"You thought that it was over, right? But no, it has just begun."

So let's tackle the demon lord, once and for all.

We need to prove that we are worthy to defeat the damned demon lord.

Turn Undead...

God Requiem...

Steal...

[Endless chanting of "EKUSUPUROSHION"]...

All to prove that we are the ultimate sorcerer.

Prove that to The Grand Magus, that we have the strongest magic in our hand.

Hmm... The Grand Magus....

Elias best btw, change my mind.

Picture source : FurAffinity

So, back to the quest.

The demon lord told us to read something, and it happens to be stored inside strongest-magic.txt

A file.

At first, I thought that the file is embedded inside the executable, so I used IDA to check whether there is something inside the database.

Well... Nothing.

Then I checked the website if the file is exposed to the public by filling the address bar with the file name.

Well, also nothing.

And so I remember, that sometimes in CTF competition, flags are stored inside the text file and can be leaked by reading the file with "cat" command. In order to do this, especially on remote server, we need to open a shell (or a terminal), so we can use various of Linux commands, and "cat" is one of those commands.

So basically, this is "shellcode" challenge. That kind of challenge where you need to open a shell.

But how does one open the shell, especially on the server?

I'm going to give a video which basically all you need.

Done watching? Then my job is done, right?

Alright, goodbye, masih ada 4 tubes belum kelar.

.

.

.

.

.

.

.

.

.

.

Okay, very weird of you to actually continue to read.

So, back to the demon lord, we need to open a shell by using buffer overflow attack. Recall on what we did in Stage 5, we managed to execute arbitrary instructions by injecting it into stack, setting the return address so that it executes our code, and then returning to another function.

But now, we only need to open the shell.

You can do this in two ways :

The easy way : Manipulate the hex2raw.py so you can use pre-existing hex binaries to open the shell, or
The hard way : Actually the easy way but you put all the hex binaries in the input.txt file.

As wise man once said, "Kalau bisa susah, kenapa harus gampang?".

So we go for the hard way...........but well, not so hard actually.

Recall in stage 5 that we injected byte codes that do something, so here we need to also inject some bytes that open a shell on the remote server.

Lots of resources for this, and http://shell-storm.org/shellcode/ is one of them.

We need a simple, short, but straighforward, and this one seems good enough. ~~totally not using the one that LiveOverflow used~~

Inject those into our input.txt. For those who wonders, "\x" is a hexadecimal character escape, often used to tell that "a character here has the hex value of AB", where AB is the same value in \xAB format. So "\xc7" equals to 37 in hexadecimal, and so on.

Input.txt now

61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 61 78 56 34 12 aa aa aa aa bb bb bb bb cc cc cc cc 04 dd ff ff 8c 93 04 08 31 c0 50 68 2f 2f 73 68 68 2f 62 69 6e 89 e3 89 c1 89 c2 b0 0b cd 80 31 c0 40 cd 80

Let's try to use this input and pipe it to remote server.

Um... I guess we did it? Or no? I don't know, I can write something and input something but I don't get any feedback. Hmm... I can assume that the shell is already opened, but why the f there is no feedback? No outputs.

No outputs means no inputs.

Hmm...

Well, if you watched LiveOverflow's video and read other articles, yes we managed to open the shell, but after that the stdin stream will be closed so basically anything that we inputted are not going to reach the program, because stdin is closed.

"A neat trick for this is to use 'cat' without parameters' -Based LiveOverflow.

So when we execute our program, add "; cat" after the token, and group the python and cat in a bracket before piping it into the netcat server.

So simply run

(python hex2raw.py <your token> ; cat) | nc <ip> <port>

Execute it properly, and write some commands, and voila!

AAAAND THAT WRAPS IT ALL

If you managed to clear all the stages, then congratulation!

If you think that this write-up actually help you, then it's my pleasure.

If you think that I have some flaws when explaining, then I'm open for all critics and suggestions.

This is actually my first time in writing a write-up, so sorry for any inconvenience.

Thanks for reading this far!

N.P : ASISTEN LAB SISTER WIBU IH

Loading...

There will be awesome contents here

Orkom3 Write-Up : Bonus - The Strongest Magic