ASIS CTF Quals 2015 - Sawthis Writeup - Srand Remote Prediction

The remote service ask for a name, if you send more than 64 bytes, a memory leak happens.
The buffer next to the name's is the first random value used to init the srand()

If we get this value, and set our local srand([leaked] ^ [luckyNumber]) we will be able to predict the following randoms and win the game, but we have to see few details more ;)

The function used to read the input until the byte \n appears, but also up to 64 bytes, if we trigger this second condition there is not 0x00 and the print shows the random buffer :)

The nickname buffer:



The seed buffer:



So here it is clear, but let's see that the random values are computed with several gpu instructions which are decompiled incorrectly:







We tried to predict the random and aply the gpu divisions without luck :(



There was a missing detail in this predcitor, but there are always other creative ways to do the things.
We use the local software as a predictor, we inject the leaked seed on the local binary of the remote server and got a perfect syncronization, predicting the remote random values:




The process is a bit ugly becouse we combined automated process of leak exctraction and socket interactive mode, with the manual gdb macro.

The macro:

Continue reading

1. Hacker
2. Pentest Recon Tools
3. Hack Tools For Mac
4. Hacking Tools 2020
5. Hacking Tools Windows 10
6. Pentest Tools Nmap
7. Hacker Tools Hardware
8. Github Hacking Tools
9. Install Pentest Tools Ubuntu
10. Hack Tools
11. Tools For Hacker
12. Black Hat Hacker Tools
13. Growth Hacker Tools
14. Hackrf Tools
15. Install Pentest Tools Ubuntu
16. Nsa Hack Tools
17. Hack Tools For Ubuntu
18. Pentest Tools Linux
19. Best Hacking Tools 2020
20. Hak5 Tools
21. Pentest Tools Nmap
22. Hacking Tools Free Download
23. Hacker Search Tools
24. Hacker Techniques Tools And Incident Handling
25. Hacker Tools For Ios
26. Hacking Tools Windows
27. Blackhat Hacker Tools
28. How To Hack