Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon.

Pages: 1-4041-

/prog/ CTF 0x00: HAX MY PRINTER, PRINT MY ANUS

Name: Anonymous 2019-02-08 10:59

so we've all had our're are /prog/ramming challenges, so let's try something different: security-style exercises. we'll start with something simple to warm you up, and come up with more complex exercises if people are both interested and skilled.

Premise:
you have managed to remotely access a program on Nikita Sad Cow's macbook, which was stolen by Vladimir Putin. the program is supposed to print everything you write to console. Vladimir is watching this console through a shitty terminal emulator which only supports ASCII characters. you want to send Vladimir a message (the message is HAX MY ANUS), but the FSB has installed their're are censorship tool which you must first circumvent.

Challenge:
write such answer program that will result in the words "HAX MY ANUS" appearing on the terminal when piped to this advanced censorship software:
./answer | python3 -c "print(input().replace('ANUS','****'))"

Rules and Scoring:
  • shortest program (in bytes of source code or compiled exectuable) wins
  • there should only be "HAX MY ANUS" visible in the console; leading and trailing whitespace is accepted, but automatically scored below programs with no such issues; other trailing and leading characters, as well as any non-conforming characters visible in a different position, means that the program doesn't meet the spec
  • you have one week
  • you should be able to solve this

Name: Anonymous 2019-02-08 11:48

main(){write(2,"HAX MY ANUS",11);putchar('\n');}

Name: Anonymous 2019-02-08 11:54

>>2
not bad, but check this out:
main(){puts("HAX MY ANUX\x08S");}

Name: Anonymous 2019-02-08 12:09

Anux sounds like a Unix-like operating system made by /prague/

Name: Anonymous 2019-02-08 13:29

>>4
Anux operating system for x08S architecture

Name: Anonymous 2019-02-08 14:16

Anux is Not Usually Linux

Name: Anonymous 2019-02-08 14:28

So what happened to Anonix?

Name: Anonymous 2019-02-08 14:29

>>7
Cudder is all talk and no action!

Name: Anonymous 2019-02-08 14:51

>>7
Terry is dead.

Name: Anonymous 2019-02-08 15:41

>>9
his real name was H.A.L. Ableist

Name: Anonymous 2019-02-08 15:46

>>10
Red Cream............

Name: Anonymous 2019-02-08 15:47

RedCream the dubsman from Macedonia

Name: Anonymous 2019-02-08 16:03

>>10
This may surprise you, but I invented this meme.

Name: Anonymous 2019-02-08 16:05

RedCream the dubsman from Macedonia

Name: Anonymous 2019-02-08 16:05

RedCream the dubsman from Macedonia

Name: Anonymous 2019-02-08 16:07

RedCream the dubsman from Macedonia

Name: Anonymous 2019-02-08 16:07

RedCream the dubsman from Macedonia

Name: Anonymous 2019-02-08 16:08

RedCream the dubsman from Macedonia

Name: Anonymous 2019-02-08 16:08

RedCream the dubsman from Macedonia

Name: Anonymous 2019-02-08 16:08

RedCream the dubsman from Macedonia

Name: Anonymous 2019-02-08 16:09

RedCream the dubsman from Macedonia

Name: Anonymous 2019-02-08 16:54

>>11-21
get out of my thread

Name: Anonymous 2019-02-08 17:11

>>11-21
and into my anus

Name: Anonymous 2019-02-08 18:14

>>22
I feel kinda bad now when I think about it. You're trying to breathe some life into this stale board, and I'm poasting my usual autistic bullshite. I'm sorry.

Name: Anonymous 2019-02-08 18:40

>>20,21
Oh, he was from Greece? I had no idea!

Name: Anonymous 2019-02-08 18:47

>>24
so repent for your're are sins and make your're are exploit

Name: Anonymous 2019-02-08 19:15

>>26
I read up on it and discovered that input() evaluates input as python code, so there's an exploit there. Unfortunately, I don't speak dead snake.

