[MCSC] evilpython2-100pts - Writeup [/PWN]

After Solving the crackme2 challenge, I try to solve evilpython2-100pts.

This time, they also provide the source code



there are UNWANTED variable in this challenge.
but I try to use the payload that used in evilpython-50pts challenge.
that payload still working!!



Flag : mcsc{exec_is_evil_t00}
Bingo!





Thank For Reading.

This is fourth challenge that I solved in MCSC2018.

And the first solver team of that challenge, so we got another bonus (1 point ).

I want to say thank you to challenge creator.

[MCSC] CrackMe02-100pts - Writeup [/REVERSING]

At that time, I decided to solve that challenge!







When I downloaded the challenge file,
the challenge provided with two files( binary exe and library dll ) all are written with c#.
I quick lookup with CFF Explorer.



So we need to debug/decompiler.
And I used dnspy, that is a great tool for debug for c# program.

When I open binary exe with dnspy, I click the main entry point,



the main binary load another dll file ( System.Data.Win32.dll ) with ( Systems.Load.
And I clicked on "new D34783ADEFF89289127037FED9()", that debugger load another dll file ( System.Data.Win32.dll ), cool!
When dll file loaded, the program will start "InitializeComponent()"

 

wait!

In Line num 55 : this.label1.Text = Window.Forms("Sqfpp#Bmz#Hfz#wl#dvfpp##FBPWFQ#FDD-", 3);
That should be a plain text!
So there must decrypt function in dll file.

but there is another interesting key event hander
1 >           base.KeyDown += new KeyEventHandler(this.D34783ADEFF89289127037FED9_2);
2 >            base.KeyPress += new KeyPressEventHandler(this.D34783ADEFF89289127037FED9_1);

 

hum!
when we press Control+Alt+Shit+Keys.0D(0)

Applications.Exit() function will execute

OR
when press any key
Applications.Resume() function will execute

Note : " don't confuse with Application.Exit(), this just Application no char s"
let check what are these!



And I set the break point on both function.

And I debug the program, I press any key on my keyboard because I want to debug the Applications.Resume() function first.

The debugger break in Resume() breakpoint.



Press F11 on debugger ( that will debug to step into)
And I saw the decrypt function.



After set breakpoint in return line the stringbuilder2 variable, and I Press F5 stringbuilder2 variable become "wrong key"



ok just press F5 to continue the program.
let debug the Applications.Exit() function, So I press Ctrl+Alt+Shit+0,
The debugger break at Applications.Exit() function.
press F5 to continue,the debugger break at return stringBuilder2.ToString()
and I saw the flag in stringBuilder2 variable.
Yay!



flag : Myanmar_Cyber_Security_Challenge






Thank For Reading.

This is third challenge that I solved in MCSC2018.

And the first solver team of that challenge, so we got another bonus (1 point ).

I want to say thank you to Ko Myo Myint Htike who created this challenge.

[MCSC] evilpython 50pts - Writeup[/PWN]

Now I going to write about evilpython pwn writeup from Myanmar Cyber Security Challenge 2018.

 

 

Hint - "Evil exists not only in hell"

Now time to test!

I just connect with my nc( netcat client ) to server that running evilpython.

first I submit "123" to server.

the server response back to me "123"

Now I try to submit some payload "1-2"

the server response back to me "-1", Opps!

why response back "-1".

And try to reconnect to server with nc and don't type anything just press Enter.

I got some error.

I know the backend running python script execute with eval function to our input variable age. 

evil_age = eval(age)

I quick look up in google and I found the python payload like that

"[].__class__.__base__.__subclasses__()[59].__init__.func_globals['linecache'].__dict__.values()[12].__dict__.values()[144]('id')"

uid=1000(pyevil)

bingo! we executed "id" command to server, Now I need to find the flag in server.

the evil python script is running under pyevil user privilege, so the flag will be under pyevil home folder ( just I guess ), let search the flag in home folder.  

Now I found the flag path, let read the flag.

flag : mcsc{eval_is_s0_ev!l}

Thanks For reading.

This is second challenge that I solved in MCSC2018.

And the first solver team of that challenge, so we got another bonus (1 point ).

Note : I forget to read evil.py script!

I want to say thank you to Ko ******* who created this challenge.

[MSCS] Lucky Draw 50pts-Writeup [/WEB]

After competition started about 9:03 min, The first challenge came out with reversing (crackme1) challenge. I just look up that challenge but I can't handle. And I trying to solve that challenge, At this moment in time one of
my team member said to me there is another challenge known as web challenge ( lucky draw 50pt ). I quickly open the challenge link, The challenge description says.




Now, Testing time!
After I opened challenge link.



There is also provide challenge source code. cool!

 





Here is the code logic of that challenge.

In line no 36 > variable "number" is initialize from user input, if user input is not numbers, "number" is set to 0.
In line no 37 > variable "random" is generate by using rand php function between 1000 to 10000.
In line no 38 > compare generated random value with user input number.
If equal we will get the flag!

Here is one condition, you can't predict the random number generated from rand function but you can brute force the certain number ;)

so, let take the your lucky number,
first, I took 2222 as my lucky number and I try to brute force with curl command.
check the command in below pic.




Note ( "gp" is "grep" command )

after 2 min, we can't see the flag

I try to change another number "2222" to "8085".

and I got the flag.



See! we successfully submit the correct value twice within two minutes.



The first challenge that I solved in MCSC2018.
And the first solver team of that challenge, so we got another bonus (1 point ).

I want to say thank you to Ko Min Ko Ko who created this challenge.