Security on Zach Alexander

Security on Zach Alexanderhttps://zpalexander.com/tags/security/Recent content in Security on Zach AlexanderHugoen-usFri, 08 Jul 2016 12:54:31 -0700Your Referer Is Showinghttps://zpalexander.com/posts/your-referer-is-showing/Fri, 08 Jul 2016 12:54:31 -0700https://zpalexander.com/posts/your-referer-is-showing/<p>Did you know that every time you click through to a new webpage, you’re voluntarily telling that new webpage where you came from?</p> <p>This isn’t a trick by the NSA, its just the way the web works. As most people know, whenever you click a hyperlink, the browser sends a request to the resource on the other end of the link. What most people don’t realize is that by default the request contains the referrer field, which indicates the page where the user clicked the link.</p>Binary Bomb Lab :: Phase 6https://zpalexander.com/posts/binary-bomb-lab-phase-6/Sat, 10 Jan 2015 12:09:45 -0800https://zpalexander.com/posts/binary-bomb-lab-phase-6/<p>A note to the reader: For explanation on how to set up the lab environment see the <a href="https://zpalexander.com/posts/binary-bomb-lab-set-up/">“Introduction”</a> section of the post.</p> <p>If you’re looking for a specific phase:</p> <ul> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-1/">Here is Phase 1</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-2/">Here is Phase 2</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-3/">Here is Phase 3</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-4/">Here is Phase 4</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-5/">Here is Phase 5</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-6/">Here is Phase 6</a></li> </ul> <hr> <p>This phase is definitely the trickiest out of all of the other bomb lab phases. Prepare for data structures…</p>Binary Bomb Lab :: Phase 5https://zpalexander.com/posts/binary-bomb-lab-phase-5/Fri, 09 Jan 2015 12:09:45 -0800https://zpalexander.com/posts/binary-bomb-lab-phase-5/<p>A note to the reader: For explanation on how to set up the lab environment see the <a href="https://zpalexander.com/posts/binary-bomb-lab-set-up/">“Introduction”</a> section of the post.</p> <p>If you’re looking for a specific phase:</p> <ul> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-1/">Here is Phase 1</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-2/">Here is Phase 2</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-3/">Here is Phase 3</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-4/">Here is Phase 4</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-5/">Here is Phase 5</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-6/">Here is Phase 6</a></li> </ul> <hr> <p>Ok, let’s get right to it and dig into the <code><phase_5></code> code:</p> <p><img src="https://zpalexander.com/images/binary-bomb/phase-5-overview.png" alt="Phase 5 overview"></p> <p>So, what have we got here? First things first, we can see from the call to <code><string_length></code> at <code><phase_5+23></code> and subsequent jump equal statement our string should be six characters long.</p>Binary Bomb Lab :: Phase 4https://zpalexander.com/posts/binary-bomb-lab-phase-4/Thu, 08 Jan 2015 12:09:45 -0800https://zpalexander.com/posts/binary-bomb-lab-phase-4/<p>A note to the reader: For explanation on how to set up the lab environment see the <a href="https://zpalexander.com/posts/binary-bomb-lab-set-up/">“Introduction”</a> section of the post.</p> <p>If you’re looking for a specific phase:</p> <ul> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-1/">Here is Phase 1</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-2/">Here is Phase 2</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-3/">Here is Phase 3</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-4/">Here is Phase 4</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-5/">Here is Phase 5</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-6/">Here is Phase 6</a></li> </ul> <hr> <h4 id="phase-4">Phase 4</h4> <p>In my opinion, this is where things start to get tricky. In this phase, it is not enough to simply understand the assembly. Some pattern-recognition will be required. As usual, let’s start by taking a look at the code for this phase’s function to see if we can find a vector through which to understand what’s happening. I’m going to do so by running gdb with a test string and using disas:</p>Binary Bomb Lab :: Phase 3https://zpalexander.com/posts/binary-bomb-lab-phase-3/Wed, 07 Jan 2015 12:09:45 -0800https://zpalexander.com/posts/binary-bomb-lab-phase-3/<p>A note to the reader: For explanation on how to set up the lab environment see the <a href="https://zpalexander.com/posts/binary-bomb-lab-set-up/">“Introduction”</a> section of the post.</p> <p>If you’re looking for a specific phase:</p> <ul> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-1/">Here is Phase 1</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-2/">Here is Phase 2</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-3/">Here is Phase 3</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-4/">Here is Phase 4</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-5/">Here is Phase 5</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-6/">Here is Phase 6</a></li> </ul> <hr> <p>By now you know the drill. Off to our objdump file!</p> <p><img src="https://zpalexander.com/images/binary-bomb/phase-3-objdump.gif" alt="Phase 3 object dump"></p> <p>Woah. There are a lot of conditionals here. Maybe you’re an IA32 warrior who can take one look at this code and immediately tell what is going on, but for the rest of us, an iterative approach might work better here.</p>Binary Bomb Lab :: Phase 2https://zpalexander.com/posts/binary-bomb-lab-phase-2/Tue, 06 Jan 2015 06:48:00 -0800https://zpalexander.com/posts/binary-bomb-lab-phase-2/<p>A note to the reader: For explanation on how to set up the lab environment see the <a href="https://zpalexander.com/posts/binary-bomb-lab-set-up/">“Introduction”</a> section of the post.</p> <p>If you’re looking for a specific phase:</p> <ul> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-1/">Here is Phase 1</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-2/">Here is Phase 2</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-3/">Here is Phase 3</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-4/">Here is Phase 4</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-5/">Here is Phase 5</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-6/">Here is Phase 6</a></li> </ul> <hr> <p>Ok, now things get a lot more interesting a lot more quickly. Let’s get started the same way we did last time, by looking at our objdump file for clues:</p>Binary Bomb Lab :: Phase 1https://zpalexander.com/posts/binary-bomb-lab-phase-1/Mon, 05 Jan 2015 12:09:45 -0800https://zpalexander.com/posts/binary-bomb-lab-phase-1/<p>A note to the reader: For explanation on how to set up the lab environment see the <a href="https://zpalexander.com/posts/binary-bomb-lab-set-up/">“Introduction”</a> section of the post.</p> <p>If you’re looking for a specific phase:</p> <ul> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-1/">Here is Phase 1</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-2/">Here is Phase 2</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-3/">Here is Phase 3</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-4/">Here is Phase 4</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-5/">Here is Phase 5</a></li> <li><a href="https://zpalexander.com/posts/binary-bomb-lab-phase-6/">Here is Phase 6</a></li> </ul> <hr> <p>Phase 1 is sort of the “Hello World” of the Bomb Lab. You will have to run through the reverse engineering process, but there won’t be much in the way of complicated assembly to decipher or tricky mental hoops to jump through. To begin, let’s take a look at the <code><phase_1></code> function in our objdump file:</p>Binary Bomb Lab :: Set Uphttps://zpalexander.com/posts/binary-bomb-lab-set-up/Sun, 04 Jan 2015 12:09:42 -0800https://zpalexander.com/posts/binary-bomb-lab-set-up/<p>The first step on your way to getting through the bomb lab will be setting up your environment. This page will assume that you have decided to do the lab for fun and profit. If you are a student, you’ve probably already been given these materials by your professor. Get to work.</p> <p>You can find all the necessary files on the <a href="http://csapp.cs.cmu.edu/public/labs.html">“Lab Assignments” page of Bryant and O’Hallaron’s website</a>, or you can download all the pieces individually.</p>