From 6a321759f6f75e7e14a29fde7cd0fa359d14215e Mon Sep 17 00:00:00 2001 From: Louis Burda Date: Wed, 21 Jul 2021 19:37:15 +0200 Subject: final tweaks to documentations, added intro and final presentation slides --- documentation/README.md | 44 +- documentation/slides-final/.gitignore | 1 + documentation/slides-final/index.html | 768 +++++++++++++++++++++ documentation/slides-final/media/dirlist.png | Bin 0 -> 2322 bytes .../slides-final/media/enowars5-timeout.png | Bin 0 -> 202709 bytes documentation/slides-final/media/enowars5.png | Bin 0 -> 22214 bytes documentation/slides-final/media/exploit-1-1.png | Bin 0 -> 16715 bytes documentation/slides-final/media/exploit-1-2.png | Bin 0 -> 26940 bytes documentation/slides-final/media/exploit-1-3.png | Bin 0 -> 52090 bytes documentation/slides-final/media/exploit-1-4.png | Bin 0 -> 70074 bytes documentation/slides-final/media/exploit-1-5.png | Bin 0 -> 71647 bytes documentation/slides-final/media/exploit-2-1.png | Bin 0 -> 46589 bytes documentation/slides-final/media/getdirentries.png | Bin 0 -> 135007 bytes .../slides-final/media/player-meme-hashfunc.png | Bin 0 -> 221940 bytes .../slides-final/media/player-meme-struggling.png | Bin 0 -> 99623 bytes documentation/slides-final/media/readdir.png | Bin 0 -> 119892 bytes documentation/slides-final/media/readdir_more.png | Bin 0 -> 124526 bytes documentation/slides-final/media/search.gif | Bin 0 -> 60562 bytes documentation/slides-final/media/socat.gif | Bin 0 -> 19413 bytes documentation/slides-final/media/stl1.png | Bin 0 -> 17519 bytes documentation/slides-final/media/stl2.png | Bin 0 -> 19783 bytes documentation/slides-final/media/stl3.png | Bin 0 -> 16751 bytes documentation/slides-final/media/stldoc.png | Bin 0 -> 114257 bytes documentation/slides-final/media/stldoc_dead.png | Bin 0 -> 686794 bytes .../slides-final/media/stldoc_dead_offline.png | Bin 0 -> 142293 bytes .../slides-final/media/stldoc_dead_r17.png | Bin 0 -> 148922 bytes .../slides-final/media/stldoc_dead_r432.png | Bin 0 -> 267521 bytes .../slides-final/media/stldoc_dead_r469.png | Bin 0 -> 250294 bytes documentation/slides-final/slides.md | 253 +++++++ documentation/slides-final/stldoctor.pdf | Bin 0 -> 2073788 bytes documentation/slides-intro/.gitignore | 1 + documentation/slides-intro/index.html | 699 +++++++++++++++++++ documentation/slides-intro/media/exploit-1-1.png | Bin 0 -> 16715 bytes documentation/slides-intro/media/exploit-1-2.png | Bin 0 -> 26940 bytes documentation/slides-intro/media/exploit-1-3.png | Bin 0 -> 52090 bytes documentation/slides-intro/media/exploit-1-4.png | Bin 0 -> 70074 bytes documentation/slides-intro/media/exploit-1-5.png | Bin 0 -> 71647 bytes documentation/slides-intro/media/exploit-2-1.png | Bin 0 -> 46589 bytes documentation/slides-intro/media/search.gif | Bin 0 -> 60562 bytes documentation/slides-intro/media/socat.gif | Bin 0 -> 19413 bytes documentation/slides-intro/slides.md | 184 +++++ documentation/slides-intro/stldoctor.pdf | Bin 0 -> 579874 bytes documentation/slides/.gitignore | 1 - documentation/slides/index.html | 699 ------------------- documentation/slides/media/exploit-1-1.png | Bin 16715 -> 0 bytes documentation/slides/media/exploit-1-2.png | Bin 26940 -> 0 bytes documentation/slides/media/exploit-1-3.png | Bin 52090 -> 0 bytes documentation/slides/media/exploit-1-4.png | Bin 70074 -> 0 bytes documentation/slides/media/exploit-1-5.png | Bin 71647 -> 0 bytes documentation/slides/media/exploit-2-1.png | Bin 46589 -> 0 bytes documentation/slides/media/search.gif | Bin 60562 -> 0 bytes documentation/slides/media/socat.gif | Bin 19413 -> 0 bytes documentation/slides/slides.md | 184 ----- documentation/slides/stldoctor.pdf | Bin 579874 -> 0 bytes 54 files changed, 1929 insertions(+), 905 