| 00:21:28 | captain_proton | looking at proto.h i think this is going to be really simple |
| 00:36:19 | captain_proton | got it |
| 00:40:16 | captain_proton | hmmmm |
| 00:40:18 | captain_proton | hello!\n |
| 00:46:04 | vogon_jeltz | hehe |
| 00:48:29 | captain_proton | you don't even know what i'm referring to |
| 00:48:47 | captain_proton | sucka |
| 00:50:58 | vogon_jeltz | yes, in fact, I do |
| 00:51:20 | vogon_jeltz | was away playing Quake3 |
| 00:53:20 | captain_proton | you got newbie8? |
| 00:53:42 | vogon_jeltz | no, but I know the problem |
| 00:53:52 | vogon_jeltz | and I'm closing in on the answer |
| 00:56:23 | captain_proton | wishes the ELF text was RW on program load |
| 00:56:37 | vogon_jeltz | hah |
| 00:57:27 | captain_proton | would that not be the coolest thing EVER? |
| 00:57:34 | vogon_jeltz | no |
| 00:57:44 | captain_proton | why not? |
| 00:58:15 | vogon_jeltz | it'd be the security hole to end all security holes |
| 00:58:22 | captain_proton | well, yeah |
| 00:58:24 | captain_proton | but still! |
| 00:58:27 | vogon_jeltz | heh |
| 01:00:59 | vogon_jeltz | ya know, technically, you can write over the ELF header provided it's setuid and has a buffer overflow condition |
| 01:01:19 | captain_proton | can't write backwards yo |
| 01:01:21 | vogon_jeltz | (and its owner has write) |
| 01:01:37 | vogon_jeltz | yes, you can... remember, you can call anything if you can place stuff into the stack |
| 01:01:59 | captain_proton | oh hmmm |
| 01:02:22 | vogon_jeltz | granted, you'd have to pull off an uber-hack to do it, but... |
| 01:03:18 | captain_proton | well, instead of using shellcode, you'd write some asm to jmp to the address in the ELF text |
| 01:03:22 | vogon_jeltz | heh |
| 01:03:28 | captain_proton | oh wait... |
| 01:03:29 | captain_proton | hmmm |
| 01:03:36 | captain_proton | ooh! |
| 01:03:37 | vogon_jeltz | no, I'm talking about overwriting the program on disk |
| 01:03:41 | captain_proton | you could use the lea instruction |
| 01:03:45 | vogon_jeltz | mwahaha |
| 01:03:53 | captain_proton | recoils in fear |
| 01:04:50 | captain_proton | well, first you could write some asm to get the PID |
| 01:04:55 | vogon_jeltz | you want the addy for the IA-32 instruction set? |
| 01:04:56 | captain_proton | then check /proc/xxx/cmd |
| 01:05:00 | captain_proton | sure |
| 01:05:16 | vogon_jeltz | or, better yet, you disassemble it and figure out where argv[0] is stored |
| 01:05:20 | captain_proton | and let the kernel redirect you to the file... |
| 01:05:23 | vogon_jeltz | more portable that way |
| 01:05:39 | captain_proton | argv[0] is dynamic |
| 01:05:45 | vogon_jeltz | uhm, no |
| 01:05:59 | captain_proton | it won't give you the path unless it was called with a path |
| 01:06:24 | vogon_jeltz | http://developer.intel.com/design/pentiumii/manuals/243191.htm |
| 01:06:28 | vogon_jeltz | ahh, true |
| 01:06:37 | captain_proton | i think /proc is the way to go |
| 01:06:46 | captain_proton | that way you can let the kernel resolve the filesystem for you |
| 01:07:00 | vogon_jeltz | k, what is newbie8's problem? (the one you're working on) |
