Cybersecurity

[wolvctf] writeup(s)

On April 18, 2024April 18, 2024By davidlee

https://ctftime.org/event/2240 I participated wolvctf as the KUICS team and scored 15th among 622 teams. Sanity Check wctf{4_c0py_4nd_p4s+3_r4c3} [rev] doubledelete’s revenge wctf{i_th1nk_y0u_m1sund3rst00d_h0w_r0t13_w0rk5} Value: 100 Solve Count: 105 Description: The notorious WOLPHV group has re-emerged and doubledelete is now ransoming us for our flags! Can you help us so we don’t have to pay them? https://github.com/WolvSec/WolvCTF-2024-Challenges-Public/tree/master/rev/doubledeletes_revenge The.

[dreamhack] captain-hook writeup

On April 16, 2024April 17, 2024By davidlee

https://dreamhack.io/wargame/challenges/51 import frida import sys def on_message(message, data): print(message) # JavaScript code to be injected jscode = “”” var file = new File(“dump.txt”, “a”) //hook GdipSetSmoothingMode, add counter and print out counter each when it get called var counter = 0; const base = Module.findBaseAddress(‘CaptainHook.exe’) Interceptor.attach(Module.findExportByName(null, “GdipSetSmoothingMode”), { onEnter: function(args) { counter++; //console.log(“GdipSetSmoothingMode called: “.

[CVE-2023-5757] How I found Stored XSS from 100K+ downloaded plugin

On January 28, 2024January 28, 2024By davidlee

Back in October 2023, I was working on finding vulnerabilities in WordPress plugins. Among one of them, I found a vulnerability from WP Crowdfunding which had a 100K + download. It was a Stored XSS vulnerability that occurs in WP Crowdfunding version <= 2.1.8. What is WP Crowdfunding? WP Crowdfunding is a plugin that enables.

[SEEDLAB] SYSTEM SECURITY WRITEUP (Shellcode and Buffer Overflow) #10

On January 28, 2024January 28, 2024By davidlee

First of all, some steps needs to bone to do tasks Disabling ASLR Linking /bin/zsh to /bin/sh Preparing vulnerable stack.c Task1: Exploiting the Vulnerability with BOFStep1. Constructing the content of badfile Following is the part where buffer overflow occurs: buffer address is required to exploit it. by looking at assembly, it can know that buffer.

[SEEDLAB] SYSTEM SECURITY WRITEUP (Environment Variables) #9

On January 28, 2024January 28, 2024By davidlee

Task 1 – Passing Environment Variables from Parent Process to Child ProcessStep 1. Compile and run the following program && Step 2. Comment out the printenv() in thechild process (Line ②) Step 3. Compare the difference of these two files using diff command. They are both the same file. The reason why this is happening.

[SEEDLAB] SYSTEM SECURITY WRITEUP (Set-UID, Capability Leaking) #8

On January 28, 2024January 28, 2024By davidlee

Task 1. Invoking External Program Using a system() vs an execve() Step 1. Environmental setup to bypass some mitigations The default /bin/sh is linked to /bin/dash. However, /bin/dash lowers the privilege even if the program is Set-UID. Hence for the tasks, I will link /bin/sh to /bin/zsh. Step 2. Compile the below program, make it.

[SEEDLAB] WEB SECURITY WRITEUP (XSS Lab Site) #7

On January 28, 2024January 28, 2024By davidlee

Task 1: Posting a Malicious Message to Display an Alert Window It is a task that performs Stored XSS. Since Samy is an attacker, I signed up with Samy’s account: Edit profile page is as follows: The page allows editing HTML directly by “Edit HTML”. However, this feature does not sanitize any strings so it.

[SEEDLAB] WEB SECURITY WRITEUP (CSRF Lab Site) #6

On January 28, 2024January 28, 2024By davidlee

Task 1: Observing HTTP Request First, install HTTP Header live firefox add-on to capture HTTP Request. HTTP Request can be captured by the add-on Also, it can set the type of HTTP request, and manually send some requests. Task 2: CSRF Attack using GET Request I will perform a CSRF attack which adds an attacker.

[SEEDLAB] NETWORK SECURITY WRITEUP (SYN Flooding, TCP RST Attack, TCP Session Hijacking) #5

On January 28, 2024By davidlee

First of all, I configured the system as follows to solve the tasks:Attacker: 192.168.0.24Telnet Server: 192.168.0.26Client: 192.168.0.27 Task 1: SYN Flooding Attack Task 1 is a task that performs a SYN Flooding attack. Before performing the attack, I checked whether the telnet server is working: From the Attacker VM, netwox can be used to perform.

[SEEDLAB] NETWORK SECURITY WRITEUP (Packet Sniffing, ICMP Spoof, Traceroute) #4

On January 28, 2024January 28, 2024By davidlee

What the task wants is to compare the results of packet sniffing runned in normal user and root. First, I wrote sniff.py which prints icmp packets. When running in root: When ping is sent to 1.1.1.1, ICMP packet is successfully captured. When running in normal user: Operation not permitted error is being printed. Through the.

Category: Cybersecurity