Minutes 2024-12-05 - Revision history

DangerDC: i added a section for solutions then realized idk if we have the mediawiki spoiler extension

2024-12-10T00:51:08Z

i added a section for solutions then realized idk if we have the mediawiki spoiler extension

← Older revision		Revision as of 00:51, 10 December 2024
Line 23:		Line 23:
	## Josh had to disable every security measure in the compiler (such as stack canaries), as well as ASLR on the system for the challenge to even work		## Josh had to disable every security measure in the compiler (such as stack canaries), as well as ASLR on the system for the challenge to even work
	### There are a lot of mechanisms nowadays to prevent these exact vulnerabilities		### There are a lot of mechanisms nowadays to prevent these exact vulnerabilities
			#Solutions to challenges:
			##<code>chal0</code>:
			##<code>chal00</code>:
			##<code>chal1</code>:
	# Some news		# Some news
	## We got the subnet from IT!		## We got the subnet from IT!

D2wn at 09:59, 6 December 2024

2024-12-06T09:59:19Z

← Older revision		Revision as of 09:59, 6 December 2024
Line 6:		Line 6:
	#### Reset it after the meeting		#### Reset it after the meeting
	## <code>chal0</code>		## <code>chal0</code>
	### input is stdin		### input is <code>stdin</code>
	### set pointer to 0xDEADBEEF		### set pointer to <code>0xDEADBEEF</code>
	## <code>chal00</code>		## <code>chal00</code>
	### input is argv[0]		### input is <code>argv[0]</code>
	### 29 byte offset for integer		### 29 byte offset for integer
	### 4 bytes for EDP		### 4 bytes for EDP
Line 25:		Line 25:
	# Some news		# Some news
	## We got the subnet from IT!		## We got the subnet from IT!
	### It'll be a /27 (32 theoretical IPs, probably ~28 usable)		### It'll be a <code>/27</code> (32 theoretical IPs, probably ~28 usable)
	### It's not impossible for student orgs to manage their own domains too		### It's not impossible for student orgs to manage their own domains too
	#### However all subdomains need to be approved by the University's Marketing and Resources department		#### However all subdomains need to be approved by the University's Marketing and Resources department

D2wn: Added to Meeting Minutes Category

2024-12-06T09:57:48Z

Added to Meeting Minutes Category

← Older revision		Revision as of 09:57, 6 December 2024
Line 37:		Line 37:
	#### Ron will ask around		#### Ron will ask around
	### Jesse +1'd SartenX's recommendation asking Hydata for a free license as students		### Jesse +1'd SartenX's recommendation asking Hydata for a free license as students
			[[Category:Meeting Minutes]]

D2wn: fixed up unfinished notes and added some more content

2024-12-06T09:57:21Z

fixed up unfinished notes and added some more content

← Older revision		Revision as of 09:57, 6 December 2024
Line 1:		Line 1:
			# Alex showed up for the first time in a while
	# Jesse (from IT) ~~and Alex~~ showed up!		# Jesse (from IT) showed up!
	# Josh's presentation on Linux buffer overflows!
			# Josh's presentation on Linux buffer overflows [https://docs.google.com/presentation/d/1d3SiXnAacS5PeexusyiQWOLgdcf_MXyxOBSMpc6mIdM/edit#slide=id.p]
	## ssh into shell, then <code>cd /home/jhstiebe/chal</code>		## ssh into shell, then <code>cd /home/jhstiebe/chal</code>
	### Used Arney's account as temp for a non-member		### Used Arney's account as temp for a non-member...
			#### Reset it after the meeting
	## chal0
			## <code>chal0</code>
	### input is stdin		### input is stdin
	### set ~~value '____'~~ to 0xDEADBEEF		### set pointer to 0xDEADBEEF
	## chal00		## <code>chal00</code>
	### input is argv[0]		### input is argv[0]
	### 29 ~~bytes~~ for ~~____~~		### 29 byte offset for integer
	### 4 bytes for EDP		### 4 bytes for EDP
	## These are 32-bit binaries		## These are 32-bit binaries
	### 64-bit binaries have registers and gadgets instead of a 'stack', "return-oriented programming"		### 64-bit binaries have registers and gadgets instead of a 'stack', "return-oriented programming"
	## chal1		## <code>chal1</code>
			###I didn't get this far lol
	###
	## ~~builds~~ are definitely not optimized by the compiler		## Builds are definitely not optimized by the compiler
	### might even be compiled as debug		### They might even be compiled as debug
	## compiler freaked out about <code>gets</code> but not <code>strcpy</code>		## compiler freaked out about <code>gets</code> but not <code>strcpy</code>
	### libc doesn't even implement it but still gives a bunch of warnings ~~when~~ ~~reimplementing~~		### libc doesn't even implement it but still gives a bunch of warnings if you import it yourself
	### Josh compiled it with default gcc C standard library version, might have worked if he used C99		### Josh compiled it with default gcc C standard library version, <code>gets</code> might have worked if he used C99
			## Josh had to disable every security measure in the compiler (such as stack canaries), as well as ASLR on the system for the challenge to even work
			### There are a lot of mechanisms nowadays to prevent these exact vulnerabilities
	# Some news		# Some news
	## We got the subnet from IT!		## We got the subnet from IT!
	### It'll be a /27		### It'll be a /27 (32 theoretical IPs, probably ~28 usable)
	### It's not impossible for student ~~porgs~~ to ~~anage~~ their own domains too		### It's not impossible for student orgs to manage their own domains too
	#### ~~Managed~~ by University Marketing and Resources		#### However all subdomains need to be approved by the University's Marketing and Resources department
			#### I suspect this is why all student orgs I know of just buy their own domain and use that instead

			##### ITO with [https://www.itoxygen.com/ itoxygen.com]

			##### LUG with [https://linuxusers.group/ linuxusers.group]

			##### NCSA with [https://ncsa.tech/ ncsa.tech]
	Solutions:
			##### WMTU with [https://wmtu.fm/ wmtu.fm]
			## [[Locked HGST drives\|The HGST drive hacking]] continues....
			### Jesse says someone in the university might have a license to SCSITools
			#### Ron will ask around
			### Jesse +1'd SartenX's recommendation asking Hydata for a free license as students

D2wn: initial commit

2024-12-06T01:34:09Z

initial commit

New page

# Jesse (from IT) and Alex showed up!
# Josh's presentation on Linux buffer overflows!
## ssh into shell, then <code>cd /home/jhstiebe/chal</code>
### Used Arney's account as temp for a non-member
## chal0
### input is stdin
### set value '____' to 0xDEADBEEF
## chal00
### input is argv[0]
### 29 bytes for ____
### 4 bytes for EDP
## These are 32-bit binaries
### 64-bit binaries have registers and gadgets instead of a 'stack', "return-oriented programming"
## chal1
###
## builds are definitely not optimized by the compiler
### might even be compiled as debug
## compiler freaked out about <code>gets</code> but not <code>strcpy</code>
### libc doesn't even implement it but still gives a bunch of warnings when reimplementing
### Josh compiled it with default gcc C standard library version, might have worked if he used C99
# Some news
## We got the subnet from IT!
### It'll be a /27
### It's not impossible for student porgs to anage their own domains too
#### Managed by University Marketing and Resources

Solutions: