Ctf on nobe4

Shellcode for/by a Newbie

Sat, 02 Sep 2017 00:00:00 +0000

I wrote this blog post with a simple goal in mind: I never took the time to understand fully how a shellcode worked. I know about it, I know that it works, but I don’t know how. So I made myself write this in order to finally grasp its logic. Ready? Let’s dig in!

For this article I’m using a Ubuntu Trusty 32bits (with Vagrant).

The wrapper

In order to execute a shellcode, we’re going to use a simple wrapper, written in C. Later in the blog post, I’ll assume that only shellcode changes, so I’ll only reference it.

/dev/random: Pipe

Wed, 19 Oct 2016 00:00:00 +0000

Writeup by npny and nobe4.

Firstly, we run nmap against the website, to discover that (among others), the ports 80 and 22 are open.

SSH doesn’t yield any results, and we try, without luck, a possible exploit against the used version.

HTTP is a lot more interesting:

An HTTP password is asked when trying to access the main page. After a few random try on the different HTTP verbs we try to access the default index.php file, which seems to have the same security. But, making a POST request on the file returned a valid HTML page. Nice!