deletions(-) create mode 100644 documentation/slides-final/.gitignore create mode 100644 documentation/slides-final/index.html create mode 100644 documentation/slides-final/media/dirlist.png create mode 100644 documentation/slides-final/media/enowars5-timeout.png create mode 100644 documentation/slides-final/media/enowars5.png create mode 100644 documentation/slides-final/media/exploit-1-1.png create mode 100644 documentation/slides-final/media/exploit-1-2.png create mode 100644 documentation/slides-final/media/exploit-1-3.png create mode 100644 documentation/slides-final/media/exploit-1-4.png create mode 100644 documentation/slides-final/media/exploit-1-5.png create mode 100644 documentation/slides-final/media/exploit-2-1.png create mode 100644 documentation/slides-final/media/getdirentries.png create mode 100644 documentation/slides-final/media/player-meme-hashfunc.png create mode 100644 documentation/slides-final/media/player-meme-struggling.png create mode 100644 documentation/slides-final/media/readdir.png create mode 100644 documentation/slides-final/media/readdir_more.png create mode 100644 documentation/slides-final/media/search.gif create mode 100644 documentation/slides-final/media/socat.gif create mode 100644 documentation/slides-final/media/stl1.png create mode 100644 documentation/slides-final/media/stl2.png create mode 100644 documentation/slides-final/media/stl3.png create mode 100644 documentation/slides-final/media/stldoc.png create mode 100644 documentation/slides-final/media/stldoc_dead.png create mode 100644 documentation/slides-final/media/stldoc_dead_offline.png create mode 100644 documentation/slides-final/media/stldoc_dead_r17.png create mode 100644 documentation/slides-final/media/stldoc_dead_r432.png create mode 100644 documentation/slides-final/media/stldoc_dead_r469.png create mode 100644 documentation/slides-final/slides.md create mode 100644 documentation/slides-final/stldoctor.pdf create mode 100644 documentation/slides-intro/.gitignore create mode 100644 documentation/slides-intro/index.html create mode 100644 documentation/slides-intro/media/exploit-1-1.png create mode 100644 documentation/slides-intro/media/exploit-1-2.png create mode 100644 documentation/slides-intro/media/exploit-1-3.png create mode 100644 documentation/slides-intro/media/exploit-1-4.png create mode 100644 documentation/slides-intro/media/exploit-1-5.png create mode 100644 documentation/slides-intro/media/exploit-2-1.png create mode 100644 documentation/slides-intro/media/search.gif create mode 100644 documentation/slides-intro/media/socat.gif create mode 100644 documentation/slides-intro/slides.md create mode 100644 documentation/slides-intro/stldoctor.pdf delete mode 100644 documentation/slides/.gitignore delete mode 100644 documentation/slides/index.html delete mode 100644 documentation/slides/media/exploit-1-1.png delete mode 100644 documentation/slides/media/exploit-1-2.png delete mode 100644 documentation/slides/media/exploit-1-3.png delete mode 100644 documentation/slides/media/exploit-1-4.png delete mode 100644 documentation/slides/media/exploit-1-5.png delete mode 100644 documentation/slides/media/exploit-2-1.png delete mode 100644 documentation/slides/media/search.gif delete mode 100644 documentation/slides/media/socat.gif delete mode 100644 documentation/slides/slides.md delete mode 100644 documentation/slides/stldoctor.pdf (limited to 'documentation') diff --git a/documentation/README.md b/documentation/README.md index f507ecc..b664fc0 100644 --- a/documentation/README.md +++ b/documentation/README.md @@ -19,20 +19,21 @@ allows users to search for public models via model name. Registered user's uploads are saved to a private directory. This (theoretically) prevents other users from accessing