Anonymous
Hi
Yuvanth
Hi bro
Anonymous
#howtocode
Anonymous
/get howtoprogram
Anonymous
/get ide
Kartik
Address: Street, Apt, City, Country/Region, Province, Postal code
Hanz
what??
Anonymous
I request elaboration
Why cant you use a while(PC!=limit && user!=limit) instead of a do-while and replace the goto statements with a continue?
Binesh
Why cant you use a while(PC!=limit && user!=limit) instead of a do-while and replace the goto statements with a continue?
coz i set a target score as limit and i need to repeat the rounds till it reach the score
Binesh
i used do... while to exit from those rounds
Anonymous
coz i set a target score as limit and i need to repeat the rounds till it reach the score
You can do the same with a while loop. And it will also work when user enters 0 as input for limit variable. Even otherwise you should still not use a goto. You can instead replace it with a continue statement.
Shourya
Use a while loop and get rid of the goto statements.
Why? ..Code seems to be clear & precise of what is intended there...Unless goto messes with the code clarity I see no harm in here ...
Anonymous
Why? ..Code seems to be clear & precise of what is intended there...Unless goto messes with the code clarity I see no harm in here ...
It will eventually when the code size increases. Most of the uses of goto start with a small code base and then get left behind when the code size increases. And using continue instead of goto in his code does exactly the same thing. So why use something which has a dubious distinction when there is a perfectly valid replacement
Anonymous
i know its a bad practice but i found it as a minimal approach there
Continue does the same thing that goto does here except that the condition in the while loop is checked again.
Shourya
i know its a bad practice but i found it as a minimal approach there
No no .. ..It's not a bad practice ...Just matter of clarity n style ...Linux Kernel is full with goto code ...Even today people commit code with goto ..Some times it's very logical sometimes it make code messy ...That's it ..
Anonymous
No no .. ..It's not a bad practice ...Just matter of clarity n style ...Linux Kernel is full with goto code ...Even today people commit code with goto ..Some times it's very logical sometimes it make code messy ...That's it ..
Linux kernel is full of goto because that is the only way to handle errors far away from where they were caused in C and exceptions are not present in C. Even if exceptions were present in C, goto would be more attractive because of the cheap runtime overheads. In C++, the use of goto should be even lesser unless you are building something like a kernel and you know what you are doing.
Anonymous
depends upon the logic i used i guess
I am saying that if you replace goto with a continue in your code, it would work just the same way
Anonymous
So dont use goto when the language offers a perfect alternative for it. In your case goto is bad because the language offers the continue statement that does the same job.
Hanz
gimme coding challenge, medium tier.
Hanz
i need to exercise
Jhon
I am really struggling in pattern printing with nested for loops in , somebody please help me to improve my logic for this types of problems. 😔
Shourya
https://youtube.com/playlist?list=PLdo5W4Nhv31Yu1igxTE2x0aeShbKtVcCy
Anonymous
hello can anyone help me understand a small c code
Anonymous
How can help you
i want to understand this code
Anonymous
#include <unistd.h> #include <stdlib.h> #include <stdio.h> #include <seccomp.h> #include <sys/mman.h> #include <limits.h> #include <fcntl.h> #include <sys/stat.h> #include <sys/types.h> #include <string.h> void setup_seccomp() { scmp_filter_ctx ctx; ctx = seccomp_init(SCMP_ACT_KILL); int ret = 0; ret |= seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(sendfile), 0); ret |= seccomp_load(ctx); if (ret) { exit(1); } } typedef void (*void_fn)(void); int main(void) { setbuf(stdout, NULL); FILE * fptr = fopen("flag.txt","r"); puts("Goodbye flag!"); int ret = remove("flag.txt"); if (ret == 0) { puts("Flag file successfully removed."); } else { puts("Error removing flag file"); exit(-1); } puts("What do you have to say about us so carelessly removing your precious flag?"); void * buf = mmap(0, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0); void_fn sc = (void_fn) buf; ssize_t num_read = read(0, buf, 100); setup_seccomp(); sc(); return 0; }
Anonymous
@gameraccoon
Mame ¥£~~©©\[§
i want to understand this code
Okay, I can help you write me inbox
Anonymous
#include <unistd.h> #include <stdlib.h> #include <stdio.h> #include <seccomp.h> #include <sys/mman.h> #include <limits.h> #include <fcntl.h> #include <sys/stat.h> #include <sys/types.h> #include <string.h> void setup_seccomp() { scmp_filter_ctx ctx; ctx = seccomp_init(SCMP_ACT_KILL); int ret = 0; ret |= seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(sendfile), 0); ret |= seccomp_load(ctx); if (ret) { exit(1); } } typedef void (*void_fn)(void); int main(void) { setbuf(stdout, NULL); FILE * fptr = fopen("flag.txt","r"); puts("Goodbye flag!"); int ret = remove("flag.txt"); if (ret == 0) { puts("Flag file successfully removed."); } else { puts("Error removing flag file"); exit(-1); } puts("What do you have to say about us so carelessly removing your precious flag?"); void * buf = mmap(0, 4096, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0); void_fn sc = (void_fn) buf; ssize_t num_read = read(0, buf, 100); setup_seccomp(); sc(); return 0; }
This program exhibits Undefined behavior. Firstly it expects the memory mapped page to be allocated within the code segment which is not the case. Secondly it expects whatever bits may be present in the memory mapped page must be of an executable code and then proceeds to execute it. As far the rest of the code, it just sets a Linux kernel filter to kill this process if it tries making any system call other than sendfile.
