GETS Buffer Overflow | PicoCTF 2017 [41] "VR Gear Console"

  Рет қаралды 8,720

John Hammond

John Hammond

Күн бұрын

Пікірлер: 14
@cyberfence3795
@cyberfence3795 6 жыл бұрын
Thanks for your videos mate, your whole channel is like a gold mine to me!
@_JohnHammond
@_JohnHammond 6 жыл бұрын
Thanks so much! Hopefully there will lots to show when PicoCTF 2018 is over after next week! :D
@rodriquh
@rodriquh 5 жыл бұрын
I loved it when you said we didn’t stay in our shell. Lolz
@HackerGprat
@HackerGprat 5 жыл бұрын
BIG FAN FROM INDIA...
@k-sansenpai7774
@k-sansenpai7774 4 жыл бұрын
Love your videos, great content How does cat command work with holding console for taking further comands? Kind of confused there
@DigitalicaEG
@DigitalicaEG 4 жыл бұрын
@4:10 I think You initial approach should've worked, the passwords were there in cleartext but the username was different (root and artist). The reason why it matches the flag is simply because the password and the flag match.
@thepag52
@thepag52 6 жыл бұрын
John your videos are great thank you for what you do. Do you know if 2017 will end when the 2018 competition starts
@_JohnHammond
@_JohnHammond 6 жыл бұрын
Thanks so much! Honestly I am not sure, that's why I had been hoping to put more pressure on the 2017 videos. 2014 and 2013 went down, but I am hoping that 2017 stays up...
@synestematic
@synestematic 4 жыл бұрын
i understand the gets approach but why doesn't the "normal" logic work: authenticate with admin + {{ create_long_password() }}. Is it because John needed to escape the spaces in the password with \'s ?
@avishabat5167
@avishabat5167 6 жыл бұрын
Why did the username overflow the access level instead of the password?
@_JohnHammond
@_JohnHammond 6 жыл бұрын
Check out the source. Since they still run `gets` on the password buffer, you COULD overflow the access level with that variable... but you have to go THROUGH the username buffer to do it. See how username is above password when it's declared? The access level is declared just before username -- so username is right under it on the stack. Overflowing username will get you to hit the access level first.
@sbig21
@sbig21 6 жыл бұрын
So if I for example input a valid username and overflow the password instead will it still work?
@_JohnHammond
@_JohnHammond 6 жыл бұрын
Yup! As long as one of the variables gets overflowed and changes the return address on the stack frame, you'll still jump to that address.
@mukundbhuva
@mukundbhuva 5 жыл бұрын
Hacker101 ctf
ZIP File Magic Bytes | PicoCTF 2017 [41] "Missing Identity"
8:05
John Hammond
Рет қаралды 12 М.
CSAW'19 - PWN - Ret2libc w/ PWNTOOLS (baby_boi)
24:03
John Hammond
Рет қаралды 26 М.
Beat Ronaldo, Win $1,000,000
22:45
MrBeast
Рет қаралды 137 МЛН
99.9% IMPOSSIBLE
00:24
STORROR
Рет қаралды 24 МЛН
[BEFORE vs AFTER] Incredibox Sprunki - Freaky Song
00:15
Horror Skunx 2
Рет қаралды 19 МЛН
Buffer Overflow Hacking Tutorial (Bypass Passwords)
55:39
David Bombal
Рет қаралды 78 М.
Running a Buffer Overflow Attack - Computerphile
17:30
Computerphile
Рет қаралды 2 МЛН
SunshineCTF 2019 | Return to Mania (PWN) PIE
16:07
John Hammond
Рет қаралды 25 М.
Three Ways to Hack Mobile Apps
43:41
John Hammond
Рет қаралды 99 М.
Writing a Simple Buffer Overflow Exploit
19:41
LiveOverflow
Рет қаралды 146 М.
Beat Ronaldo, Win $1,000,000
22:45
MrBeast
Рет қаралды 137 МЛН