Skip to content

Latest commit

 

History

History
187 lines (145 loc) · 6.72 KB

master.org

File metadata and controls

187 lines (145 loc) · 6.72 KB
Raw

Practical CTF Hacking

Tasks

Write outline

Figure out title page setup

Figure out how to do code blocks in babel mode

First, customize the variable org-babel-load-languages, save, and then you can work as normal

Find out how to run a web browser in emacs

You can do this with eww

Figure out how to get org-beautify-theme to load

Introduction

This book covers the practical tools, tips, and references for CTF hacking contests. I assume you have what I call the “hacker spirit”, where you can do self-directed exploration of a subject. If you are the type of person who needs an instructor to point you to the next thing to learn, then computer security is probably not the right field for you.

Audience and Assumptions

In this book we assume you already have a working knowledge of:

  1. UNIX and the command line. Personally years ago I learned reading UNIX in 24 hours.
  2. You have access to a UNIX system. For example, you can rent a server for $5/month at Digital Ocean, or you can install a virtual machine, e.g., via vagrant.
  3. The ability to use a UNIX text editor. Some get by on nano, I recommend learning vim as well. (Real programmers know emacs; consider learning it eventually.)
  4. Some python experience. I’ve found that really good CTF hackers are also typically very experienced with python. You can use Learn Python the Hard Way as a good introduction.

In addition, to solve many reversing and binary exploitation challenges you must know:

  1. The C Programming Language. (Note: C++ is a related, but different language. I recommend C). I do not have any experience recommending books. One possibility is the free wikibooks Little C Primer.
  2. Compilation and basic debugging of compiled programs on x86. We call compilied programs “binaries”. At CMU, we require most students to take Introduction to Computer Systems. As part of that course, students read Computer Systems:A Programmers Perspective. I highly recommend this book. In particular, you should be an expert in material at least up to Chapter 3. In particular, I assume you know the GNU debugger gdb, and the objdump utility.

Credits

This book is the product of the Spring 2015 18739L class at Carnegie Mellon University.

This e-book is mostly written and edited in emacs org-mode. This is my first time using org-mode for a book. Most of the links and tools were provided by students in the 18-739L course in Spring 2015.

Binary Exploitation

Learning

Tools

gdb

peda

peda is a GDB plugin that provides enhanced UI and python integration. Highlights disassembly. searchmem is useful for searching for your input string. checksec also checks general security properties of the executable.

IDA Pro

IDA Pro is the DE factor standard tool for navigating binaries. The free version is adequate for most needs. You should get use to solving problems without the decompiler plugin. The full decompiler is nice, but don’t make it a crutch.

The most common tasks, by shortcut, are:

  • x to see what calls a function.
  • n to rename (usually to something memorable)

Spending a few days with the IDA Pro book is worthwhile, especially Section 2 on basic IDA usage.

use pwntools to set up connection

Reliability in connections.

shellcraft

fuzzers

Fuzzers tend to have less value in CTF problems that real world security scenarios. However, it is still useful to know how to fuzz. In practice, zzuf and afl-fuzz tend to be the most popular currently for quick, black-box fuzzing.

Useful shell commands

While we assume basic UNIX experience, there are unique CTF-specific tasks often crop up. This is grab-bag of such tricks and tips. We use the program named `ctf` to stand in for any CTF program.

Providing command-generated input

Suppose you want to provide a long input to a program. We can use our one-liners from above to generate the input, and use the modern shell feature of using (<cmd>).

For example, the following command will run python in a subshell with a small one-liner that prints 40 A characters in a row.

echo $(python -c 'print "A"*40')

The results are:

Of course you can run any unix command. The following echos /bin/ls to objdump, which then pipes to head to print the first 5 results:

objdump -D $(echo /bin/ls) | head -5

Another (and older) method is to use backticks:

echo `python -c 'print "B"*40'`

The results are:

Using the (<cmd>) syntax is newer and the recommended method for invoking a command. The backticks have been deprecated in favor of $() for command substitution because $() can easily nest within itself as in $(echo foo$(echo bar)). There are also minor differences such as how backslashes are parsed in the backtick version[fn:1].

[fn:1] See Shell Programming: What’s the difference between $(command) and `command`

Python one-liners

  1. tjis is an item

Random things

Analyzing binaries when you don’t have read permissions

On level 13 of IO, you are not given read access to the binary. The trick here is to use ptrace. ptrace allows a parent process to step through a child. You can also use xobinary potentially.

Web Exploitation

Learning

Tools

Useful shell commands

Python one-liners

Forensics

Papers

Tools

Useful shell commands

Python one-liners

Cryptography

Learning

Tools

SAGE

SAGE. Nice example is rsa picoctf problem. tjbecker has the example. (need to implement your own gcd)

Useful shell commands

Python one-liners

atm: