Global variable Buffer Overflow to leak memory - 34C3 CTF readme_revenge (pwn)

[@SentientSeven]

This has quickly turned into one of my favorite channels, my only regret is not discovering you sooner!

[@sagarkapasi099]

same

[@X3eRo0]

Didn't understand anything but still enjoyed hoping that someday I will also learn it

[@mortenschantz3811]

Same :)

[@X3eRo0]

Morten Schantz we have to do something. I can't live like that I need to learn this. Even Liveoverflow channel has a binary exploitation series that goes over my head I need to restart. Anyone has any good resources to start with

[@007order007]

You need to do it, try the exploit exercises vms; practical knowledge is the best way to truly grasp it

[@pwn0x80]

Pulkit Singhania indian!!??

[@X3eRo0]

RoCk StAr DeViL yeah

[@SuperBotcreator]

All the drawings and indicators combined with the quality of the microphone and video actually makes this way more helpful to understand your points (opposed to other creators). +1 to everything

[@mr2amethyst]

is this fucking faggocheat sphenix

[@Alex-kh8zj]

@@mr2amethyst ?

[@rwpage89]

Dude you are absolutely fantastic. It’s one thing to have the experience and knowledge, it’s a totally different skill to be able to teach the thought process and logic. I wish you had more subs, your content gold

[@procrast]

exactly

[@renakunisaki]

Here my mind is blown just at the fact that you can register custom printf handlers.

[@DemonixTB]

i watched this when it came out, back whenever i started high school, didn't understand any of it, now Im at least able to follow, a good sign of improvement :D

[@ltstaffel5323]

Really liked this. First video of yours that I watched and was able to understand everything you did before your extra explanations

[@__mk_km__]

The best thing about those challenges is multiple solutions. Having the power of re-writing unlimited amount of memory you can just do whatever

[@pacsmile]

I wish i understood anything you talk about, still so entertaining to watch yout videos.

[@pandavova]

Mir gefallen echt deine Videos. Mal hoffen das es viele weiter geben wird :D

[@m0mosenpai]

Really amazing video man! I admit i didn't understand most of it but hope to work my way towards that level of understanding. I would also love to see more in depth tutorials and advice for beginners ! :D

[@infosecaphorisms5479]

As a beginner what kind of tutorials and materials would be useful to you?

[@movAX13h]

Awesome channel! It gets better with every new video! Danke

[@LiveOverflow]

thanks for saying that! I was worried to disappoint a lot of the new subscribers that came because of the less technical videos.

[@daab889]

easy-ish?

[@oldbootz]

hahahahaha yes this is fucking next level for my memory editing skills

[@MegaStupidMonkeys]

compared to some other challenges, yes this is relatively very easy and doesn't really require a team to solve it.

[@DanteElMc]

Easy'nt

[@---br3hp]

every vid of yours is awesome!I will keep studying , and it's hard for me I feel

[@anishamdi4405]

Awesome as always

[@stancuflorin]

Love your videos man,keep it up!

[@DevDungeon]

Great job explaining things!

[@cervi6538]

You are the best!

[@slindnertube]

Hi... thanks for the video. I totally get what you did there. Just as an exercise I still wanted to get a full shell. You easily control the instruction pointer here, but the arguments are a problem. Anyone interested in trying this as well?

[@lukaszstocki6998]

blew my mind!

[@Dr.A.P.]

can you do a video where you introduce all the tools you use in your videos?

[@meksaldi]

There is already a video of what you are asking I think.

[@__mk_km__]

The binary exploitation playlist on his channel, first or second video

[@kirdow]

Notification Squad woo :D Edit: Great video as usual

[@TheSkepticSkwerl]

I'm wondering if using crunch and xargs could fuzz it. And once you find the length to buffer overflow, you then try to change the return to every value. And then grep 34c3 to get the flag. It wouldn't explain how it works like you're video. But it would fuzz out an answer

[@WoolieOG]

great vid =)

[@Napert]

why whenever you do a buffer overflow with "AAAAAAAAAAAAAAAAAAAAAAA" i start screaming "AAAAAAAAAAAAAAAAAAA"?

[@centdemeern1]

it overflowed into your voice jk lol

[@Ketchup911]

This was crazy

[@agustinothadeus]

Pretty straightforward huh!!, well not to me it wasn't, nice video though. I hope one day I might learn to do the same

[@StefanGliga48]

Revenge is so sweet.

[@Zooiest]

Aww that self-confidence at the end is so cute. I’m the opposite, I’ll never reach your level

[@ifconfigurator]

Why did you need to smash the stack? Wouldn't simply returning the flag's address from printf's new %s function work to cause it to be printed?

[@LiveOverflow]

I didn’t smash the stack here. I executed the stack smash printing error by hand, which is the new %s function, which causes the flag to be printed ;)

[@robindimyanoglu4369]

nice trick you've done there with __stack_chk_fail! was the nx enabled? if not, couldn't you redirect execution flow to an egg-hunter-ish shellcode?

