Solving Pwnable CTF Challenge With Docker Workflow

A very simple pwnable challenge to checkout the docker workflow.
pwn_docker_example: github.com/Liv...
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Website: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow

[@Alkiiis]

You can attach simply attach gdb with: *gdb.attach(**p.pid**, "c")* (The c is to continue gdb after attached.) This will open a new terminal window with gdb.

[@mal-nr3ym]

Does this work from within docker?

[@ritabandas]

That's for python2 For python3 I think it's more comfortable to use p = gdb.debug("./binary")

[@kirdow]

Really nice to see you've taken on a series about Docker. I am really looking forward to the next episodes. Keep it up man :D

[@notyoursurya]

*Idol on youtube:-* _1. LiveOverflow_ _2. Ippsec_ _3. Ghidra Ninja_ *Thanks for my job* ❤

[@0dyss3us51]

You got a job in sec from learning from them? :)

[@MRGolum]

@@0dyss3us51 go away job lover....we don't want a job..

[@LisaD478]

Those videos helped me a lot, too. Studying computer science was really helpful to understand these things in a short amount of time. Even though IT-security wasn't my first intention for studying. Btw I met LiveOverflow in real life last december, he was shorter than me XD.. Didn't know who he was back then. A friend of mine introduced me to his channel afterwards.

[@sontapaa11jokulainen94]

You forgot Ben Eater and John Kelly.

[@amyshaw893]

forgot john hammond

[@conqu3red545]

Love your vids bro, you have taught me so much, also inspired me to head into this industry when I grow up 😃

[@D-mw8vr]

My man, ZSH with my fav theme lol i love when i see others use Zsh i really love autocomplete on it as well.

[@disconnect3d_pl]

Pwntools comes up with CLI tools too. One of such is "template" which generates a solver script. E.g. `pwn template --host --port > solv.py` will give us script that we can launch as: python solv.py LOCAL - run local binary python solv.py GDB LOCAL - run local binary under GDB (with gdbserver; we can also provide gdbscript for that) python solv.py REMOTE - connect to remote There's also DEBUG arg which enables pwntools debugging mode that prints out all read/writes etc.

[@dannielpineda2026]

Just wow Keep it up men I will support until the end..

[@sudorm-rf9032]

15:00 sounds like a lot of time went into finding this problem...

[@ari_archer]

aye, ur minecraft texture is missing

@@ari_archer Nah it's just a pink BMW logo

[@conceptualprogress]

Awessoommme video! Thx! This really helped me getting an idea about where to start!

[@ムワ-d7n]

Nice, another binex videos Hope u make some of them again but this time lets make the binex chall from intermediate level to hardcore level!

[@mrhappysmiley2968]

Never would I thought that I would ever see "uwu" from LiveOverflow 15:24

[@alexzander5948]

It's hard to digest, When you spoke about all Advanced stuff in your Previous videos and came back into very Basics in latest Videos

[@TheOxis1]

Great video, as always! However, I didn't understand something: why is the RSP misaligned? We are overwriting exactly the buffer bytes + the already existing ret ptr and nothing more, so why after the ret the RSP isn't aligned? Wouldn't it be misaligned even if we didn't overwrite the ptr?

[@bgo271]

Exactly what I thought! I'm trying to figure that out myself, but I'd like someone to comment over here so we both have the answer.

[@scottjcrouch]

I'm only guessing here but perhaps the compiler knows that, on the normal execution path, the stack will always be 16-byte aligned (or perhaps misaligned, and so inserts asm to push padding bytes to the stack somewhere ahead of the call to "backdoor"). Or maybe it doesn't even bother checking since backdoor() isn't actually called from anywhere.

[@kevinwydler4405]

Very well explained! Thank you!

[@mal-nr3ym]

Not sure if I missed something out or if docker is configured slightly different on mac but I had to add both containers to a network before I could connect to the other. I think you could also connect both to the host network though. There's also the ROP api within pwntools, which would have let you do: padding = 'A' * cyclic_find('acla') rop = ROP(binary) rop.call(rop.search(move=8)) rop.call('backdoor') p.sendline("sUp3r_S3cr3T_P4s5w0rD\x00" + padding + str(rop))

[@adi331]

Regarding the ROP Api: This doesn't work for me . I printed str(rop) for debugging and it's only 5 bytes , when it should be 16 bytes ( 8 byte for aligning, 8 byte for the jump into the backdoor function) . Output: "\x89\x11\x00\x12\x00"

[@mal-nr3ym]

@@adi331 try adding context.clear(arch='i386') to the top of your exploit to force it to use 32bit pointers

[@adi331]

@@mal-nr3ym Changing it to arch='i386' didn't change anything. But I asked myself why i386 when it's a 64 bit binary. So I changed it to arch='x86_64' . Then it worked :) ! . I guess that's what you probably meant . Thx :) Though i find it a bit bad that the ROP Class doesn't automatically detect this .

