them. A working exploit then has to be converted… Succes
That is good to know. At the moment I am stuck trying to think ahead and work out what I want to do once I’ve worked out how to exploit the binary fully. Finding an executable “victim” to run it on is defeating me. My current assumption is that it is going to be related to something running on ****.
Gadgets are there. Some are hidden. Ropper will show them. A working exploit then has to be converted… Succes
That is good to know. At the moment I am stuck trying to think ahead and work out what I want to do once I’ve worked out how to exploit the binary fully. Finding an executable “victim” to run it on is defeating me. My current assumption is that it is going to be related to something running on ****.
Ok, i’ve already spent more than 10 days onto this behemoth…getting user’s flag has been a gigantic learning experience (thanks also to @TazWake) , but i have to admit that root is out of my reach for now.
If anyone wants to give me one or more nudges, it’ll be more than welcome. for now the only thing that i can say is that maybe i have understood what to do, but i am almost completely illiterate onto this branch of exploitation…
Ok, i’ve already spent more than 10 days onto this behemoth…getting user’s flag has been a gigantic learning experience (thanks also to @TazWake) , but i have to admit that root is out of my reach for now.
If anyone wants to give me one or more nudges, it’ll be more than welcome. for now the only thing that i can say is that maybe i have understood what to do, but i am almost completely illiterate onto this branch of exploitation…
Pretty much in the same boat. I have an idea of what the attack needs to be, I just cant seem to get it to work. I took me days to get control of the registers, let alone turning that into anything useful.
(embarrassingly it took me a few hours realise I was analysing it on the wrong platform at first…)
Pretty much in the same boat. I have an idea of what the attack needs to be, I just cant seem to get it to work. I took me days to get control of the registers, let alone turning that into anything useful.
(embarrassingly it took me a few hours realise I was analysing it on the wrong platform at first…)
Same here. User was hard and I learned a lot, but I’m very stuck on the binary. Seems like it is meant to be a B*F attack, but looking at the dump of objects it doesn’t seem to do anything with the arguments it is given apart from counting them. Good point about the platform though, I assume that is why g** is installed on the box.
Same here. User was hard and I learned a lot, but I’m very stuck on the binary. Seems like it is meant to be a B*F attack, but looking at the dump of objects it doesn’t seem to do anything with the arguments it is given apart from counting them.
Tiny bit of progress on that, depending on your input you can get a slightly different response. I have a plan of what I want to do but I haven’t worked out how to weaponise this yet though!
Good point about the platform though, I assume that is why g** is installed on the box.
gdb comes included with OpenBSD, its pre-installed, but I suggest to just install openbsd locally and try. I think using vanilla gdb will be pretty hard. There is B*F there and you can change the flow, but its a bit hard as this binary is messing with you.
Pretty much in the same boat. I have an idea of what the attack needs to be, I just cant seem to get it to work. I took me days to get control of the registers, let alone turning that into anything useful.
(embarrassingly it took me a few hours realise I was analysing it on the wrong platform at first…)
Same here. User was hard and I learned a lot, but I’m very stuck on the binary. Seems like it is meant to be a B*F attack, but looking at the dump of objects it doesn’t seem to do anything with the arguments it is given apart from counting them. Good point about the platform though, I assume that is why g** is installed on the box.
What really hurts me (and make me feel ashamed), is my pathetic lack of coding skills that puts me definitely in the corner despite being “in sight” of the goal…
Ok, i’ve already spent more than 10 days onto this behemoth…getting user’s flag has been a gigantic learning experience (thanks also to @TazWake) , but i have to admit that root is out of my reach for now.
If anyone wants to give me one or more nudges, it’ll be more than welcome. for now the only thing that i can say is that maybe i have understood what to do, but i am almost completely illiterate onto this branch of exploitation…
Pretty much in the same boat. I have an idea of what the attack needs to be, I just cant seem to get it to work. I took me days to get control of the registers, let alone turning that into anything useful.
(embarrassingly it took me a few hours realise I was analysing it on the wrong platform at first…)
Yeah, LOL.
What if i tell you that I was doing it on the right VM but i discovered after MANY HOURS that the reason why i was getting no responses at all was that i was tunnelling it to the wrong ip?