their files. -The service is hosted with socat, one process per client. +The service is hosted with ncat, one process per client. -Models are periodically cleaned up using files *last modified* date. +Models are periodically checked for removal via their *last modified* date +and tracked using index files. For both flagstores the **service returns the flag in plaintext**, which is -vulnerable to detection by network filters and can lead to easy replication -of exploits. +vulnerable to detection by network filters. However, multiple sessions can be +used to somewhat obfuscate the exploit mechanism. RCE Countermeasures =================== It is good practice to take preventitive measures against unintentional RCE, -which can be used to cause havoc on vulnboxes and make services go mumble. +which can be used to wreak havoc on vulnboxes and make services go mumble. For this reason, additional security features are enabled via compilation flags: @@ -98,19 +99,20 @@ freadstr(FILE *f, char **dst) To determine whether the end-of-file was reached, the return value of `int fgetc(FILE *f)` is compared to the constant `EOF`, which has a value of `-1`. -The problem lies in the fact, that this comparison is done following a demotion -of the return value to `char` through the assignment and a subsequent promotion -to `int`, which results in an arithmetic extension. As a result, reading the -value char `0xff` would promote it to `0xffffffff` with a value of `-1`, -preventing the function from reading the complete string. +The problem lies in the fact that this comparison is done following a demotion +of the return value to `char` through the assignment, and a subsequent promotion +to `int`, which results in an arithmetic extension. As a result, a char with +unsigned value `255` is cast to char (`0xff`) and then promoted to `-1` +(`0xffffffff`). Since this value corresponds with `EOF`, it prevents the +function from reading the complete string. This allows an attacker to cleverly truncate a string before it has ended to manipulate the content of strings which follow it. In this case, the model name is saved before the model hash in the information file. By adding a `0xff` to -the end of our uploaded model's name, the model hash is read as an empty string -following a `search` of the file's contents. Since any following `search` will use -the previously loaded models hash to find the file via prefix match, any files -uploaded by unregistered users may be accessed by a user. +our uploaded model's name, we can control what value is loaded from the file for +the model's hash. Since a `search last` will use the previously loaded models hash +to find the file via prefix match, any files uploaded by unregistered users can +be accessed by choosing this value accordingly. The flag is saved in the model name. @@ -119,12 +121,12 @@ Exploiting ---------- 1. Open a session -2. Run `upload` to upload an STL file and specify a model name ending in `0xff` +2. Run `upload` to upload an STL file and specify a model name ending in + `0xff` 3. Open a new session -4. Run `search` with the same model name from **step 1** to load the parsed - information from the `info` file and trigger the truncation -5. Run `search last` to use the cached hash which should be empty, - allowing you to accesss any files uploaded by unregistered users +4. Run `search` with the same model name from **step 1** to load the malicious + model hash value +5. Run `search last` to use the cached hash prefix to access the target file See the `exploit` method of the checker in `checker/src/checker.py` for an implementation in python. @@ -208,12 +210,12 @@ previously, to log in as them and query information about their files. To calculate the preimage we repeatedly