search

KAIST-IS521 / 2018s-gitctf-team5

1 stars 0 forks source link

exploit-bug2 #39

Closed sunnyeo closed 6 years ago

sunnyeo commented 6 years ago

-----BEGIN PGP MESSAGE----- Version: GnuPG v1

hQEMAy8nZUIPGP0nAQf8Dz6TBV+vrdLro2zubNe+8B4QSWPkGCR+q0eqYm00VPgN OhJXIElgXKxC2x5DjZ3f3bRm2m5jYlWWAo42LqJc6gzX5KTzByZbgxGQiXFMw1Rf drTPGQXK18q1QiXSpXT7Qv4xBdVjG1RKtCPWN1M1VK+98EUk9yQWtguZkGRJIYMV q5NvPdvYybz/MuCbK5+czvxmHbZInke5uBHPyjYbEjeKOwagUu7dF8p8DT3C/AOk OSGQaoIq+15tlzjYyPxKNEPt44y2daNcXiGPMog9SpWSa2kgJKIOIGvU0QwWdw5g TspJu3HzM1at3ZqzKAoK2vIBynkEQfNB5xJSHaxzkYUBjAPcMgCV6N35oQEMAJR+ 96zWqLVzotfwNGzY1uwPQOqWjH8OPNBsNcZtKtocT2IEF9yEZTio1NsWtIUOqliP QHoPr9ybTdv2OGu6O9NX0cz7EAMo7HuhBQT666xnConN4C5XPz6cVgK2KAVJZQyg 0xbL71Ca0JEdNODBQAVQK6S//facsdSIgEA5An/wbCP8SmhKSqSSplrP1n5r/3tT fTnUeFqQk+2svRPZQUMYKosXPskr8UX0sP50qEshzn0V3qvG8wEbn1qjIEDFLBwR B0NtznZE872V+adk+CHBYJJAGIo851j86VvuIi96rlrbeDDDQQGq790JwvGPNml+ Xnz8w67spW1LrW0Scjdt/D3qq5Rxy9PVErhNLI9Ai/zvIBC59hZ75kuB/nPAyalk uOYE66RgAz7V+hf35D1f9rhcuj60cAqyJotq1Vgu46HStofaYs0+rOMPHWDJozOp Xdsh0KVYl2jp9MiuRErlTHJkOPLQaQlMGxjtXGXW/jJci9ULqZAFJIFtMYhUNNLr ATX7ul4dah8w1BgXxFEe34006tZEVqZExwaSQQqeMUNr+Ex33MlVPAKy5A9qCfb0 P0fWMwoZ2QRdxvuktDQhWoEmg5qKW8w3c1AZs2X1+lRGEllY+IkyNqqVu/lXVLWx m636h2JryW9mHniqoRP1uNfH8qQO5migiVriT1/pUDJUIBjLsp7riqMFSskmy1e0 3VsGDzkoVwnS17/RAkxTno5XCQRPxIGDJH6z76cZhJt0opI/xWXz0FxOtQeq9qWV +HRKqcK9j1QiR2zHo5I8Sfsy4q6iJ36U9kMwDdkWxHCi6p+xnoXOnP0hVqTGXHqZ M/N2PiPJSG3vuDjhBDvqxhqhJDa0cwXaPGDVUnfLlS2zzknZgfHbQr3NLh/NMnwt