CTF notes

Notes on doing some CTFs:

How to setup Vbox:

Grab an ubuntu image from osboxes.org

user:  osboxes 

pass:  osboxes.org

Inside your vmm, Install open ssh on your slave:

sudo apt-get install openssh-server




Open the right ports on host:

VBoxManage modifyvm asdf --natpf1 "ssh,tcp,,3022,,22"

ssh/sftp in:

ssh -p 3022 osboxes@127.0.0.1

 sftp -P 3022 osboxes@127.0.0.1

How to wget / curl:

curl url

wget posting data and saving/loading data to/from cookie

wget url --post-data="password=ee&user=hr" --save-cookies sc.txt
wget url --load-cookies=sc.txt

Also don't forget simple developer mode and google chrome.

Vulnerabilities check:

File Loading:

* Look for files that load other files or data
* Look for string replacing that can be bypassed

Login:

* Check for session state not being cleared properly.

File Execution:

* Check the execution path: Add things to the path.

Disassemble files:

* objdump -d  file > raw

* gdb file

r (run)
c (contine)
b X (breakpoint at function X)
si (step one place forwards)
info registers (what is in my registers