choose a seed for srand. For each seed, we XOR the values encoded in the hex-encoded hash with -calls to rand(). If after generating each character the sum of the +calls to `rand()`. If after generating each character the sum of the generated values is less than the seed we used, restart. Otherwise, we append some characters to make the sum of the input characters match the seed, such that the seed for srand mhash uses matches the one we chose. The actual value of these 'extra' chars is irrelevant, -since mhash only processes the first 20 chars anyways. +since mhash only processes the first 20 chars. See `checker/src/revhash/main.c` for an example implementation in C. diff --git a/documentation/slides-final/.gitignore b/documentation/slides-final/.gitignore new file mode 100644 index 0000000..e4e7469 --- /dev/null +++ b/documentation/slides-final/.gitignore @@ -0,0 +1 @@ +slides diff --git a/documentation/slides-final/index.html b/documentation/slides-final/index.html new file mode 100644 index 0000000..b7457ef --- /dev/null +++ b/documentation/slides-final/index.html @@ -0,0 +1,768 @@ + + + + + + STLDoctor + + + +
+
+
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/documentation/slides-final/media/dirlist.png b/documentation/slides-final/media/dirlist.png new file mode 100644 index 0000000..68985ad Binary files /dev/null and b/documentation/slides-final/media/dirlist.png differ diff --git a/documentation/slides-final/media/enowars5-timeout.png b/documentation/slides-final/media/enowars5-timeout.png new file mode 100644 index 0000000..2dfecb2 Binary files /dev/null and b/documentation/slides-final/media/enowars5-timeout.png differ diff --git a/documentation/slides-final/media/enowars5.png b/documentation/slides-final/media/enowars5.png new file mode 100644 index 0000000..4dbba87 Binary files /dev/null and b/documentation/slides-final/media/enowars5.png differ diff --git a/documentation/slides-final/media/exploit-1-1.png b/documentation/slides-final/media/exploit-1-1.png new file mode 100644 index 0000000..b251075 Binary files /dev/null and b/documentation/slides-final/media/exploit-1-1.png differ diff --git a/documentation/slides-final/media/exploit-1-2.png b/documentation/slides-final/media/exploit-1-2.png new file mode 100644 index 0000000..e63f7d0 Binary files /dev/null and b/documentation/slides-final/media/exploit-1-2.png differ diff --git a/documentation/slides-final/media/exploit-1-3.png b/documentation/slides-final/media/exploit-1-3.png new file mode 100644 index 0000000..4dc961d Binary files /dev/null and b/documentation/slides-final/media/exploit-1-3.png differ diff --git a/documentation/slides-final/media/exploit-1-4.png b/documentation/slides-final/media/exploit-1-4.png new file mode 100644 index 0000000..2d75f2f Binary files /dev/null and b/documentation/slides-final/media/exploit-1-4.png differ diff --git a/documentation/slides-final/media/exploit-1-5.png b/documentation/slides-final/media/exploit-1-5.png new file mode 100644 index 0000000..874529b Binary files /dev/null and b/documentation/slides-final/media/exploit-1-5.png differ diff --git a/documentation/slides-final/media/exploit-2-1.png b/documentation/slides-final/media/exploit-2-1.png new file mode 100644 index 0000000..91b0df7 Binary files /dev/null and b/documentation/slides-final/media/exploit-2-1.png differ diff --git a/documentation/slides-final/media/getdirentries.png b/documentation/slides-final/media/getdirentries.png new file mode 100644 index 0000000..e19c3e7 Binary files /dev/null and b/documentation/slides-final/media/getdirentries.png differ diff --git a/documentation/slides-final/media/player-meme-hashfunc.png b/documentation/slides-final/media/player-meme-hashfunc.png new file mode 100644 index 0000000..04077ca