# Play with hacking - Stri.pe Capture The Flag **URL:** \ **Category:** NYSpeed Off Topic\ **Created:** [February 23, 2012, 5:54am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710 "2012-02-23T05:54:49Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [February 23, 2012, 5:54am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/1 "2012-02-23T05:54:49Z")
> **[Capture the Flag](https://stripe.com/blog/capture-the-flag)** > > Online payment processing for internet businesses. Stripe is a suite of payment APIs that powers commerce for businesses of all sizes. > The hardest part of writing secure code is learning to think like an attacker. For example, every programmer is told to watch out for SQL injections, but it’s hard to appreciate just how exploitable they are until you’ve written a SQL injection of your own. > > We built Stripe Capture the Flag, a security wargame inspired by SmashTheStack’s IO, to help the community (as well our team!) practice identifying and exploiting common security problems. > > After completing our CTF, you should have a greatly improved understanding of how attackers will try to break your code (and hopefully will have fun in the process!). > > You can begin Stripe’s CTF challenge by running ssh level01@ctf.stri.pe from your shell and entering the password e9gx26YEb2. > > Your goal is to read the contents of /home/level02/.password. In /levels/level01, you’ll find a setuid binary owned by level02 (as well as its source code) — you will probably find it useful. > > Once you have the password, you can ssh in as level02. There are six levels in all; once you’ve logged in as level06 your goal is to read the password from /home/the-flag/.password. > > ⁕ ⁕ ⁕ > > If you’ve successfully captured the flag, let us know at [ctf@stripe.com](mailto:ctf@stripe.com)! We’ll send a special-edition Stripe CTF T-shirt to anyone who successfully captures the flag. Include the following information in your email: > > The password to the-flag. > Code or a brief description of how you escalated through each level. ---
**Author:** ![ProgRocker](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/progrocker/32/5434_2.png) [@ProgRocker](https://forums.speedlife.net/u/ProgRocker)\ **Post date:** [February 23, 2012, 6:36am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/2 "2012-02-23T06:36:18Z")
After reading the description… I give up. ---
**Author:** ![Neon](https://avatars.discourse-cdn.com/v4/letter/n/f19dbf/32.png) [@Neon](https://forums.speedlife.net/u/Neon)\ **Post date:** [February 23, 2012, 6:40am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/3 "2012-02-23T06:40:36Z")
eli7e h4x0r ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [February 23, 2012, 7:20am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/4 "2012-02-23T07:20:06Z")
I got up to level 3 so far. First 2 are pretty easy. First one is a sudo explot and the second is a PHP Session/Cookie hack Little more difficult than guessing a friends FB password =) ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [February 23, 2012, 7:23am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/5 "2012-02-23T07:23:27Z")
The box is getting hammered. Hard to do anything on it. hmmm…how do you trick level03.c into executing the run() function? ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [February 23, 2012, 8:30am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/6 "2012-02-23T08:30:21Z")
I just got back from out of town I will mess with this shortly ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [February 23, 2012, 8:39am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/7 "2012-02-23T08:39:14Z")
looks like level 3 requires messing with memory locations and the pointer they setup… it’s a bit over my head for sure. ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [February 23, 2012, 8:51am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/8 "2012-02-23T08:51:54Z")
^^ buffer overflows and null pointers =) This is where my ssh connection kicked me. Will play more tonight. ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [February 23, 2012, 8:56am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/9 "2012-02-23T08:56:04Z")
I assume the box isn’t using address layout randomization so its just a simple buffer over flow that needs to be fuzzed? control EIP and win? Is the binary suid? ---
**Author:** ![jeffthespasm](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/jeffthespasm/32/3153_2.png) [@jeffthespasm](https://forums.speedlife.net/u/jeffthespasm)\ **Post date:** [February 23, 2012, 9:24am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/10 "2012-02-23T09:24:24Z")
I’ll give this a shot later… > **[Exploits of a Mom](https://xkcd.com/327/)** > > Her daughter is named Help I'm trapped in a driver's license factory. (Someone fork-bombed this and brought everything to a grinding halt… hah. [http://www.reddit.com/r/programming/comments/q1qii/want\_to\_try\_your\_hand\_at\_writing\_exploits\_try/c3u09kc](http://www.reddit.com/r/programming/comments/q1qii/want_to_try_your_hand_at_writing_exploits_try/c3u09kc)) ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [February 23, 2012, 10:31am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/11 "2012-02-23T10:31:08Z")
