Minutes 2024-12-05: Difference between revisions

From MTU LUG Wiki
Jump to navigation Jump to search
(initial commit)
 
(i added a section for solutions then realized idk if we have the mediawiki spoiler extension)
 
(3 intermediate revisions by one other user not shown)
Line 1: Line 1:
# Alex showed up for the first time in a while
# Jesse (from IT) and Alex showed up!
# Jesse (from IT) showed up!
# Josh's presentation on Linux buffer overflows!
# Josh's presentation on Linux buffer overflows [https://docs.google.com/presentation/d/1d3SiXnAacS5PeexusyiQWOLgdcf_MXyxOBSMpc6mIdM/edit#slide=id.p]
## ssh into shell, then <code>cd /home/jhstiebe/chal</code>
## ssh into shell, then <code>cd /home/jhstiebe/chal</code>
### Used Arney's account as temp for a non-member
### Used Arney's account as temp for a non-member...
#### Reset it after the meeting
## chal0
## <code>chal0</code>
### input is stdin
### input is <code>stdin</code>
### set value '____' to 0xDEADBEEF
### set pointer to <code>0xDEADBEEF</code>
## chal00
## <code>chal00</code>
### input is argv[0]
### input is <code>argv[0]</code>
### 29 bytes for ____
### 29 byte offset for integer
### 4 bytes for EDP
### 4 bytes for EDP
## These are 32-bit binaries
## These are 32-bit binaries
### 64-bit binaries have registers and gadgets instead of a 'stack', "return-oriented programming"
### 64-bit binaries have registers and gadgets instead of a 'stack', "return-oriented programming"
## chal1
## <code>chal1</code>
###I didn't get this far lol
###
## builds are definitely not optimized by the compiler
## Builds are definitely not optimized by the compiler
### might even be compiled as debug
### They might even be compiled as debug
## compiler freaked out about <code>gets</code> but not <code>strcpy</code>
## compiler freaked out about <code>gets</code> but not <code>strcpy</code>
### libc doesn't even implement it but still gives a bunch of warnings when reimplementing
### libc doesn't even implement it but still gives a bunch of warnings if you import it yourself
### Josh compiled it with default gcc C standard library version, might have worked if he used C99
### Josh compiled it with default gcc C standard library version, <code>gets</code> might have worked if he used C99
## Josh had to disable every security measure in the compiler (such as stack canaries), as well as ASLR on the system for the challenge to even work
### There are a lot of mechanisms nowadays to prevent these exact vulnerabilities
#Solutions to challenges:
##<code>chal0</code>:
##<code>chal00</code>:
##<code>chal1</code>:
# Some news
# Some news
## We got the subnet from IT!
## We got the subnet from IT!
### It'll be a /27
### It'll be a <code>/27</code> (32 theoretical IPs, probably ~28 usable)
### It's not impossible for student porgs to anage their own domains too
### It's not impossible for student orgs to manage their own domains too
#### Managed by University Marketing and Resources
#### However all subdomains need to be approved by the University's Marketing and Resources department
#### I suspect this is why all student orgs I know of just buy their own domain and use that instead

##### ITO with [https://www.itoxygen.com/ itoxygen.com]

##### LUG with [https://linuxusers.group/ linuxusers.group]

##### NCSA with [https://ncsa.tech/ ncsa.tech]
Solutions:
##### WMTU with [https://wmtu.fm/ wmtu.fm]
## [[Locked HGST drives|The HGST drive hacking]] continues....
### Jesse says someone in the university might have a license to SCSITools
#### Ron will ask around
### Jesse +1'd SartenX's recommendation asking Hydata for a free license as students
[[Category:Meeting Minutes]]

Latest revision as of 19:51, 9 December 2024

  1. Alex showed up for the first time in a while
  2. Jesse (from IT) showed up!
  3. Josh's presentation on Linux buffer overflows [1]
    1. ssh into shell, then cd /home/jhstiebe/chal
      1. Used Arney's account as temp for a non-member...
        1. Reset it after the meeting
    2. chal0
      1. input is stdin
      2. set pointer to 0xDEADBEEF
    3. chal00
      1. input is argv[0]
      2. 29 byte offset for integer
      3. 4 bytes for EDP
    4. These are 32-bit binaries
      1. 64-bit binaries have registers and gadgets instead of a 'stack', "return-oriented programming"
    5. chal1
      1. I didn't get this far lol
    6. Builds are definitely not optimized by the compiler
      1. They might even be compiled as debug
    7. compiler freaked out about gets but not strcpy
      1. libc doesn't even implement it but still gives a bunch of warnings if you import it yourself
      2. Josh compiled it with default gcc C standard library version, gets might have worked if he used C99
    8. Josh had to disable every security measure in the compiler (such as stack canaries), as well as ASLR on the system for the challenge to even work
      1. There are a lot of mechanisms nowadays to prevent these exact vulnerabilities
  4. Solutions to challenges:
    1. chal0:
    2. chal00:
    3. chal1:
  5. Some news
    1. We got the subnet from IT!
      1. It'll be a /27 (32 theoretical IPs, probably ~28 usable)
      2. It's not impossible for student orgs to manage their own domains too
        1. However all subdomains need to be approved by the University's Marketing and Resources department
        2. I suspect this is why all student orgs I know of just buy their own domain and use that instead
          1. ITO with itoxygen.com
          2. LUG with linuxusers.group
          3. NCSA with ncsa.tech
          4. WMTU with wmtu.fm
    2. The HGST drive hacking continues....
      1. Jesse says someone in the university might have a license to SCSITools
        1. Ron will ask around
      2. Jesse +1'd SartenX's recommendation asking Hydata for a free license as students
Retrieved from "https://lug.mtu.edu/w/index.php?title=Minutes_2024-12-05&oldid=7735"