Binary files /dev/null and b/documentation/slides-final/media/player-meme-hashfunc.png differ diff --git a/documentation/slides-final/media/player-meme-struggling.png b/documentation/slides-final/media/player-meme-struggling.png new file mode 100644 index 0000000..9863892 Binary files /dev/null and b/documentation/slides-final/media/player-meme-struggling.png differ diff --git a/documentation/slides-final/media/readdir.png b/documentation/slides-final/media/readdir.png new file mode 100644 index 0000000..a211c1f Binary files /dev/null and b/documentation/slides-final/media/readdir.png differ diff --git a/documentation/slides-final/media/readdir_more.png b/documentation/slides-final/media/readdir_more.png new file mode 100644 index 0000000..c24c582 Binary files /dev/null and b/documentation/slides-final/media/readdir_more.png differ diff --git a/documentation/slides-final/media/search.gif b/documentation/slides-final/media/search.gif new file mode 100644 index 0000000..de4ed18 Binary files /dev/null and b/documentation/slides-final/media/search.gif differ diff --git a/documentation/slides-final/media/socat.gif b/documentation/slides-final/media/socat.gif new file mode 100644 index 0000000..38f1e93 Binary files /dev/null and b/documentation/slides-final/media/socat.gif differ diff --git a/documentation/slides-final/media/stl1.png b/documentation/slides-final/media/stl1.png new file mode 100644 index 0000000..cef284a Binary files /dev/null and b/documentation/slides-final/media/stl1.png differ diff --git a/documentation/slides-final/media/stl2.png b/documentation/slides-final/media/stl2.png new file mode 100644 index 0000000..1201981 Binary files /dev/null and b/documentation/slides-final/media/stl2.png differ diff --git a/documentation/slides-final/media/stl3.png b/documentation/slides-final/media/stl3.png new file mode 100644 index 0000000..49045cc Binary files /dev/null and b/documentation/slides-final/media/stl3.png differ diff --git a/documentation/slides-final/media/stldoc.png b/documentation/slides-final/media/stldoc.png new file mode 100644 index 0000000..f276ef7 Binary files /dev/null and b/documentation/slides-final/media/stldoc.png differ diff --git a/documentation/slides-final/media/stldoc_dead.png b/documentation/slides-final/media/stldoc_dead.png new file mode 100644 index 0000000..6838fbf Binary files /dev/null and b/documentation/slides-final/media/stldoc_dead.png differ diff --git a/documentation/slides-final/media/stldoc_dead_offline.png b/documentation/slides-final/media/stldoc_dead_offline.png new file mode 100644 index 0000000..8cc3faa Binary files /dev/null and b/documentation/slides-final/media/stldoc_dead_offline.png differ diff --git a/documentation/slides-final/media/stldoc_dead_r17.png b/documentation/slides-final/media/stldoc_dead_r17.png new file mode 100644 index 0000000..0fef751 Binary files /dev/null and b/documentation/slides-final/media/stldoc_dead_r17.png differ diff --git a/documentation/slides-final/media/stldoc_dead_r432.png b/documentation/slides-final/media/stldoc_dead_r432.png new file mode 100644 index 0000000..5985a1a Binary files /dev/null and b/documentation/slides-final/media/stldoc_dead_r432.png differ diff --git a/documentation/slides-final/media/stldoc_dead_r469.png b/documentation/slides-final/media/stldoc_dead_r469.png new file mode 100644 index 0000000..d202b69 Binary files /dev/null and b/documentation/slides-final/media/stldoc_dead_r469.png differ diff --git a/documentation/slides-final/slides.md b/documentation/slides-final/slides.md new file mode 100644 index 0000000..54b1fa8 --- /dev/null +++ b/documentation/slides-final/slides.md @@ -0,0 +1,253 @@ +title: STLDoctor +output: index.html +controls: false + +-- + + + +-- + + + +# STLDoctor 💉 + +-- + +### Index 🗄️ + +- Service recap +- Optimization +- ENOWARS 5 +- Reflection + +-- + +### Refreshing Memories 💾 + +- Plaintext service written in C +- Users upload STL files for parsing +- Private and public storage (2 flagstores) +- 1. Vuln: Deserialization +- 2. Vuln: Hash preimage + + + +-- + +### Since Last Meeting ⏩ + + + +- Performance improvements +- Added service fluff + + + + + + + +-- + +### Issues 😒 + + + +- Slow search / list operations +- Enochecker memory leak without patch +- Engine error on worker restart with patch +- Logs not showing up in ELK + +-- + +### Solutions 💡 + +- Index files with locks for directory listing +- Refactored checker for asyncio +- Condensed checker functionality +- Increase docker-compose log size + +-- + +# ENOWARS 5 + +-- + +### OSError 💢 + +- Checker throws `INTERNAL_ERROR` on bad connection +- Fixed in c97789ad.. of enochecker3 + + + +-- + +### Checker Overload 💥 + + + +- Checker tasks being aborted for every team + + + +-- + +### Checker Overload 💥 + + + + +-- + +### Anomaly 👽 + + + + + +-- + +### Feedback 🤔 + +- 1. flagstore exploited after ~4h (R190) +- 2. flagstore not exploited + + + + + +-- + +### Conclusion 🎉 + +- Relatively good uptime +- Not too easy / hard +- Users found vulns interesting +- No (known) unintended vuln +- Had a lot of fun + +-- + +-- + +### Slow IO 🐌 + + + +- Enumerating files in a directory is expensive +- Index file per directory containing file names +- File locks to ensure exclusive writes + + + +-- + +### Investigating `readdir(..)` 🔍 + + + +`__readdir(..)`: + + + +-- + +### Investigating `readdir(..)` 🔍 + +`__get_dir_entries(..)`: + + + +-- + +### Checker Overload + + + +-- + +### Checker Overload + + + +-- + + + + + + diff --git a/documentation/slides-final/stldoctor.pdf b/documentation/slides-final/stldoctor.pdf new file mode 100644 index 0000000..6667621 Binary files /dev/null and b/documentation/slides-final/stldoctor.pdf differ diff --git a/documentation/slides-intro/.gitignore b/documentation/slides-intro/.gitignore new file mode 100644 index 0000000..e4e7469 --- /dev/null +++ b/documentation/slides-intro/.gitignore @@ -0,0 +1 @@ +slides diff --git a/documentation/slides-intro/index.html b/documentation/slides-intro/index.html new file mode 100644 index 0000000..cc0aa6a --- /dev/null +++ b/documentation/slides-intro/index.html @@ -0,0 +1,699 @@ + + + + + + STLDoctor + + + + +
+
+
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/documentation/slides-intro/media/exploit-1-1.png b/documentation/slides-intro/media/exploit-1-1.png new file mode 100644 index 0000000..b251075 Binary files /dev/null and b/documentation/slides-intro/media/exploit-1-1.png differ diff --git a/documentation/slides-intro/media/exploit-1-2.png b/documentation/slides-intro/media/exploit-1-2.png new file mode 100644 index 0000000..e63f7d0 Binary files /dev/null and b/documentation/slides-intro/media/exploit-1-2.png differ diff --git a/documentation/slides-intro/media/exploit-1-3.png b/documentation/slides-intro/media/exploit-1-3.png new file mode 100644 index 0000000..4dc961d Binary files /dev/null and b/documentation/slides-intro/media/exploit-1-3.png differ diff --git a/documentation/slides-intro/media/exploit-1-4.png b/documentation/slides-intro/media/exploit-1-4.png new file mode 100644 index 0000000..2d75f2f Binary files /dev/null and b/documentation/slides-intro/media/exploit-1-4.png differ diff --git a/documentation/slides-intro/media/exploit-1-5.png b/documentation/slides-intro/media/exploit-1-5.png new file mode 100644 index 0000000..874529b Binary files /dev/null and b/documentation/slides-intro/media/exploit-1-5.png differ diff --git a/documentation/slides-intro/media/exploit-2-1.png b/documentation/slides-intro/media/exploit-2-1.png