Skip to content

Commit 7ed5824

Browse files
bynectbynect
committed
Fix categories
1 parent b7d17c9 commit 7ed5824

9 files changed

Lines changed: 19 additions & 13 deletions

File tree

  • content/posts
    • csaw-19-embedded-security-challenge-report
    • csaw-20-embedded-security-challenge-report
    • csaw-23-embedded-security-challenge-report
    • csaw-24-cybersecurity-awareness-communication-challenge-report
    • csaw-24-embedded-security-challenge-report
    • csaw-quals-18-doubletrouble
    • flare-on-2017-writeups
    • trend-micro-ctf-2019-libchakracore-so
    • wctf-2019-babypwn

‎content/posts/csaw-19-embedded-security-challenge-report/index.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@ date: '2019-11-11'
44
lastmod: '2019-11-11T15:25:44+01:00'
55
categories:
66
- articles
7+
- CSAW
78
tags:
8-
- esc
99
- csaw
10+
- esc
1011
authors:
1112
- matteojug
1213
- cristianrichie

‎content/posts/csaw-20-embedded-security-challenge-report/index.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@ date: '2020-11-12'
44
lastmod: '2020-11-12T17:03:23+01:00'
55
categories:
66
- articles
7+
- CSAW
78
tags:
8-
- esc
99
- csaw
10+
- esc
1011
authors:
1112
- matteojug
1213
- cristianrichie

‎content/posts/csaw-23-embedded-security-challenge-report/index.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@ date: '2023-09-28'
44
lastmod: '2024-11-14T20:07:57+01:00'
55
categories:
66
- articles
7+
- CSAW
78
tags:
8-
- esc
99
- csaw
10+
- esc
1011
authors:
1112
- Titto
1213
---

‎content/posts/csaw-24-cybersecurity-awareness-communication-challenge-report/index.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@ date: '2024-11-17'
44
lastmod: '2024-11-17T18:37:43+01:00'
55
categories:
66
- articles
7+
- CSAW
78
tags:
8-
- cac
99
- csaw
10+
- cac
1011
authors:
1112
- Titto
1213
---

‎content/posts/csaw-24-embedded-security-challenge-report/index.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@ date: '2024-11-14'
44
lastmod: '2024-11-17T18:37:43+01:00'
55
categories:
66
- articles
7+
- CSAW
78
tags:
8-
- esc
99
- csaw
10+
- esc
1011
authors:
1112
- Titto
1213
---

‎content/posts/csaw-quals-18-doubletrouble/index.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ categories:
77
- csawquals18
88
tags:
99
- pwn
10+
- csaw
1011
authors:
1112
- malweisse
1213
---

‎content/posts/flare-on-2017-writeups/index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Flare-On 2017 writeups
33
date: '2017-10-14'
44
lastmod: '2023-07-03T19:19:24+02:00'
55
categories:
6-
- articles
6+
- writeup
77
tags:
88
- flare-on
99
authors:

‎content/posts/trend-micro-ctf-2019-libchakracore-so/index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Trend Micro CTF 2019 libChakraCore.so
33
date: '2019-09-09'
44
lastmod: '2019-09-09T22:49:17+02:00'
55
categories:
6-
- articles
6+
- writeup
77
tags:
88
- pwn
99
- jit

‎content/posts/wctf-2019-babypwn/index.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: WCTF 2019 BabyPwn
33
date: '2019-07-06'
44
lastmod: '2019-07-06T15:08:55+02:00'
55
categories:
6-
- articles
6+
- writeup
77
tags:
88
- pwn
99
- crypto
@@ -168,7 +168,7 @@ To do so we have to carefully choose the parameters of the DH key exchange.
168168
In function dh_exchange at 0x00411ae0 we are asked for 3 hex-encoded values
169169
170170
```
171-
p (in hexadecimal, length <= 1000) :
171+
p (in hexadecimal, length <= 1000) :
172172
q (in hexadecimal, length <= 1000) :
173173
g (in hexadecimal, 0x2 <= g <= 0x40 ) :
174174
```
@@ -203,7 +203,7 @@ To at least complete the exchange, our parameters p, q, g need to satisfy some c
203203
if (q_bit_len_ge_200 < 0x200) {
204204
return 0;
205205
}
206-
206+
207207
….
208208
209209
p_min_1_mod_q = __gmpz_divisible_p(p_minus_1,q);
@@ -226,7 +226,7 @@ We will be prompted for g^a and then the server will compute the shared key as g
226226
```c
227227
// function key_exchange@0x00412064
228228
BCryptGenRandom((BCRYPT_ALG_HANDLE)0x0,nonce,0x40,2);
229-
…..
229+
…..
230230
__gmpz_set_str(b,nonce_hex,0x10);
231231
__gmpz_powm(g_to_b,g,b,p);
232232
__gmp_sprintf(local_8c4,&DAT_00418b38,g_to_b);
@@ -237,7 +237,7 @@ We will be prompted for g^a and then the server will compute the shared key as g
237237
238238
### Solution
239239
240-
So we need to find a way to choose g^a so that g^ab mod p = 0x0102030405060708091011121314151617181920212223242526272829303132
240+
So we need to find a way to choose g^a so that g^ab mod p = 0x0102030405060708091011121314151617181920212223242526272829303132
241241
242242
The key insight to solve the challenge is that g^a = b-th root of 0x0102030405060708091011121314151617181920212223242526272829303132 mod p
243243
@@ -259,7 +259,7 @@ So mainly thanks to point 2 and 3 we can use *pohlig hellman* algorithm to solve
259259
260260
To do so we repeatedly
261261
262-
1. generate q as a 0x200 bits prime, then we generate several (in my final exploit ~100) small primes
262+
1. generate q as a 0x200 bits prime, then we generate several (in my final exploit ~100) small primes
263263
2. check that p = 2 * q * primes + 1 is prime
264264
Now that we have the correct p and q we can store them to use in the exploit
265265

0 commit comments

Comments
 (0)