Monday, 5 March 2018

CTF notes

Notes on doing some CTFs:

How to setup Vbox:

Grab an ubuntu image from
user:  osboxes 

Inside your vmm, Install open ssh on your slave:
sudo apt-get install openssh-server

Open the right ports on host:
VBoxManage modifyvm asdf --natpf1 "ssh,tcp,,3022,,22"
ssh/sftp in:
ssh -p 3022 osboxes@
 sftp -P 3022 osboxes@

How to wget / curl:

curl url

wget posting data and saving/loading data to/from cookie

wget url --post-data="password=ee&user=hr" --save-cookies sc.txt
wget url --load-cookies=sc.txt

Also don't forget simple developer mode and google chrome.

Vulnerabilities check:

File Loading:

* Look for files that load other files or data
* Look for string replacing that can be bypassed


* Check for session state not being cleared properly.

File Execution:

* Check the execution path: Add things to the path.

Disassemble files:

* objdump -d  file > raw
* gdb file
  • r (run)
  • c (contine)
  • b X (breakpoint at function X)
  • si (step one place forwards)
  • info registers (what is in my registers

No comments:

Post a Comment