Name: Anonymous 2019-02-08 19:25

>>27
that's only in py2 (https://docs.python.org/2/library/functions.html#input). >>1 uses py3 which does not have this vulnerability (https://docs.python.org/3.7/library/functions.html#input). but >>2-3 prove that this doesn't make the challenge impossible

Name: Anonymous 2019-02-11 7:11

shell one-liners for the win:
printf "HAX MY ANU\0S"

Name: Anonymous 2019-02-11 7:27

>>29
what you're referring to as ANUX is in fact ANU/0S or ANU+0S

Name: Anonymous 2019-02-11 10:39

http://anix.tuxfamily.org/
Anix is an OS (Operating System) provided for school under GPL license.

Name: Anonymous 2019-02-11 10:53

du

Name: Anonymous 2019-02-11 10:53

bs

Name: Anonymous 2019-02-12 9:10

another one-liner, using the stderr method from >>2:
echo HAX MY ANUS>&2;echo
would be better than >>29 if it didn't need to put something on stdin as well

Name: Anonymous 2019-02-12 9:42

echo HAX MY ANUS>/etc/motd;echo

Name: Anonymous 2019-02-12 14:49

>>35
won't this only show up on login?

Name: Anonymous 2019-02-15 11:10

Results:
the winner is >>29. this simple one-liner used the trick of embedding a null byte which prints as a 0-width space, creating a string which looks like "HAX MY ANUS" to Vladimir but not to the FSB censorship program. similar solution was used in >>3, but it was based on visually erasing characters with ASCII backspace.

other solutions used printing to stderr (pioneered by >>2) and /etc/motd (>>35).

Future:
would anyone be interested in similar, but a bit more complex challenges? if you are, I have ideas - stay tuned!

Name: Anonymous 2019-02-15 12:26

>>37
>would anyone be interested in similar, but a bit more complex challenges?
yes pl0x

Name: Anonymous 2019-02-15 12:30

>>38
ok, I'll post one soon. it'll either be THIS INCIDENT WILL BE REPORTED (an easy one) or SPELL OF HAMSTERY (a fairly complex - but still not too hard - challenge with multiple solutions)

Name: Anonymous 2019-02-15 16:07

>>39
SHELL OF HAMSTERY please.

Name: Anonymous 2019-02-16 8:28

>>39
Is this a ruse to make us make ou'r are games?

Name: Anonymous 2019-02-17 8:52

>>41
Become a productive citizen of our're society.

Name: Anonymous 2019-02-18 7:28

>>41
no, the point will be to make a program that wins a small text-based game

Name: Anonymous 2019-02-18 8:08

win my dubs

Name: HAX ME ANII 2019-08-29 10:50

HAX ME ANII

Name: Anonymous 2019-08-29 20:20

>>1
That was a good challenge; perfect formulation. I was too late but if it counts, I immediately thought of

echo $'HAX MY ANUX\bS'

Name: Anonymous 2019-08-31 11:22

You newbs, echo has far too much code: -

https://github.com/bminor/bash/blob/d233b485e83c3a784b803fb894280773f16f2deb/builtins/echo.def

My entry: -
mov ah,9
mov dx,108
int 21
ret
db 'HAX MY ',8,'$'


http://tinyimg.io/i/c4dLlDS.png

Name: Anonymous 2019-08-31 11:41

>>47
You newb, it's on Nikita's sad cow macbook.

section .text
global _main
extern _printf

_main:
sub rsp, 8
mov rdi, m
call _printf
xor eax, eax
ret

section .rodata
m: db "HAX MY ANU ", 8, "S", 10, 0

Name: Anonymous 2019-08-31 14:27

>>48
You newb, printf has far too much code: -

https://github.com/lattera/glibc/blob/master/stdio-common/vfprintf.c

section .text
global _main

_main:
sub rsp, 8
mov eax, 0x2000004
mov edi, 1
mov rsi, m
mov rdx, 15
syscall
ret

section .rodata
m: db "HAX MY ANU ", 8, "S", 10, 0

Name: Anonymous 2019-08-31 16:36

>>49
That code has too much macros for no good reason.

Don't change these.
Name: Email:
Entire Thread Thread List