g1oA04b1zcEJMZqYneAz66UMgosY1WWH6PcYhHA3e1wBPNSyNB+7zt1iofvOmxAD /iEeFYCU8aRJ7+b14cFrClrUzKiY5zBEvrqt2p/+LgU8bqFqhdEqEc7D6+uZEhLI 6o7nB5w7AzCYBDUUgmFrsEUbiW6KonvYFTbM7gEvLU7Q4/+UNEMkBgnnD03+nnGC B4Zrz1l1nUsxEuGC9tDPtAss0i4KG+kvKeKaIpWqQC7XfX9KxfKf6nh3RebB/siB of/LRPTVknjklNK7n1Liced4PtngXpsQbJArtEHXoD8pHjX62wBvnnSjTM0BYNpa uKLaEGjlchDhZNuh3nJuiy7Qf8BKO6oP7ZAnIqhQ2LK47pdT/iGSzNR1+BcWyW5i tJ+khJnb0j8gJxj43qeEI7DKokaVC1j85zZFqDnH/DQ0x0KIMqlHk6tyu3oOkL3w VYrNbcf4c/7d+c1ca2oHxRrC/oNAFAl4Z/7xgUDnYXs6eC+TC0lVkVfA5G/7Obti eiRKLvBprG2AZPMJpIdHTLmwzdONATds07wUIGxpT4XI8dGGpGR/DtW6IETEBxvl XN3aT1Enr3YmglFqgEThg2ZxWBoAwOE5CG2TTE9Lpbyb4puyaDXXX3iylLkPei9U seKNrXa5/87l7SvUyGtTA4LFKfgLrPK0Scf/e2ls/uTX3xCteu8ENqhPHFEFVodO cn4Tfm4HrXgKMX5THC7hkwyX6jPjPKohZhpDo0au+fW0Jp1i+z1cVS5KGhCACnLo dCz1yXgCdQisrlZU5mS+1khYWdQQQ1shpYRc+Ut14EYkiJdzrvP/Yg1RbXkRoAT3 rwQA1xcamj73jTq55ZawTKZ5AOLaqThsWvGtOIMLr5R3qDh5dlhqlJw+YKcgegfw 18WWElkEmIe20g7dvXcfa0c2TfiqfXMGrWJs2r6575CqFIdXggt7M8ukXdAkgaf1 JqgmYUUal8CV2BnbH7PmfLByEv9N9vJdFE5il802ForcGf4vW/DdLO4Fw6oMVLaC mZmThYXkkt4VKHZaL8VlMvROexKHO+wX7mWiit5v5uXZWPv1sHtlqlCS6tLhNVyI SGV67buNx9URiei2FFW/NHUXVKDQ26aLHA58plh8p3UgTohPHQX4WqhcKLA3bkd4 iZBkPHyOBhRLET/syc+yclnLty5VH5Gu8QZko8sF/bKppbo9XDOoUYxpgK5xGmc1 QANQYPwq88zE1j86plZ7hZCnRYp+OFjj9VM9X1W5TKGSOytlj1csXnksVSP1SkBD aYJkc6z4SS3LBwDpRy3iiqeHVZB7XGoTsqjWHuR9s2Y0vwaWjvKKLp7qQ2Ed5vYS VJF4ctkSu1ySZ8VZq9qWyZrN72WOKf4+K0SgOOr+HW9Q4+FdzNm8NDgwtxCKsdYD ZxPe97mFxE6lkWM+bmHJMzr6jfBzqNzEAQW5z93EtwFoDE8ORT5gpYlFbTHZP2T7 