STLDoctor

From aca639afe8c435f45ccc1864c42236252646fff9 Mon Sep 17 00:00:00 2001 From: Louis Burda Date: Tue, 15 Jun 2021 19:04:22 +0200 Subject: add service overview slides --- documentation/slides/.gitignore | 1 + documentation/slides/index.html | 699 +++++++++++++++++++++++++++++ documentation/slides/media/exploit-1-1.png | Bin 0 -> 16715 bytes documentation/slides/media/exploit-1-2.png | Bin 0 -> 26940 bytes documentation/slides/media/exploit-1-3.png | Bin 0 -> 52090 bytes documentation/slides/media/exploit-1-4.png | Bin 0 -> 70074 bytes documentation/slides/media/exploit-1-5.png | Bin 0 -> 71647 bytes documentation/slides/media/exploit-2-1.png | Bin 0 -> 46589 bytes documentation/slides/media/search.gif | Bin 0 -> 60562 bytes documentation/slides/media/socat.gif | Bin 0 -> 19413 bytes documentation/slides/slides.md | 184 ++++++++ documentation/slides/stldoctor.pdf | Bin 0 -> 579874 bytes 12 files changed, 884 insertions(+) create mode 100644 documentation/slides/.gitignore create mode 100644 documentation/slides/index.html create mode 100644 documentation/slides/media/exploit-1-1.png create mode 100644 documentation/slides/media/exploit-1-2.png create mode 100644 documentation/slides/media/exploit-1-3.png create mode 100644 documentation/slides/media/exploit-1-4.png create mode 100644 documentation/slides/media/exploit-1-5.png create mode 100644 documentation/slides/media/exploit-2-1.png create mode 100644 documentation/slides/media/search.gif create mode 100644 documentation/slides/media/socat.gif create mode 100644 documentation/slides/slides.md create mode 100644 documentation/slides/stldoctor.pdf (limited to 'documentation/slides') diff --git a/documentation/slides/.gitignore b/documentation/slides/.gitignore new file mode 100644 index 0000000..e4e7469 --- /dev/null +++ b/documentation/slides/.gitignore @@ -0,0 +1 @@ +slides diff --git a/documentation/slides/index.html b/documentation/slides/index.html new file mode 100644 index 0000000..cc0aa6a --- /dev/null +++ b/documentation/slides/index.html @@ -0,0 +1,699 @@ + + + + + + STLDoctor + + + + +

+ +

+ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/documentation/slides/media/exploit-1-1.png b/documentation/slides/media/exploit-1-1.png new file mode 100644 index 0000000..b251075 Binary files /dev/null and b/documentation/slides/media/exploit-1-1.png differ diff --git a/documentation/slides/media/exploit-1-2.png b/documentation/slides/media/exploit-1-2.png new file mode 100644 index 0000000..e63f7d0 Binary files /dev/null and b/documentation/slides/media/exploit-1-2.png differ diff --git a/documentation/slides/media/exploit-1-3.png b/documentation/slides/media/exploit-1-3.png new file mode 100644 index 0000000..4dc961d Binary files /dev/null and b/documentation/slides/media/exploit-1-3.png differ diff --git a/documentation/slides/media/exploit-1-4.png b/documentation/slides/media/exploit-1-4.png new file mode 100644 index 0000000..2d75f2f Binary files /dev/null and b/documentation/slides/media/exploit-1-4.png differ diff --git a/documentation/slides/media/exploit-1-5.png b/documentation/slides/media/exploit-1-5.png new file mode 100644 index 0000000..874529b Binary files /dev/null and b/documentation/slides/media/exploit-1-5.png differ diff --git a/documentation/slides/media/exploit-2-1.png b/documentation/slides/media/exploit-2-1.png new file mode 100644 index 0000000..91b0df7 Binary files /dev/null and b/documentation/slides/media/exploit-2-1.png differ diff --git a/documentation/slides/media/search.gif b/documentation/slides/media/search.gif new file mode 100644 index 0000000..de4ed18 Binary files /dev/null and b/documentation/slides/media/search.gif differ diff --git a/documentation/slides/media/socat.gif b/documentation/slides/media/socat.gif new file mode 100644 index 0000000..38f1e93 Binary files /dev/null and b/documentation/slides/media/socat.gif differ diff --git a/documentation/slides/slides.md b/documentation/slides/slides.md new file mode 100644 index 0000000..48e3447 --- /dev/null +++ b/documentation/slides/slides.md @@ -0,0 +1,184 @@ +title: STLDoctor +output: index.html +controls: false + +-- + + + +-- + +# STLDoctor 💉 + +-- + +### The Plan 💡 + + + + + + +- Plaintext service +- Interesting C bugs +- Exploit logic bugs, not RCE +- Learn about the STL format + +

+ +-- + +### Setup 🔧 + +- C binary that communicates via `stdin` and `stdout` +- Networking abstracted through hosting with `socat` +- File system backend with periodic clean up + +![socat](media/socat.gif) + +-- + +### Functionality 🎮 + + + + +- Users can upload and search for files +- Register to upload private files +- Uploaded files are analyzed and information is returned to the user + +--- + + + +![FileSearch](media/search.gif) + +-- + +### 1. Vuln 💉 + +- Flags are stored in the solidname of the STL +- Bug in upload info file parsing allows attacker to retrieve any public file + +-- + +### 2. Vuln 💉 + +- Flags are stored in the solidname of a private file +- Buffer overflow in hash function allows enumeration of private user hashes +- Generate preimages of weak hash function to login as users + +-- + +### Goals Met 🎉 + + + +⭐ Plaintext file inspection service
+⭐ Interesting and realisitic bugs
+⭐ Combine different gadgets for exploit
+⭐ Don't need to be an expert at fancy ROP
+⭐ No SLA lost in TestCTF
+⭐ Written in C + +-- + +### Issues 📉 + + + + + +💥 Exploits not directly related to STL format
+💥 (Eno)checker has memory leaks + +-- + +### Lesssons Learned + + + +- Many exploits are not suited for A/D ctfs +- How to write a FSM format parser +- Be careful with casts in C +- People just *love* C services 🤡 + +-- + +-- + +-- + +# Exploit 1 + +-- + +![exploit-1-1](media/exploit-1-1.png) + +-- + +![exploit-1-2](media/exploit-1-2.png) + +-- + +![exploit-1-3](media/exploit-1-3.png) + +-- + +![exploit-1-4](media/exploit-1-4.png) + +-- + +![exploit-1-5](media/exploit-1-5.png) + +-- + +# Exploit 2 + +-- + +![exploit-2-1](media/exploit-2-1.png) + + + + diff --git a/documentation/slides/stldoctor.pdf b/documentation/slides/stldoctor.pdf new file mode 100644 index 0000000..ddfe89b Binary files /dev/null and b/documentation/slides/stldoctor.pdf differ -- cgit v1.2.3-71-gd317