[MCSC] evilpython2-100pts - Writeup [/PWN]

After Solving the crackme2 challenge, I try to solve evilpython2-100pts.

This time, they also provide the source code



there are UNWANTED variable in this challenge.
but I try to use the payload that used in evilpython-50pts challenge.
that payload still working!!



Flag : mcsc{exec_is_evil_t00}
Bingo!





Thank For Reading.

This is fourth challenge that I solved in MCSC2018.

And the first solver team of that challenge, so we got another bonus (1 point ).

I want to say thank you to challenge creator.

[MCSC] evilpython 50pts - Writeup[/PWN]

Now I going to write about evilpython pwn writeup from Myanmar Cyber Security Challenge 2018.

 

 

Hint - "Evil exists not only in hell"

Now time to test!

I just connect with my nc( netcat client ) to server that running evilpython.

first I submit "123" to server.

the server response back to me "123"

Now I try to submit some payload "1-2"

the server response back to me "-1", Opps!

why response back "-1".

And try to reconnect to server with nc and don't type anything just press Enter.

I got some error.

I know the backend running python script execute with eval function to our input variable age. 

evil_age = eval(age)

I quick look up in google and I found the python payload like that

"[].__class__.__base__.__subclasses__()[59].__init__.func_globals['linecache'].__dict__.values()[12].__dict__.values()[144]('id')"

uid=1000(pyevil)

bingo! we executed "id" command to server, Now I need to find the flag in server.

the evil python script is running under pyevil user privilege, so the flag will be under pyevil home folder ( just I guess ), let search the flag in home folder.  

Now I found the flag path, let read the flag.

flag : mcsc{eval_is_s0_ev!l}

Thanks For reading.

This is second challenge that I solved in MCSC2018.

And the first solver team of that challenge, so we got another bonus (1 point ).

Note : I forget to read evil.py script!

I want to say thank you to Ko ******* who created this challenge.

[MSCS] Lucky Draw 50pts-Writeup [/WEB]

After competition started about 9:03 min, The first challenge came out with reversing (crackme1) challenge. I just look up that challenge but I can't handle. And I trying to solve that challenge, At this moment in time one of
my team member said to me there is another challenge known as web challenge ( lucky draw 50pt ). I quickly open the challenge link, The challenge description says.




Now, Testing time!
After I opened challenge link.



There is also provide challenge source code. cool!

 





Here is the code logic of that challenge.

In line no 36 > variable "number" is initialize from user input, if user input is not numbers, "number" is set to 0.
In line no 37 > variable "random" is generate by using rand php function between 1000 to 10000.
In line no 38 > compare generated random value with user input number.
If equal we will get the flag!

Here is one condition, you can't predict the random number generated from rand function but you can brute force the certain number ;)

so, let take the your lucky number,
first, I took 2222 as my lucky number and I try to brute force with curl command.
check the command in below pic.




Note ( "gp" is "grep" command )

after 2 min, we can't see the flag

I try to change another number "2222" to "8085".

and I got the flag.



See! we successfully submit the correct value twice within two minutes.



The first challenge that I solved in MCSC2018.
And the first solver team of that challenge, so we got another bonus (1 point ).

I want to say thank you to Ko Min Ko Ko who created this challenge.

[Root-Me]Cryptanalysis-Encoding-ASCII[/Solution]

Hello MS

Root Me-Cryptanalysis challenge solution ေလးတင္ေပးလိုက္ပါတယ္ေနာ္ :D

Challenge Link Encoding-ASCII

Level 1 ပါ Challenge ရဲ့ title ကို တစ္ခ်က္ျကည့္လိုက္ ပါမယ္။

Encoding - ASCII

Point ကေတာ့ 5 Points ျဖစ္ပါတယ္။

OK ဗ်ာ။

ေအာက္နားမွာ hint အေနနဲ့ ေပးထားတာကေတာ့

Statement

Decode the string.

အင္း ဒါဆိုရင္ေတာ့ decode လုပ္ရမယ္ဆိုတာကို သိလိုက္ရသလို encode လုပ္ထားတဲ့ msg တစ္ခုကို ေတြ့ရေတာ့မယ္လို့ ယူဆရပါေတာ့မယ္  :P

OK Let start the Challenge

Start the challenge button ေလးကို နိုပ္လိုက္မယ္ဗ်ာ။

file ext က txt file ပဲ ဘာမွေထြေထြ ထူးထူး မရွိပါဘူး (View Page Source တို့ဘာတို့  ျကည့္စရာမလိုပါဘူး )

4C6520666C6167206465206365206368616C6C656E6765206573743A203261633337363438316165353436636436383964356239313237356433323465

က်ြန္ေတာ္ အေပါ္မွာ ေျပာထားသလိုပါပဲ encode လုပ္ထားတဲ့ msg တစ္ခုေပါ့ဗ်ာ။

msg ကိုေသေသခ်ာခ်ာ ျကည့္လိုက္ပါ။

0-E ( 0-F hex encode ) စာလံုးေတြပါေနတယ္။

hex encode စာလံုးေတြဆိုတာ သိရပါမယ္။ ( ASCII Char ေတြကို hex encode လုပ္ထားတာ )

ok ဗ်ာ။

decode processing ေလးလုပ္ရေအာင္။ :D

decode process ေတြ အမ်ားျကီးရွိပါတယ္။

hackbar ကန hex decode လုပ္ရသလို

python language ကို သံုးျပီး decode လုပ္လို့ရပါတယ္ ကိုသန္ရာ သန္ရာေပါ့ :P

( တျခား programming language ေတြ သံုးျပီးလဲ decode လုပ္လို့ရတယ္ ေနာ္  )

hackbar ကေန လုပ္တက္မယ္ထင္ပါတယ္။ မေျပာျပေတာ့ပါဘူး

python ကေန ဘယ္လိုလုပ္လဲ ဆိုတာ ေျပာျပခ်င္ပါတယ္ :bh:

အရင္ဆံုး

1 - python shell တစ္ခုဖြင့္လိုက္ပါ

2 - variable တစ္ခုထဲ ကို encode msg assign လုပ္လိုက္ပါမယ္။

3 - encode msg assign လုပ္ထားတဲ့ variable ကို decode လုပ္ပါမယ္

Done :dance:

ans

Le flag de ce challenge est: 2ac376481ae546cd689d5b91275d324e

Le flag de ce challenge est ကေတာ့ French Language နဲ့ ေရးထားတာျဖစ္ပါတယ္။

Google Translate ကေနဘာသာျပန္လိုက္ရေတာ့ ေအာက္ကလိုမ်ိုး English Language နဲ့ဆိုရင္ေတာ့

Flag အေနနဲ့ ရမွာျဖစ္ပါတယ္

The flag of this challenge is: 2ac376481ae546cd689d5b91275d324e

---

Thanks For Reading

---