Тёмный

Exploiting C strstr Function (PicoCTF 2022 #37 'rps') 

John Hammond
Подписаться 1,7 млн
Просмотров 12 тыс.
50% 1

Опубликовано:

 

12 июл 2024

Поделиться:

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист
Посмотреть позже
Комментарии : 17   
@thetrollingboss3155
@thetrollingboss3155 2 года назад
Wow, that's amazing! I did not even realize the strstr function was vulnerable during the competition and ended up doing some good 'ol PRNG abuse
@majoryoshi
@majoryoshi 2 года назад
The only proper way to win at RPS. I know these are designed to be easier but holy cow this made me laugh so hard at how stupid the answer was
@Lodinn
@Lodinn 2 года назад
Tbf given a win is possible playing "normally" one might as well just brute force it.
@0xTas
@0xTas 2 года назад
That was a fun little exercise in reversing a program's logic, nice video.
@kawzaki
@kawzaki 2 года назад
The moment I saw strstr I guessed put all of them in as one word. Funny! Then funny how the flag reads some extreme luck ! Hahaha
@n0br.a1n
@n0br.a1n 9 месяцев назад
I searched what is strstr and figured the loophole out right away :D
@mrhappytroll
@mrhappytroll 2 года назад
Im proud of myself for figuring this out just by pausing and looking at the source code haha
@djibrille31
@djibrille31 2 года назад
Why does he use the ? sign in the grep command regular expression? Is it not enough to just use the ".*" like grep -oE "picoCTF{.*}". It drives me mad that I do not get it.
@Lodinn
@Lodinn 2 года назад
If the output contains another closing bracket, greedy capture would get the entirety of it. Not necessary here, but it's a good habit to have when dealing with regex matching something in brackets.
@lucidattf
@lucidattf Год назад
if the text content for example included picoCTF{aaaaa}aaaaa and then another }, the grep without the question mark would output "picoCTF{aaaaa}aaaaa and then another }"
@bladesvlogs4965
@bladesvlogs4965 Год назад
Would never have gotten that one 🤪
@bhagyalakshmi1053
@bhagyalakshmi1053 Год назад
Ok full pics and videos season.
@lordspacecake5565
@lordspacecake5565 2 года назад
Very neat trick
@AmanPatel-rv2it
@AmanPatel-rv2it 2 года назад
That's nice - just strstr being my cousin 😂😂
@vanfrancisco4573
@vanfrancisco4573 Год назад
Lmao, i have been tinkering the program only not to notice that the category was not a reverse engineering problem but a binary exploitation problem. stupid me. LOL
@jeffer746
@jeffer746 2 года назад
i just spammed the program with paper 5000 times until it won lol
@unutilisateurdeyoutube1256
@unutilisateurdeyoutube1256 Год назад
you spam five times rockpaperscissors and it wins xd
Далее
Return Oriented Programming (PicoCTF 2022 #48 'ropfu')
35:09
Boots on point 👢
00:24
Просмотров 675 тыс.
coding in C but I start over for every compiler error
16:34
how do hackers exploit buffers that are too small?
8:25
Writing My Own Database From Scratch
42:00
Просмотров 174 тыс.
Finding WEIRD Phishing Websites
18:28
Просмотров 48 тыс.
Rust and RAII Memory Management - Computerphile
24:22
Просмотров 219 тыс.