new file mode 100644 index 0000000..91b0df7 Binary files /dev/null and b/documentation/slides-intro/media/exploit-2-1.png differ diff --git a/documentation/slides-intro/media/search.gif b/documentation/slides-intro/media/search.gif new file mode 100644 index 0000000..de4ed18 Binary files /dev/null and b/documentation/slides-intro/media/search.gif differ diff --git a/documentation/slides-intro/media/socat.gif b/documentation/slides-intro/media/socat.gif new file mode 100644 index 0000000..38f1e93 Binary files /dev/null and b/documentation/slides-intro/media/socat.gif differ diff --git a/documentation/slides-intro/slides.md b/documentation/slides-intro/slides.md new file mode 100644 index 0000000..48e3447 --- /dev/null +++ b/documentation/slides-intro/slides.md @@ -0,0 +1,184 @@ +title: STLDoctor +output: index.html +controls: false + +-- + + + +-- + +# STLDoctor 💉 + +-- + +### The Plan 💡 + + + + + + +- Plaintext service +- Interesting C bugs +- Exploit logic bugs, not RCE +- Learn about the STL format + + + +-- + +### Setup 🔧 + +- C binary that communicates via `stdin` and `stdout` +- Networking abstracted through hosting with `socat` +- File system backend with periodic clean up + +![socat](media/socat.gif) + +-- + +### Functionality 🎮 + + + + +- Users can upload and search for files +- Register to upload private files +- Uploaded files are analyzed and information is returned to the user + +--- + + + +![FileSearch](media/search.gif) + +-- + +### 1. Vuln 💉 + +- Flags are stored in the solidname of the STL +- Bug in upload info file parsing allows attacker to retrieve any public file + +-- + +### 2. Vuln 💉 + +- Flags are stored in the solidname of a private file +- Buffer overflow in hash function allows enumeration of private user hashes +- Generate preimages of weak hash function to login as users + +-- + +### Goals Met 🎉 + + + +⭐ Plaintext file inspection service
+⭐ Interesting and realisitic bugs
+⭐ Combine different gadgets for exploit
+⭐ Don't need to be an expert at fancy ROP
+⭐ No SLA lost in TestCTF
+⭐ Written in C + +-- + +### Issues 📉 + + + + + +💥 Exploits not directly related to STL format
+💥 (Eno)checker has memory leaks + +-- + +### Lesssons Learned + + + +- Many exploits are not suited for A/D ctfs +- How to write a FSM format parser +- Be careful with casts in C +- People just *love* C services 🤡 + +-- + +-- + +-- + +# Exploit 1 + +-- + +![exploit-1-1](media/exploit-1-1.png) + +-- + +![exploit-1-2](media/exploit-1-2.png) + +-- + +![exploit-1-3](media/exploit-1-3.png) + +-- + +![exploit-1-4](media/exploit-1-4.png) + +-- + +![exploit-1-5](media/exploit-1-5.png) + +-- + +# Exploit 2 + +-- + +![exploit-2-1](media/exploit-2-1.png) + + + + diff --git a/documentation/slides-intro/stldoctor.pdf b/documentation/slides-intro/stldoctor.pdf new file mode 100644 index 0000000..ddfe89b Binary files /dev/null and b/documentation/slides-intro/stldoctor.pdf differ diff --git a/documentation/slides/.gitignore b/documentation/slides/.gitignore deleted file mode 100644 index e4e7469..0000000 --- a/documentation/slides/.gitignore +++ /dev/null @@ -1 +0,0 @@ -slides diff --git a/documentation/slides/index.html b/documentation/slides/index.html deleted file mode 100644 index cc0aa6a..0000000 --- a/documentation/slides/index.html +++ /dev/null @@ -1,699 +0,0 @@ - - - - - - STLDoctor - - - - -
-
-
- -
-
-
- - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/documentation/slides/media/exploit-1-1.png b/documentation/slides/media/exploit-1-1.png deleted file mode 100644 index b251075..0000000 Binary files a/documentation/slides/media/exploit-1-1.png and /dev/null differ diff --git a/documentation/slides/media/exploit-1-2.png b/documentation/slides/media/exploit-1-2.png deleted file mode 100644 index e63f7d0..0000000 Binary files a/documentation/slides/media/exploit-1-2.png and /dev/null differ diff --git a/documentation/slides/media/exploit-1-3.png b/documentation/slides/media/exploit-1-3.png deleted file mode 100644 index 4dc961d..0000000 Binary files a/documentation/slides/media/exploit-1-3.png and /dev/null differ diff --git a/documentation/slides/media/exploit-1-4.png b/documentation/slides/media/exploit-1-4.png deleted file mode 100644 index 2d75f2f..0000000 Binary files a/documentation/slides/media/exploit-1-4.png and /dev/null differ diff --git a/documentation/slides/media/exploit-1-5.png b/documentation/slides/media/exploit-1-5.png deleted file mode 100644 index 874529b..0000000 Binary files a/documentation/slides/media/exploit-1-5.png and /dev/null differ diff --git a/documentation/slides/media/exploit-2-1.png b/documentation/slides/media/exploit-2-1.png deleted file mode 100644 index 91b0df7..0000000 Binary files a/documentation/slides/media/exploit-2-1.png and /dev/null differ diff --git a/documentation/slides/media/search.gif b/documentation/slides/media/search.gif deleted file mode 100644 index de4ed18..0000000 Binary files a/documentation/slides/media/search.gif and /dev/null differ diff --git a/documentation/slides/media/socat.gif b/documentation/slides/media/socat.gif deleted file mode 100644 index 38f1e93..0000000 Binary files a/documentation/slides/media/socat.gif and /dev/null differ diff --git a/documentation/slides/slides.md b/documentation/slides/slides.md deleted file mode 100644 index 48e3447..0000000 --- a/documentation/slides/slides.md +++ /dev/null @@ -1,184 +0,0 @@ -title: STLDoctor -output: index.html -controls: false - --- - - - --- - -# STLDoctor 💉 - --- - -### The Plan 💡 - - - - - - -- Plaintext service -- Interesting C bugs -- Exploit logic bugs, not RCE -- Learn about the STL format - - - --- - -### Setup 🔧 - -- C binary that communicates via `stdin` and `stdout` -- Networking abstracted through hosting with `socat` -- File system backend with periodic clean up - -![socat](media/socat.gif) - --- - -### Functionality 🎮 - - - - -- Users can upload and search for files -- Register to upload private files -- Uploaded files are analyzed and information is returned to the user - ---- - - - -![FileSearch](media/search.gif) - --- - -### 1. Vuln 💉 - -- Flags are stored in the solidname of the STL -- Bug in upload info file parsing allows attacker to retrieve any public file - --- - -### 2. Vuln 💉 - -- Flags are stored in the solidname of a private file -- Buffer overflow in hash function allows enumeration of private user hashes -- Generate preimages of weak hash function to login as users - --- - -### Goals Met 🎉 - - - -⭐ Plaintext file inspection service
-⭐ Interesting and realisitic bugs
-⭐ Combine different gadgets for exploit
-⭐ Don't need to be an expert at fancy ROP
-⭐ No SLA lost in TestCTF
-⭐ Written in C - --- - -### Issues 📉 - - - - - -💥 Exploits not directly related to STL format
-💥 (Eno)checker has memory leaks - --- - -### Lesssons Learned - - - -- Many exploits are not suited for A/D ctfs -- How to write a FSM format parser -- Be careful with casts in C -- People just *love* C services 🤡 - --- - --- - --- - -# Exploit 1 - --- - -![exploit-1-1](media/exploit-1-1.png) - --- - -![exploit-1-2](media/exploit-1-2.png) - --- - -![exploit-1-3](media/exploit-1-3.png) - --- - -![exploit-1-4](media/exploit-1-4.png) - --- - -![exploit-1-5](media/exploit-1-5.png) - --- - -# Exploit 2 - --- - -![exploit-2-1](media/exploit-2-1.png) - - - - diff --git a/documentation/slides/stldoctor.pdf b/documentation/slides/stldoctor.pdf deleted file mode 100644 index ddfe89b..0000000 Binary files a/documentation/slides/stldoctor.pdf and /dev/null differ -- cgit v1.2.3-71-gd317