| 01:07:28 | vogon_jeltz | would help, but he doesn't have the password, and he's too lazy to write up a program to solve nub7 |
| 01:08:00 | captain_proton | just want me to give you the password to 8? |
| 01:09:16 | vogon_jeltz | sure |
| 01:09:43 | captain_proton | Geo5yJxh0 |
| 01:09:46 | vogon_jeltz | got it |
| 01:10:09 | captain_proton | nub8 is /usr/bin/noneed2hide |
| 01:10:26 | captain_proton | source is in 9.c (the commented out line shouldn't be) |
| 01:10:43 | captain_proton | i think it needs a buffer overflow + IFS/PATH |
| 01:11:56 | vogon_jeltz | stop it |
| 01:11:57 | vogon_jeltz | :P |
| 01:12:07 | vogon_jeltz | was in the middle of something |
| 01:12:16 | captain_proton | sorry about that :P |
| 01:12:21 | vogon_jeltz | np |
| 01:12:24 | vogon_jeltz | hmm |
| 01:12:33 | vogon_jeltz | want me to try the Aleph One on it? |
| 01:12:56 | captain_proton | sure |
| 01:13:06 | captain_proton | though i don't think it'll work - they use fgets |
| 01:13:21 | vogon_jeltz | meh |
| 01:14:17 | vogon_jeltz | hmm... no |
| 01:15:01 | captain_proton | you didn't delete my code, did you? |
| 01:15:10 | vogon_jeltz | no |
| 01:15:23 | vogon_jeltz | you HCl? :) |
| 01:15:34 | captain_proton | i'm the evil enchilada |
| 01:15:39 | vogon_jeltz | didn't delete anything |
| 01:16:12 | captain_proton | writes newbie8 pts/18 |
| 01:17:01 | vogon_jeltz | :/ |
| 01:18:27 | vogon_jeltz | shared lib replacement doesn't work :P |
| 01:18:58 | captain_proton | ld.so drops LD_PRELOAD if the binary is setuid |
| 01:19:16 | vogon_jeltz | ahh... damn ld-linux people, being all secure and smart |
| 01:19:18 | vogon_jeltz | :) |
| 01:20:52 | vogon_jeltz | hmm |
| 01:21:19 | vogon_jeltz | w00t! can you say symlink? |
| 01:21:26 | vogon_jeltz | tries something |
| 01:21:28 | captain_proton | symlink to WHAT sucka? |
| 01:22:06 | vogon_jeltz | :/ |
| 01:22:14 | vogon_jeltz | didn't work :P |
| 01:22:51 | captain_proton | what were you trying to symlink? |
| 01:23:09 | vogon_jeltz | I was trying to set up a symlink race, and I forgot that it doesn't ask for a path :P |
| 01:23:54 | captain_proton | lmao |
| 01:23:57 | vogon_jeltz | hah |
| 01:24:27 | captain_proton | we need to overflow buf1 into buf2 (each are 200 bytes i think, and the fgets reads 400 chars) |
| 01:24:43 | vogon_jeltz | hmmmmm |
| 01:24:46 | captain_proton | then if we put 'hello\n' into buf2, it'll do system("/bin/ls -la"); |
| 01:24:51 | vogon_jeltz | ahh |
| 01:24:53 | vogon_jeltz | heap overflow |
| 01:25:22 | captain_proton | well, sorta |
| 01:25:25 | captain_proton | it reads into buf1 |
| 01:25:28 | vogon_jeltz | so we need to overflow hello into buf2 and overflow /bin/bash or /bin/pass into the stack |
| 01:25:34 | captain_proton | no |
| 01:25:52 | vogon_jeltz | hmm |
| 01:25:57 | captain_proton | overflow hello\n (does fgets put the newline in the buffer?) into buf1, then use IFS/PATH for ls |
| 01:26:01 | vogon_jeltz | ahh, n/m :P |
| 01:26:04 | vogon_jeltz | got it |
| 01:26:18 | vogon_jeltz | into buf2, you mean? |
| 01:26:37 | captain_proton | into any buffer |
| 01:26:42 | captain_proton | fgets stops reading at a newline |
| 01:26:48 | vogon_jeltz | yeah :/ |