8ot5qnFEYgshB1vX4VjLcVtm6SueBywrnvSQlPELVe8IWZAhCbymiD/IBKWWvy5V gmc+h7NrAzV2Ghe+3v8W3XiQRUmFQqVRotFurCjP0vuAtnRbJD4rSwE1y6OgUA8G NcQbrCZHdQfCGv/VGW0Gv9kvhPiG5h6rVE7Kkc0WmRfEnBsK53hXuEVkIdTQSEMp Yn/f6LOfEdXr4ZYVfi3PYAv2rn7ORC9zMJo7+Ga67O2VLND4cN1NUMOpe4HKVZe3 OWx/EbOq7zHsHMTWYYbxBJzezwofv+TZSW0ud5KPssmxjSwMSCTqZyyxrqkorL+K BjD83vd/XH/LPsEfwiF+uqajwZ/tm3ik0EmEoKokeYfMJetOoVi2Zt2PRazU2ZOh 7F+CF6SeIaWWCOa0isIUp0B0HNmbnfZAA6lVt8JHAtwSASD9FjN3itly8nzmxYFl xpmsYGHHsUh/YYTMQBoEzXaecDJPdtDl5IXg4EURkJ3pqLEgpvIhLdhI8CrAzWZQ pwwUV0K5pNkk0on8k+7FTanT8w+WL8uwnVk9szX3fvIs3YTjzsfK0s+QvRp+RIMQ LwGuL3D2Su5E6uC91JfRFdSzA6TFeeqrvKxkkdRvIfdjood3SMh7A9MPyYxcSpfB QM5CQ9XNKDcDutok10tz+7leYDxll4mwL/G8jMbhdIi56JdUffzEFw5g1jMMt82y Ax3gMxoi+E2mWGIJNoYDNTBfoGJTOt8Gc7rtmfV4VlN3iefC2p5LeBEOlbyG21dW lXCPx2dpgqp/UpLVQm2zRpiTjUkVPq6Ty+COG375ApDO/Bzp5NxuWgQukMCZcnqM 61Cy6kMIn/KGJmJ0Sv49OHCRhrEe6EZ6yIFPAuss1nXA691KXVcgUw5W47rlOmPl ImpTn1zmyHVO4vVBjFbRyEY6SH32KB/OGmohopBfSh6N47YLbYUuQd27c4O2SElU vAP0BAfMrQnoNuPYfkkTuGNGKb9NSz8puWKLeMYv1+tTUvYca7yKyRnAX2XdBIdR QNsVGOVXC9Us1bW/C3C1CXWlCCtSrNgWKPUJ0av/kOGbnuLrDV1tRC31Fma3iCA6 Tw2KhCeGYwx4QAVeI8W5r0+UrOLuQYHCa2u1LbmkDD4BYCVt2hO0CFPv2KCjYoJ9 n3A1mVJeJVo2ldcHvAB4ZgNla8zYlTO84fD2u9kIdLJCjoDjxTsDXSwdsu8viR0K zxbP4cACxEZwq8a2tpZ/VUKoT2VkHLx8/Y3/XrkTd3OI6bdnTZIkqG/e0nqdYUbj uAqETg2t7A7qPuad6igA4y13sbvCrWPif0vd41IWFKkK3iP/oFxpFGkbg3W3kv6K pJPwKvzbm63Y69PZrxfHA9id0cdDL/5shUJVnoHz+PHA+Bfsu8O28mRxMsWhaQeI xqrWc0oREDFMHG6cM4eXCOMDX24azTXxKpcHl50= =GZrV -----END PGP MESSAGE-----

softsec-is521 commented 6 years ago 
About exploit-bug2 (exploit-service branch)
[*] Starting service from 2018s-gitctf-team5 (branch '8a0b39b831e3bb1efdc845658089c0ae66a36fd7')
Sending build context to Docker daemon  2.193MB
Step 1/33 : FROM debian:latest
---> 8626492fecd3
Step 2/33 : MAINTAINER k1rh4 <k1rh4.lee@gmail.com>
---> Using cache
---> 8e9e3881ec66
Step 3/33 : RUN         sed -i 's/deb.debian.org/ftp.daumkakao.com/g' /etc/apt/sources.list
---> Using cache
---> d58cb6fc7f0d
Step 4/33 : RUN apt-get update
---> Using cache
---> f74c65dc9bfe
Step 5/33 : RUN apt-get install -y xinetd
---> Using cache
---> 845d6f85baa1
Step 6/33 : RUN apt-get install -y libsqlite3-dev
---> Using cache
---> ff66c0e5a29c
Step 7/33 : RUN apt-get install netcat -y
---> Using cache
---> df491e9bff6a
Step 8/33 : RUN apt-get install net-tools -y
---> Using cache
---> 93debded14f4
Step 9/33 : RUN apt-get install -y procps
---> Using cache
---> c472a4cdaf3f
Step 10/33 : RUN useradd -d /home/load load -s /bin/bash
---> Using cache
---> 88d6cfc64fa7
Step 11/33 : RUN mkdir /home/load
---> Using cache
---> 82e3bcea59ce
Step 12/33 : RUN chown -R root:load /home/load
---> Using cache
---> 5aa04924d1ab
Step 13/33 : RUN chmod 750 /home/load
---> Using cache
---> f51da5c3a761
Step 14/33 : ADD ./BUILD/prob /home/load/
---> Using cache
---> 5fa7dbc08b05
Step 15/33 : ADD ./BUILD/modify_usr /home/load/modify_usr
---> Using cache
---> 80d1f6379516
Step 16/33 : ADD ./BUILD/run.sh /home/load/run.sh
---> Using cache
---> 906323f975f1
Step 17/33 : ADD ./BUILD/usr.db /home/load/usr.db
---> Using cache
---> ba9251f94caa
Step 18/33 : RUN chown root:root /home/load/*
---> Using cache
---> bb326fbfe03f
Step 19/33 : RUN chmod 755 /home/load/run.sh
---> Using cache
---> 693348cb1317
Step 20/33 : RUN chmod 755 /home/load/modify_usr
---> Using cache
---> e9b9fc8366c5
Step 21/33 : RUN chmod 755 /home/load/prob
---> Using cache
---> 2b467833030a
Step 22/33 : RUN chmod 766 /home/load/usr.db
---> Using cache
---> e09ce7454b7a
Step 23/33 : RUN mkdir -p /var/ctf/
---> Using cache
---> 836e043d7be7
Step 24/33 : COPY ./flag    /var/ctf/flag
---> e753070d8cfc
Step 25/33 : RUN chown root:load /var/ctf/flag
---> Running in 917c9a8b9999
Removing intermediate container 917c9a8b9999
---> 694a1d84b9a7
Step 26/33 : RUN chmod 440 /var/ctf/flag
---> Running in 5266a8eee973
Removing intermediate container 5266a8eee973
---> ebf7d7793b50
Step 27/33 : ADD ./SRC/load.xinetd /etc/xinetd.d/load
---> 03a3760ae8bd
Step 28/33 : WORKDIR /home/load
Removing intermediate container 8470ab6a7cf4
---> b77448b9d9dd
Step 29/33 : ADD ./SRC/start.sh /start.sh
---> 4961426e71d4
Step 30/33 : RUN chmod +x /start.sh
---> Running in b194c40ab0f6
Removing intermediate container b194c40ab0f6
---> 17fb078b031a
Step 31/33 : RUN su load
---> Running in d0a2bc149d81
Removing intermediate container d0a2bc149d81
---> 70c1fd5ff397
Step 32/33 : RUN /start.sh &
---> Running in bfa3f7180838
Removing intermediate container bfa3f7180838
---> cf33ed605afe
Step 33/33 : ENTRYPOINT /start.sh
---> Running in 7dd9004b10e9
Removing intermediate container 7dd9004b10e9
---> 477c005d68ce
Successfully built 477c005d68ce
Successfully tagged 2018s-gitctf-team5-8a0b39b831e3bb1efdc845658089c0ae66a36fd7:latest
5090a78c536f56e68d61715ce084e2aaccbc6aea22043891eaa4e727936520db
[*] Started service successfully
[*] Running exploit
Sending build context to Docker daemon   7.68kB
Step 1/6 : FROM debian:latest
---> 8626492fecd3
Step 2/6 : RUN sed -i 's/deb.debian.org/ftp.daumkakao.com/g' /etc/apt/sources.list
---> Using cache
---> 45fa25df3fa6
Step 3/6 : RUN apt-get update
---> Using cache
---> 0845a94ffa3b
Step 4/6 : RUN apt-get install -y python
---> Using cache
---> 371c580f05da
Step 5/6 : COPY /ex.py /bin/exploit
---> Using cache
---> bb2f5d2c7cea
Step 6/6 : RUN chmod 755 /bin/exploit
---> Using cache
---> b4325a2098ba
Successfully built b4325a2098ba
Successfully tagged exploit-8a0b39b831e3bb1efdc845658089c0ae66a36fd7:latest
0 
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 m
0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 mX
[*] Failed to run exploit

==========================
[*] Exploit returned : None
[*] Solution flag : PbQhMWlZqu
[*] Exploit returned a wrong flag string

[*] The exploit did not work.