Security

V8, the JavaScript engine, is largely undocumented. An important source to understand V8 are design documents. To the best of my knowledge, there is no index of all design docs. I made an attempt to create at least a partial index, i.e. all design docs I know of. It is not limited to design docs in the strict sense; more like “Google Doc with details about V8 development”. This is the current state of it.

Python jail escapes have evolved into their own CTF category over the past years. I recently gave a talk and wrote a blog post for my CTF team, where I give an introduction to the topic and show some classical examples. CSAW CTF finals I played with team polyflag, overall the CTF was pretty mid with a lot of guessing and an unacceptable required VPN setup, where we had to install some random VPN client on our machines (with sudo curl .

This is the second part of my adoption of …ing the technical interview. A blog series by Aphyr about writing programs in funny, non-standard ways. Again this is a writeup of a CTF challenge I created. Specifically, the dive in the lake challenge of LakeCTF, organized by the CTF of EPFL polygl0ts. Since, the last technical interview in Java was apparently not enough to get me hired as a performance engineer, I need to go to the binary level.

I really like the blog series …ing the technical interview from Aphyr. Besides the humor, I enjoy seeing Turing completeness in parts of systems that many people use but that were not designed to write entire programs in. Jeg snakker lite norsk and I can’t write anything as funny as the original. But I write CTF challenges from time to time. CTF reverse engineering challenges are the perfect place for implementing such weird things and getting the joy of many people trying to figure it out.

This is a writeup of an easy/medium pwn challenge called “Profile” featuring a type confusion, some GOT overwriting, and a funny but unnecessary one gadget exploit for the fun of it. We are given the following files: main.c profile (binary) Dockerfile docker-compose.yml Let’s look at main.c and see if we can spot a vulnerability from the provided source code. #include <stdio.h> #include <stdlib.h> #include <string.h> #include <time.h> struct person_t { int id; int age; char *name; }; void get_value(const char *msg, void *pval) { printf("%s", msg); if (scanf("%ld%*c", (long*)pval) !

Solution to the Cyber Security Rumble Finals challenge simple-asm. The challenge is strait forward. It defines an custom set of instructions, that get translated to x64 instructions directly and are then executed at a fixed offset, in a no-PIE binary. The translation lacks checks, such that the instructions do more than they should at first sight, when using specific higher register. This is the provides challenge source code, also running on the remote instance:

A talk from ju256 and me about Chrome V8 internals with some case studies of common bugs. While the slides are okay to look at, there is a fair bit of context missing from what we say during the talk. Maybe we will give the talk in a similar form somewhere where it is recorded in the future.

KITCTF held the CTF of the GPN conference. Accompanying it, Martin and I gave a talk about CTFs and the CTF community. The talk was recorded.

At the meeting of my CTF team I gave a talk about Python jail escapes. I.e., CTF challenges where there is only a very limited execution environment and the goal is to get unrestricted code execution, e.g. executing os.system('cat flag.txt'). While I have the slides, I think reading the blog post on the KITCTF blog with all the examples I wrote for the talk is much more insightful. It is meant to serve as a practice problems for everyone who wants to get started with exploiting Python jails.

Ghidra is a fairly complex reverse engineering tool, that has a lot of great features, that are not really intuitive to use. This talk was given together with intrigus for our CTF team KITCTF. It touches on many interesting but not easy to use features, specifically: Importing processor manuals Syncing decompiler and debugger pcode emulation Ghidra scripts in Java, and how you one use python 3 instead of python 2.7 Function signatures, how to use them in static binaries and how they work internally Adding custom architectures The slides should be navigated with n and p instead of arrow keys, because they are 2D slides.