PWN Overflow | CSAW CTF "BigBoy"

If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
E-mail: [e-mail]
PayPal: paypal.me/johnhammond010
GitHub: github.com/JohnHammond
Site: www.johnhammond.org
Twitter: / _johnhammond

[@stevet7522]

How did I not find this guys channel sooner? This stuff is amazing.

[@_JohnHammond]

Thanks for the kind words, and thanks for watching!

[@MrEdwardSP]

State of the art explanation... Amazing video~

[@_JohnHammond]

Thanks for all the kind words! And thanks for watching!

[@alecsymmonds959]

You're a beast! Motivating.

[@niteshsurana]

Commenting for the LLS CTF Flag! And hey, I've subscribed to you months ago :p

[@timothyhill4486]

Love the video

[@gyul2311]

John Can I ask you what program are you using when you record your screen?

[@_JohnHammond]

Holy crap, I don't know how I missed this a YEAR ago -- but I use OBS Studio, nowwadays. I used to use SimpleScreenRecorder or Kazam.

[@mushtakhussain9017]

Damn thats an art work.. hope i can learn alot from you.. play more ctf john.. im getting inspired ❤

[@timothyhill4486]

Commenting for the LLS CTF Flag!

[@ApploFag]

John please explain, we pass buffer 'aaaa'+magic_hex and then bash shell will be executed. After that all input after our string will pass to bash command shell via cat command and we will get output also, am I right?

[@lsd3284]

I have a doubt , when esp sets buffer frame of 0x18, and waiting for our input, you tried to brute over garbage input to fill those in buffer and hit eax. I don't understood what do you mean by hitting eax or how is input reacting to stack and eax ?

[@tobiasmayer4492]

Containing the year in the title would be awesome.

[@sontapaa11jokulainen94]

Yeah. I wonder how many people "missed the like button" because of that.

[@shogunisheremistaa3432]

You can find the binary in this repo: github.com/osirislab/CSAW-CTF-2018-Quals/tree/master/pwn

[@mamtachahal1277]

If someone can explain why he did to make the bash stay. He put the entire python command under brackets and used cat, but why does that make the bash stay?

[@robinhood3841]

Hey john i really love and enjoy how you are working in exploitation can u pls give me good resources or books to start from ?

[@kushansingh6244]

Hi John I don't understand why would you use 'A'*$i to find if it overflows the buffer. I am new to reverse engineering. Can you please help me understand that python script. I will appreciate it.

[@_JohnHammond]

I can't tell what you are asking? The "A"*$i is Bash syntax, that $i is the variable that will be replaced with the current count in the for loop. I use that technique to sort of spray the binary with different length inputs and see which ones it acts differently for (as 20 was where we were correctly overwriting EIP and getting a shell). Does that help at all..?

[@kushansingh6244]

@@_JohnHammond Hi John, yes i get it now, so it's a trick used to spray heap and find out the memory location where it's overflowing. Is it more of a trial and error or is there a way to guess the numbers as in this case you used 20 to 28 ?

[@_JohnHammond]

@@kushansingh6244 This isn't spraying the heap -- just looping through numbers to determine which "offset" of garbage input will get the right overflow position to force a new EIP. I estimated 20 to 28 because we could see the buffer size was 0x10 (16 in decimal) -- so I added four to that number, because EBP will be in the way, and did a small range of 4's to see if there was anything else that could be in the way. The amount of data that is being read in, or the buffer size, or good indicators as to where you should base your search.

[@kushansingh6244]

@@_JohnHammond Got it, thanks Appreciate it !

[@rakeshlal6882]

hey John will you play blazeCTF 2019?

[@sontapaa11jokulainen94]

Why doesn't the overflow start after 24 characters? Why does it already start at 20 characters? Edit: Never mind. Had to just use my brain a bit.

[@mazharhussain.]

Hey Sir can you please attach the files of ctfs with videos? we need it for practice :P Thank You

[@videospromoter5884]

give me the flag