| 01:27:59 | captain_proton | but does it put it in the buffer? if not, this'll be tricky |
| 01:28:13 | vogon_jeltz | hmm |
| 01:29:15 | vogon_jeltz | ahh |
| 01:29:18 | vogon_jeltz | this looks promising |
| 01:30:59 | vogon_jeltz | ah-hah! |
| 01:31:07 | vogon_jeltz | the buffer overflows at 8,193 characters |
| 01:31:24 | captain_proton | fgets only reads 400 though :P |
| 01:32:50 | vogon_jeltz | hacks on it for a sec |
| 01:41:20 | captain_proton | any progress? |
| 01:42:06 | vogon_jeltz | no |
| 01:42:16 | vogon_jeltz | decides to go back to useful coding |
| 01:43:27 | captain_proton | noo |
| 01:45:33 | captain_proton | sweet - got it |
| 01:51:54 | captain_proton | argh another fgets |
| 01:53:31 | captain_proton | wonders exactly what 0xdeadbeef is |
| 02:02:37 | vogon_jeltz | hehe |
| 02:03:18 | captain_proton | from nub9: cmpl $0xdeadbeef,0xfffffff8(%ebp) |
| 02:06:11 | captain_proton | care to help on this next problem? |
| 02:06:55 | vogon_jeltz | no thanks |
| 02:07:26 | captain_proton | bah |
| 02:09:16 | vogon_jeltz | is away: Panic: Aiee, epsoning the whole astroda |
| 02:20:45 | captain_proton | is proud of himself |
| 02:21:27 | captain_proton | talking with one of the mainsource admins, and watching him amazed as i explain what the to-be-exploited program does |
| 02:21:52 | captain_proton | <Blue_Dude> oh wow.. i see .. hehe, hold on ;) |
| 02:49:27 | captain_proton | oh GRRR GRRR GRRR GRRR |
| 02:49:42 | captain_proton | they have SOURCE fucking available for all the problems |
| 04:56:16 | vogon_jeltz | is back (gone 02:46:58) |
| 04:56:35 | vogon_jeltz | moron |
| 04:56:36 | vogon_jeltz | :) |
| 05:00:33 | vogon_jeltz | is away: 24 |
| 05:59:39 | vogon_jeltz | is back (gone 00:59:06) |
| 06:06:35 | captain_proton | wb |
| 06:06:42 | captain_proton | care to help me figure this out? |
| 06:08:52 | captain_proton | lol...JP from antionline is now officially known as 'tfm' |
| 06:18:56 | vogon_jeltz | hehe |
| 06:19:12 | captain_proton | vogon_jeltz: you'll like this problem |
| 06:19:26 | captain_proton | dangles a carrot in front of vogon_jeltz..."its a buffer overflow..." |
| 06:19:39 | vogon_jeltz | hahaha |
| 06:20:31 | captain_proton | and it'll be a lot easier now that we know we have source! |
| 06:20:41 | vogon_jeltz | points out that it'll take ages for cappy to hack up an overflow exploit |
| 06:21:06 | captain_proton | points out that the overflow 'sploit on hackerslab took him 5 minutes |
| 06:21:21 | vogon_jeltz | hah |
| 06:21:31 | captain_proton | want nub9 pass? |
| 06:21:34 | vogon_jeltz | no thanks |
| 06:21:39 | captain_proton | oh come on |
| 06:22:17 | captain_proton | main() |
| 06:22:17 | captain_proton | { char buf2[200]; |
| 06:22:17 | captain_proton | char buf[200]; |
| 06:22:17 | captain_proton | fgets(buf,400,stdin); |
| 06:22:18 | captain_proton | if (!strcmp(buf2,"hello!\n")) |
| 06:22:18 | captain_proton | { |
| 06:22:20 | captain_proton | setreuid(2009,2009); |
| 06:22:21 | vogon_jeltz | hehehe |
| 06:22:22 | captain_proton | system("/bin/tcsh"); |
| 06:22:24 | captain_proton | } |
| 06:22:26 | captain_proton | } |
| 06:22:28 | captain_proton | oops |
| 06:22:30 | captain_proton | wrong one :P |
