WinKern x64 - Advanced stack buffer overflow - ROP

120 Puntos

Reversez le driver, trouvez les vulnerabilités qu’il expose et exploitez les sur un système Windows 10, afin d’obtenir les privilèges SYSTEM

Autor o autora

__syscall, Synacktiv, 27 enero de 2020

Niveau

Validaciones

13 Challengeurs 1%

Nota

13 votos

Para acceder en esta sección, por favor de iniciar sesión

Solución

Proponer una solución

Resultados de los retos

Usuario	Prueba	Idiomas	Data
Alkanor	WinKern x64 - Stack buffer overflow avancé - ROP		15 de noviembre de 2020 a 02:18
nobodyisnobody	WinKern x64 - Advanced stack buffer overflow - ROP		29 de octubre de 2020 a 10:33
shelli	WinKern x64 - Advanced stack buffer overflow - ROP		21 de octubre de 2020 a 08:45
hexabeast	WinKern x64 - Stack buffer overflow avancé - ROP		4 de octubre de 2020 a 00:01
awe	WinKern x64 - Advanced stack buffer overflow - ROP		9 de septiembre de 2020 a 21:01
gwel	WinKern x64 - Stack buffer overflow avancé - ROP		30 de junio de 2020 a 13:40
danigargu	WinKern x64 - Advanced stack buffer overflow - ROP		16 de junio de 2020 a 17:12
christrc	WinKern x64 - Stack buffer overflow avancé - ROP		26 de mayo de 2020 a 09:52
hyliad	WinKern x64 - Stack buffer overflow avancé - ROP		27 de abril de 2020 a 22:37
Tomtombinary	WinKern x64 - Stack buffer overflow avancé - ROP		28 de marzo de 2020 a 19:40

75 Retos

Resultados	Nombre	Validaciones	Puntos	Dificuldad	Autor o autora	Nota	Solución
	ELF x86 - Stack buffer overflow basic 1	8% 15124	5		Lyes		2
	ELF x86 - Stack buffer overflow basic 2	6% 10803	10		Lyes		1
	PE32 - Stack buffer overflow basic	1% 670	10		Ech0		0
	ELF x86 - Format string bug basic 1	4% 7015	15		Lu33Y		0
	ELF x64 - Stack buffer overflow - basic	3% 5334	20		Arod		1
	ELF x86 - Format string bug basic 2	2% 3513	20		Lyes		0
	ELF x86 - Race condition	3% 4792	20		Lu33Y		0
	ELF ARM - Stack buffer overflow - basic	1% 978	25		pickle		0
	ELF MIPS - Stack buffer overflow - No NX	1% 310	25		franb		0
	ELF x86 - Stack buffer overflow basic 3	2% 3506	25		Lyes		0
	ELF x86 - Use After Free - basic	1% 935	25		Esad		0
	ELF ARM - Stack Spraying	1% 172	30		pickle		0
	ELF x86 - BSS buffer overflow	2% 3378	30		Lu33Y		1
	ELF x86 - Stack buffer overflow basic 4	2% 2229	30		Lu33Y		0
	ELF x86 - Stack buffer overflow basic 6	2% 2057	30		TiWim		1
	ELF x86 - Format String Bug Basic 3	1% 920	35		Lyes		0
	PE32 - Advanced stack buffer overflow	1% 110	35		Ech0		0
	ELF ARM - Basic ROP	1% 497	40		pickle		0
	ELF MIPS - Basic ROP	1% 94	40		dagger		0
	ELF x86 - Stack buffer overflow - C++ vtables	1% 657	40		sebbb		0
	PE32+ Format string bug	1% 53	45		Ech0		0
	ELF x64 - Logic bug	1% 144	50		sbrk		0
	ELF x86 - Bug Hunting - Several issues	1% 73	50		sbrk		0
	ELF x86 - Stack buffer and integer overflow	1% 1601	50		Lu33Y		0
	ELF x86 - Stack buffer overflow - ret2dl_resolve	1% 148	50		kikko		0
	ELF x86 - Stack buffer overflow basic 5	1% 1467	50		Lu33Y		0
	ELF x64 - Stack buffer overflow - advanced	1% 965	55		Arod		0
	ELF MIPS - Format String Glitch	1% 41	60		pickle, martin		0
	ELF x86 - Information leakage with Stack Smashing Protector	1% 693	60		Arod		0
	ELF ARM - Race condition	1% 101	70		pickle		0
	ELF x64 - Browser exploit - Intro	1% 59	70		pickle		0
	ELF x86 - Out of bounds attack - French Paradox	1% 84	70		sbrk		0
	ELF x86 - Remote BSS buffer overflow	1% 674	75		Tosh		0
	ELF x86 - Remote Format String bug	1% 839	75		Tosh		0
	PE32+ Basic ROP	1% 26	75		Ech0		0
	ELF x64 - Remote heap buffer overflow - fastbin	1% 217	80		franb		0
	ELF x86 - Blind remote format string bug	1% 245	80		Lyes		0
	LinKern ARM - vulnerable syscall	1% 102	85		pickle		0
	LinKern x86 - Buffer overflow basic 1	1% 360	85		franb		0
	LinKern x86 - Null pointer dereference	1% 359	90		franb		0
	LinKern x64 - Race condition	1% 222	95		franb		0
	ELF ARM - Alphanumeric shellcode	1% 34	100		pickle		0
	ELF MIPS - URLEncoded Format String bug	1% 19	100		pickle		0
	ELF x86 - Hardened binary 1	1% 596	100		sm0k		0
	ELF x86 - Hardened binary 2	1% 474	100		sm0k		0
	ELF x86 - Hardened binary 3	1% 293	100		sm0k		0
	ELF x86 - Hardened binary 4	1% 327	100		sm0k		0
	LinKern MIPSel - Vulnerable ioctl	1% 34	100		pickle		0
	LinKern x64 - reentrant code	1% 117	100		franb		0
	ELF ARM - Heap format string bug	1% 62	105		franb		0
	ELF x64 - Sigreturn Oriented Programming	1% 198	105		Arod		0
	ELF ARM - Format String bug	1% 72	110		pickle		0
	ELF ARM - Use After Free	1% 73	110		pickle		0
	ELF x64 - Heap feng-shui	1% 54	110		laxa		0
	ELF x64 - Off-by-one bug	1% 106	110		NeedToLearn		0
	ELF x86 - Hardened binary 5	1% 254	110		sm0k		0
	LinKern ARM - Stack Overflow	1% 40	110		pickle		0
	LinKern x86 - basic ROP	1% 178	110		franb		0
	ELF ARM - Heap Off-by-One	1% 46	115		pickle		0
	ELF x64 - Remote Heap buffer overflow 1	1% 137	115		Tosh		0
	ELF x86 - Hardened binary 6	1% 236	115		sm0k		0
	ELF x86 - Hardened binary 7	1% 200	115		Tosh		0
	ELF x86 - Remote stack buffer overflow - Hardened	1% 119	115		franb		0
	LinKern x64 - RowHammer	1% 49	115		pickle		0
	LinKern x64 - SLUB off-by-one	1% 31	115		Tosh		0
	ELF ARM - Heap buffer overflow - Wilderness	1% 28	120		pickle		0
	ELF ARM - Heap Overflow	1% 33	120		pickle		0
	ELF x64 - Seccomp Whitelist	1% 41	120		pickle		0
	ELF x86 - Blind ROP	1% 97	120		franb		0
	Linkern x64 - Memory exploration	1% 78	120		franb		0
	WinKern x64 - Advanced stack buffer overflow - ROP	1% 13	120		__syscall, Synacktiv		0
	WinKern x64 - Use After Free	1% 9	120		__syscall, Synacktiv		0
	ELF x64 - Remote Heap buffer overflow 2	1% 102	130		Tosh, Fritz		0
	ELF x64 - Blind ROP	1% 67	135		franb		0
	ELF x64 - Browser exploit - BitString	1% 24	135		pickle		0