> [@LZ](#): > > I assume the box isn’t using address layout randomization so its just a simple buffer over flow that needs to be fuzzed? control EIP and win? > > Is the binary suid? Acutally, the /r/netsec guys said it is using randomization IIRC yes, the binary is suid, so if you get it to call the run function and pass it something runable, you’ll be able to get at the .password file. I really have never researched or learned about buffer overflows. ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [February 23, 2012, 2:22pm UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/12 "2012-02-23T14:22:18Z")
Maybe you need to run it with a debugger like GDB? ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [February 23, 2012, 5:07pm UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/13 "2012-02-23T17:07:43Z")
Ok so now that I slept level 1 is easy… Just export a new path and create a script to cat the password file. ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [February 23, 2012, 5:15pm UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/14 "2012-02-23T17:15:52Z")
yep, that was a good an easy lesson for script writers to learn why they should use full paths when calling executable in code. And yeah, level3 will likely require debugging…gonna have to go back and learn/re-learn that stuff. ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [February 23, 2012, 5:27pm UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/15 "2012-02-23T17:27:14Z")
I need to figure out level2 I assume you fuck around with the cookie since it opens a file I guess that or the user agent… Work said I can spend tomorrow fucking around with it lol ---
**Author:** ![Jack](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/jack/32/7613_2.png) [@Jack](https://forums.speedlife.net/u/Jack)\ **Post date:** [February 23, 2012, 5:38pm UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/16 "2012-02-23T17:38:28Z")
> [@ProgRocker](#): > > After reading the description… I give up. I agree. Know what? If they can get into my shit, they can have it. lol. ---
**Author:** ![boxxa](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/boxxa/32/5045_2.png) [@boxxa](https://forums.speedlife.net/u/boxxa)\ **Post date:** [February 24, 2012, 6:27am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/17 "2012-02-24T06:27:36Z")
> [@LZ](#): > > Ok so now that I slept level 1 is easy… > > Just export a new path and create a script to cat the password file. Your welcome. > [@LZ](#): > > I need to figure out level2 I assume you fuck around with the cookie since it opens a file > > I guess that or the user agent… > > Work said I can spend tomorrow fucking around with it lol Level 2 was easier for me being a web app guy. Here is a hint, look at this line. The output is displaying a local file and passes in a string from a cookie without doing any checks. You need a tool for Chrome/Firefox that will let you edit a cookie that gets set. $out = file\_get\_contents(‘/tmp/level02/’.$\_COOKIE[‘user\_details’]); ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [February 24, 2012, 7:04am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/18 "2012-02-24T07:04:18Z")
There is another way to alter the cookie…I won’t hint at it though, since I cheated ---
**Author:** ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)\ **Post date:** [February 24, 2012, 10:52am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/19 "2012-02-24T10:52:09Z")
![http://dshaw.net/cray.jpg](http://dshaw.net/cray.jpg) ---
**Author:** ![boardjnky4](https://avatars.discourse-cdn.com/v4/letter/b/96bed5/32.png) [@boardjnky4](https://forums.speedlife.net/u/boardjnky4)\ **Post date:** [February 24, 2012, 11:08am UTC](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710/20 "2012-02-24T11:08:04Z")
fyi, this whole thing has got me looking at other capture the flags, which led to me needing to learn how buffer overflow attacks work…which lead to my mind being blown if anyone wants info on buffer overflows, I highly suggest fuzzynop’s channel on youtube, watch “buffer over tutorial 1-8” also, get the livecd for the book “Art of Exploitation” here [http://nostarch.com/hacking2.htm#toc](http://nostarch.com/hacking2.htm#toc) after watching and learning the above method, I was able to exploit a buffer overflow vuln :tup: [Next page](https://forums.speedlife.net/t/play-with-hacking-stri-pe-capture-the-flag/220710.md?page=2)