| 06:22:30 | vogon_jeltz | I'm not using your code |
| 06:22:32 | captain_proton | main() |
| 06:22:34 | captain_proton | { int crap; |
| 06:22:36 | captain_proton | int check; |
| 06:22:38 | captain_proton | char buf[20]; |
| 06:22:40 | captain_proton | fgets(buf,25,stdin); |
| 06:22:42 | captain_proton | if (check==0xdeadbeef) |
| 06:22:44 | captain_proton | { |
| 06:22:46 | captain_proton | setreuid(2010,2010); |
| 06:22:48 | captain_proton | system("/bin/tcsh"); |
| 06:22:50 | captain_proton | } |
| 06:22:52 | captain_proton | } |
| 06:22:56 | captain_proton | this is the proggie to be exploited |
| 06:23:08 | vogon_jeltz | once again, that's a heap overflow |
| 06:23:32 | captain_proton | but *backwards*? |
| 06:23:36 | vogon_jeltz | hehe |
| 06:24:01 | captain_proton | oh wait a sec i'm an idiot |
| 06:24:32 | vogon_jeltz | it's the same freaking program, only you have to push a different value into a different place |
| 06:25:08 | vogon_jeltz | jmp 0x1f |
| 06:25:12 | vogon_jeltz | popl %esi |
| 06:25:21 | vogon_jeltz | movl %esi, 0x8(%esi) |
| 06:25:35 | vogon_jeltz | those are the first 3 instructions of the Aleph One shellcode |
| 06:25:45 | vogon_jeltz | (written in proper GCC inline assembly format) |
| 06:26:06 | captain_proton | don't need no freaking shellcode |
| 06:26:08 | vogon_jeltz | hehe |
| 06:26:20 | vogon_jeltz | you will if you hit an actual buffer overflow |
| 06:26:44 | captain_proton | reminds vogon_jeltz he knows how to smash the stack for fun and profit |
| 06:26:46 | vogon_jeltz | hah |
| 06:26:53 | vogon_jeltz | notes that cappy read the article |
| 06:29:28 | vogon_jeltz | you wanna play a game of Freeciv? |
| 06:29:48 | captain_proton | nah i'm on a roll now that i realized how much of an idiot i am :P |
| 06:29:56 | vogon_jeltz | hahaha |
| 06:30:21 | captain_proton | oh SHIT |
| 06:30:29 | vogon_jeltz | w0t? |
| 06:30:40 | vogon_jeltz | you hit the quota? |
| 06:30:44 | captain_proton | no |
| 06:31:03 | captain_proton | oh wait |
| 06:31:05 | captain_proton | nevermind :) |
| 06:34:36 | captain_proton | hmmm not working... |
| 06:35:55 | captain_proton | ahhh...fixed |
| 06:51:38 | captain_proton | hmmm...how to pull a pointer out of the air... |
| 07:16:54 | captain_proton | vogon_jeltz: still here? |
| 07:17:39 | vogon_jeltz | yeah |
| 07:17:59 | vogon_jeltz | I'll be damned if I help you before you play Freeciv against me, tho ;) |
| 07:18:45 | captain_proton | lol |
| 07:18:48 | captain_proton | soon, ok? |
| 07:19:02 | vogon_jeltz | k |
| 07:19:11 | vogon_jeltz | get 1.12.0 from freeciv.org, btw |
| 07:19:38 | captain_proton | how big? |
| 07:19:57 | vogon_jeltz | less than 4 megs |
| 07:20:52 | captain_proton | hmmm it'll be a while then |
| 07:21:17 | vogon_jeltz | it's only about 10-15 minutes to DL on my box |
| 07:35:36 | captain_proton | cries as all his bandwidth is used up |
| 07:35:43 | vogon_jeltz | hah |
| 07:36:09 | captain_proton | remembers why he despises dialup |
| 07:36:13 | vogon_jeltz | hehe |
| 07:38:58 | captain_proton | care to help work this problem while its downloading? |
| 07:40:45 | vogon_jeltz | meh |
| 07:41:16 | captain_proton | main() |