[@LiveOverflow]

NX is basicallly always enabled ;)

[@omrikurtz5981]

Hm, at 3:52 you said you can access local vars on the stack using rsp+0xsomething, didn't you mean rbp? I mean stack pointer is just the top of the stack, and rbp is the base pointer, which is saved in the prologue for this purpose.

[@kotkiorketer]

Big FACEPALM that scanf("%s") reads null bytes and I thought only gets is so stupid :D

[@ИльяАпролов]

gj man

[@klikkolee]

I'm so amused that a function related to detecting buffer overflow is used as a gadget when performing a buffer overflow exploit.

[@nieder-olm]

Wow I didn’t understand a word and I have a BSc in CS. Feelsbadman

[@viraatchandra8498]

genius :)

[@StefanSchlott]

This means that stack_chk_fail does not use printf for its output (or at least not %s for displaying the program name)?

[@inferno3853]

Late reply but from what I understand that wouldn't matter in this case. He overwrote the printf function table to execute the stack_chk_fail function (which is always present) and as stack_chk_fail uses the command line argument 0 to print the path of the program, he overwrote the argv pointer address to point to memory he can modify. He then modified argv[0] to point to the flag and voila, stack_chk_fail prints the flag since it believes argv[0] is located at that address. Someone correct me if I'm wrong here.

[@that_one_redfox]

Only lesson i learned in attempts to get some knowledge: I m useless in coding area.

[@nikidino8]

I love the 1337

[@gsniteesh3794]

can you do a live Q&A session pls

[@alsacchi]

I don't undestad the part when you use forma buffer the dumped memory

[@mdsathees3747]

Could you tell some idea for improving assembly code

[@jbess04]

Satheeskumar Durai What I've heard helps is writing your own programs in C, then looking at the assembly of those programs to see how they work

[@sundhaug92]

A slight issue with going through C is that by default your compiler will add a whole lot of stuff

[@Zooiest]

10:52 163rd*

[@black_platypus]

🤔 Yees... what do we _chang_ ? :P

[@kim15742]

Wow

[@justanormalperson]

im seeing glitched text at 5:00?

[@LiveOverflow]

I changed my recording process a little bit and haven’t figure out to get rid of them yet. Sorry :(

[@justanormalperson]

i hate when something goes wrong :/

[@wayneyahnke7099]

It's OK, it's not a big deal and flashes by so fast it doesn't really matter. Your content is of such great quality not because of the video you show but the words you use! Keep these great explanations coming =)

[@ali-azizimayer-peters6686]

Every Video of you is f**in amazing and its a pleasure to watch them and learn more. There is no way to buy private lessons from you ? :D :D ...Joke... No your awesome dude, please don't stop making Videos i've learned already so much from your Videos that i am leaving my script-kiddie status step by step. Eventually i can work for the Bundeswehr in the "Cyber Abwehr"-program in a few years ?! Yeah im german too. That would be amazing. I've learned most of my binary hacking/disassembling skills from your channel, because your Videos are really full of good Information, so that i've learned in some Videos much more than in a 500-Page book. Keep going LiveOverflow your really a Person which does something very important for the people. Greetings Hotwire ;)

[@mdsathees3747]

Can suggest some way to practice CTF flag game..

[@infosecaphorisms5479]

I would look into hackthebox.eu. They have an online lab for a wide range of skill levels. You can also look into lists like captf.com/practice-ctf/ for some CTF challenges.

[@justanormalperson]

nice :D

[@luckyymvm]

revenge pwn????

[@candacepelley8093]

8:03 haaah

[@benjaminnewman3833]

what was that calculator?

[@LiveOverflow]

default OSX calculator

[@benjaminnewman3833]

ty

[@martinp.4797]

When ur blocked, u arrive to get out with new ideas, i don't know how ur doing. Me, I just stay stuck and give up.

[@essamal-mansouri2689]

This was ranked as "easy-ish"? What's easier than easy because that's what I need to find.

[@codex4971]

damn am too faar from this lvl fuaark

[@pinkflamingointhehouse]

Watch me do this in C# 😂

[@morte3252]

Can C# be hacked?

[@stewartzayat7526]

Morte no it is immune

[@hmm-.-]

Stewart Zayat men, you made my day xD

[@m8_981]

Really wonder if Anyone here understands shit :D

[@WoolieOG]

i did understand most, cuz he explains his steps well, but im nowhere near attacking such challenges myself.

[@digifomation]

Wait a minute, Buffer Overflow are still relevant in 2018 ?

[@meksaldi]

Some of the simplest bugs remain today still as the most dangerous ones. It has just become more difficult to discover them. This is due to the complexity of modern web & native applications.

[@thescreemregular5168]

F

[@greob]

Have you considered using dark background colours (and themes) instead of white backgrounds?