[@qwkc]

hell yea time to watch a video where i understand pretty much nothing but enjoy it regardless

[@madghostek3026]

That kinda... doesn't fit into this channel

[@qwkc]

Madghostek i haven’t ever really learned more than some basic c++ and making a few websites however i enjoy watching his workflow, especially on CTF videos

[@madghostek3026]

@@qwkc wait sorry I must've misclicked a comment, it wasn't supposed to be here

[@qwkc]

Madghostek ah no problem all good

[@zzh1996]

e = ELF('./foo') and then use p64(e.symbols['backdoor'])

[@MrBrendanpdx]

A note about the word “canary”. You are pronouncing the word “cannery” not “canary”. I don’t mean to be critical rather I am assuming you’re the type of person who would like to know the difference. Thanks for all the content!

[@LisaD478]

The german accent is strong in this one... I know the pain too well~

[@feifeilooper8312]

Thanks so much.

[@zbigniewchlebicki478]

One does not simply `gets()` into `char *`.

[@wardijien_official149]

I really want to be like that but it's difficult for me because I'm still a beginner :( Semanta is always a teacher:)

[@sotakawaii]

Just make a Docker-Compose file.

[@waplet]

Wouldnt it read BBBBCCCC , but due to endianess reversed?

[@piticarrara]

15:24 owo what's this

[@scuroguardiano5511]

uwu

[@neerajnigam6]

Hey nice video. I working on a similar challenge where I redirected the code flow to backdoor function. system("/bin/bash") is getting executed within the backdoor (verfied via GDB) however I am still not able to spawn a shell, instead of an interactive shell the backdoor function returns and go back to main function and program crashes ( Because stack is messed up as we overwritten over other stored registers) any ideas what is going wrong? Any help or resource would be appreciated. Thanks.

[@GameTimeWithVargaArmy]

I'd love to see you code a mmorpg bot with like C#, that would be so cool!

[@pyryvartiovaara230]

Begone future osrs botter

[@GameTimeWithVargaArmy]

@@pyryvartiovaara230 Writing a osrs bot thats not based on color detection but rather injection and memory was surprisingly easy, I was thinking more like world of warcraft of even Tibia, I found this really cool one on GitHub for tibia the other day, pretty interesting topic but that might just be me

[@LukenSkyne]

15:26 killed me uwu

[@MinhNguyen-kv2mz]

just notice lol

[@michaelhoefler5118]

This is great!

[@timtomlan4183]

Sadly I don't know how to do this but I like to watch you explain it if someone has some tips HoW tO gEt Started you can comment it ^^

[@timtomlan4183]

Btw You do a great job live overflow stay how you are

[@simone9485]

Try picoCTF they are really simple and there are plenty of writeups I've started there last year and I'm slowly learning. I'm using this video to try and solve one of the 2019 picoCTF wish me luck

[@pwndumb2903]

elf = context.binary = ELF("./binary") io = process(elf.path) context.log_level="DEBUG" gdb.attach(io, ''' break *main break *0x08049019 ''')

[@richardlighthouse5328]

8 bit computer update?

[@trungthanhbp]

love you

[@pascal5848]

Nice :)

[@Va47i]

Python2 in 2020.

[@dexdevlon]

What is redstarOSX, is it some kind of hackintosh?

[@eIicit]

It's a joke. Red Star OS is North Korea's state-made linux distribution, some observed that it had similarities with Apple.

[@Whiterabbit124]

No pie :(

[@launumins3102]

Love u :)

[@TheMas-sk7nd]

"raw_input" is python 2, makes me sad which has been EOL for 2 months now

[@LiveOverflow]

It’s not dead on my computer

[@TheMas-sk7nd]

@@LiveOverflow true, but it wont be getting any security updates or anything anymore

[@recklessroges]

If it makes you sad, then tell people what would make you happy. "This is how I do it" is more useful than "thing BAD!"

[@vinos1629]

*pretends to understand*

[@adrianopinaffo]

At some point you just start enjoying his voice

[@_mvr_]

did you just invent cheatengine?

[@zergberg1278]

YO

[@cassandradawn780]

3 hours ago

[@RepublikSivizien]

uwu