| 07:41:18 | captain_proton | { int crap; |
| 07:41:18 | captain_proton | int *check; |
| 07:41:19 | captain_proton | char buf[20]; |
| 07:41:19 | captain_proton | fgets(buf,25,stdin); |
| 07:41:19 | captain_proton | if (*check==0xdeadbeef) |
| 07:41:20 | captain_proton | { |
| 07:41:22 | captain_proton | setreuid(2011,2011); |
| 07:41:23 | vogon_jeltz | yeah, I know |
| 07:41:23 | captain_proton | system("/bin/tcsh"); |
| 07:41:25 | captain_proton | } |
| 07:41:28 | captain_proton | } |
| 07:41:30 | captain_proton | need to somehow get the address of buf |
| 07:45:56 | captain_proton | thoughts? |
| 07:47:13 | vogon_jeltz | ever heard of objdump? |
| 07:47:15 | captain_proton | btw, so you can run it, newbie10's pwd is 4Eh7hcMwb |
| 07:47:20 | captain_proton | no |
| 07:47:27 | captain_proton | i've been trying to get it to dump core |
| 07:47:36 | captain_proton | its being stubborn |
| 07:49:21 | captain_proton | SAWEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEETTTTTTTTTTTTTTTTTTT |
| 07:49:28 | vogon_jeltz | :) |
| 07:49:50 | vogon_jeltz | objdump? |
| 07:49:52 | captain_proton | brosius' updated patch provides *exactly* what I need for this CTF world I've been working on |
| 07:49:55 | captain_proton | lol |
| 07:49:55 | vogon_jeltz | hah |
| 07:50:04 | captain_proton | actually on topic for once |
| 07:50:26 | vogon_jeltz | 8055d5b: 0f 89 7b ff ff ff jns 8055cdc <drawGroundReceivers__18BackgroundRendererR13SceneRenderer+0x4ac> |
| 07:50:43 | vogon_jeltz | name the program |
| 07:50:48 | captain_proton | bzflag |
| 07:50:51 | vogon_jeltz | hehe |
| 07:51:09 | captain_proton | that one was amazingly easy |
| 07:52:22 | captain_proton | the problem is that /proc/xxx/mem isn't readable |
| 07:52:27 | captain_proton | else i could just gcc it |
| 07:52:30 | captain_proton | oops |
| 07:52:31 | captain_proton | gdb it |
| 07:53:15 | vogon_jeltz | points out that on any fairly secure system, anything that's a subdirectory of process space is unreadable except by root |
| 07:53:30 | vogon_jeltz | you have freeciv yet? |
| 07:53:57 | captain_proton | building it |
| 07:54:50 | captain_proton | uptime wars! |
| 07:54:56 | captain_proton | 12:55am up 2 days, 12:03, 7 users, load average: 1.71, 1.17, 1.03 |
| 07:55:01 | vogon_jeltz | 11:49pm up 9 days, 4:04, 3 users, load average: 0.08, 0.04, 0.01 |
| 07:55:04 | captain_proton | bah |
| 07:55:09 | vogon_jeltz | :) |
| 07:55:36 | vogon_jeltz | all that 0-day ssh war3z|/\/g is killing your uptime |
| 07:55:36 | captain_proton | aside from various gnome applications (gnome-term, xchat, etc), i am completely gnome free |
| 07:55:46 | vogon_jeltz | same here |
| 07:55:58 | vogon_jeltz | has run Blackbox for about 3 months |
| 07:55:58 | captain_proton | 0-day warez on 56k? roflmao |
| 07:56:01 | vogon_jeltz | :) |
| 07:56:12 | captain_proton | runs sawfish with a custom background manager/program launcher |
| 07:56:23 | vogon_jeltz | yeah, I heard |
| 07:56:31 | captain_proton | its purdy |
| 07:56:39 | vogon_jeltz | uses your bg |
| 07:56:48 | captain_proton | all i need is a decent 3d-ish mozilla icon and i'd be set |
| 07:56:53 | vogon_jeltz | (the one with all the brick things) |
| 07:57:12 | captain_proton | well, its a l33t background |
| 07:57:20 | vogon_jeltz | captain_proton: some of the freeciv screenies were taken by someone with a 3D-ish Mozilla icon in their proggy dock |
| 07:58:33 | captain_proton | server? |
| 07:58:38 | vogon_jeltz | mine |
| 07:58:46 | captain_proton | IP? |
| 07:58:49 | vogon_jeltz | freeciv isn't that bandwidth-intensive |
| 07:58:50 | vogon_jeltz | wait a sec |
| 07:58:58 | vogon_jeltz | it'll be at fortytwo.homeip.net |
| 07:59:31 | captain_proton | port 5555? |
| 07:59:33 | vogon_jeltz | get 1.20 |
| 07:59:35 | vogon_jeltz | 1.12, rather |
| 07:59:44 | captain_proton | i did |
| 07:59:48 | vogon_jeltz | 2: Connection request from evil enchilada from s172-210.denver.webaccess.net |
| 07:59:48 | vogon_jeltz | 2: evil enchilada has client version 1.11.4 |
| 07:59:48 | vogon_jeltz | 2: evil enchilada was rejected: Mismatched capabilities. |
| 08:00:32 | captain_proton | hmmm maybe i'm using the wrong binary |
| 08:00:47 | vogon_jeltz | remove the version that came with RH |
| 08:00:52 | vogon_jeltz | rpm -e freeciv |
| 08:02:14 | vogon_jeltz | hi |
| 08:02:18 | captain_proton | ahhh |
| 08:55:18 | MIKE{wb} | anybody here? |
| 08:55:23 | captain_proton | sortof |
| 08:55:28 | MIKE{wb} | heya cap |
| 08:55:41 | MIKE{wb} | i finally got server 1.7e4 working |
| 08:55:49 | MIKE{wb} | where can i find maps for it? |
| 08:56:24 | MIKE{wb} | it uses degree's instead of radians, and it won't use the rad maps |
| 08:57:11 | captain_proton | it comes with a perl script to convert maps |
| 08:57:41 | MIKE{wb} | really? |
| 08:57:46 | MIKE{wb} | how do i use it? |
| 08:58:55 | captain_proton | script <file> |
| 08:59:02 | captain_proton | well maybe not |
| 08:59:03 | captain_proton | let me check |
| 08:59:24 | MIKE{wb} | tanks for checkin on it |
| 08:59:30 | captain_proton | you're on some form of UNIX? |
| 09:00:15 | MIKE{wb} | mandrake linux |
| 09:00:37 | MIKE{wb} | far superior to winbloze |
| 09:00:40 | MIKE{wb} | hehe |
| 09:00:44 | captain_proton | ok |
| 09:00:50 | captain_proton | script < oldmap > newmap |
| 09:00:57 | captain_proton | its called bzwcvt.pl or something like that |
| 09:01:00 | captain_proton | should be in the misc dir |
| 09:01:12 | MIKE{wb} | ok, does the map have to be in that dir? |
| 09:01:51 | captain_proton | you can give it absolute paths for the maps |
| 09:02:41 | MIKE{wb} | ok |
| 09:02:46 | MIKE{wb} | tanks again |
| 09:46:55 | vogon_jeltz | you lost! :P |
| 09:47:19 | vogon_jeltz | you snooze, you lose ;) |
| 09:48:36 | vogon_jeltz | that synchronized turns thing sucks ass, tho |
| 09:49:58 | captain_proton | its as good as it can possibly be |
| 09:50:04 | vogon_jeltz | :P |
| 09:50:09 | captain_proton | turn-based multiplayer games suck |
| 09:50:12 | vogon_jeltz | hahaha |
| 09:50:20 | vogon_jeltz | not if you strictly impose a time limit |
| 09:50:24 | vogon_jeltz | is away: TV |
| 09:54:15 | captain_proton | new mozilla... |
| 10:51:57 | BZFlag | 3:53am up 31 days, 4:29, 1 user, load average: 0.08, 0.03, 0.01 |
| 20:23:46 | abs | lo fellas |
| 20:54:36 | vogon_jeltz | is back (gone 11:04:08) |