Anonymous
so my question is how can i read the flag file before the program deletes it
You wont know where the flag file was stored in memory. If you want to read it after it has been deleted, you should try finding out the memory location where it was mapped to by reading the /proc/self/maps file and then create a mmap around this boundary. Not guaranteed to work. Even if that was your aim, why did you have to create those filters?
Anonymous
the source code of the programmning that is running in a server
Anonymous
i have to write a shellcode to read the flag
Anonymous
i guess the file will be in the same directory
Anonymous
i am learning exploit development and this is the challange that he send to me
Try doing the method I suggested. You can remove the function setup_seccomp. You dont need it for this challenge.
Anonymous
okie
Anonymous
i think he was preventing me from running execv by using that function?
Anonymous
im not sure though
Anonymous
i think he was preventing me from running execv by using that function?
Oh you mean he gave you that function. Well then I understand. His intention was to allow only access to sendfile system call.
Anonymous
yes ;-;
Anonymous
So you can use that system call to copy contents of that file using just the file descriptor to another file descriptor. So your challenge is to see how you you can do it without using any other system call.
Anonymous
yes maam
Anonymous
i have to write a shellcode to do it
Anonymous
i have to write a shellcode to do it
Good luck then. Seems like a nice exercise to brush up your system calls knowledge
Anonymous
thank you for the help
Walter
anyone using arduino here ??
Shourya
so my question is how can i read the flag file before the program deletes it
File is not closed right.....May be you can list the file descripotor used by this process ...Then read from it in the script..
Shourya
She can just get it from the FILE* ptr.
Thought he has to write a script to exploit..If iam nit wrong..
Anonymous
In C code within the same process you can get a descriptor from a FILE* pointer.
Walter
can anyone hellp me with storing data in arduino eeprom?
z
In C code within the same process you can get a descriptor from a FILE* pointer.
Yeah, calling fileno(fptr) where fptr is FILE * will return file descriptor.
z
I guess the solution will be sendfile(1, fileno(fptr), NULL, 100);
z
I am not sure sendfile can write to stdout though.
Anonymous
I guess the solution will be sendfile(1, fileno(fptr), NULL, 100);
It has to be done through another process. So the file descriptors wont work as the ones returned by fileno are per process entries. She has to read the vnode table to get the file descriptors that are maintained system wide and not per process.
Anonymous
That mmap() with PROT_EXEC allows you to give a payload as the code. It reads from stdin. So you need to write an Assembly code that perform that syscall. I guess.
That is what I assumed as well. But she said that is not the case. And even if we allowed it to write our own payload (should be less than 100 bytes) then all that has to be done is an assembly code that sets the eax register to fileno call number, followed by a trap into the kernel and reads the return and then follow it up with a sendfile system call. But the problem is that fileno call wont work because it is not allowed.
Shourya
I am not sure but remove here is buggy ..Hence the exploit...
Shourya
Remove won't close the file so it canbe read some how...And that's the test...Not sure but looks like this
Anonymous
No, the eax will be 40, because sendfile syscall number is 40. And fileno is not a syscall, it actually just takes something from FILE * struct (it contains a file descriptor).
Aah alright. And when did I say sendfile number is not 40? I just didnt look it up and instead said that the eax register must be set to whatever is the system call number.
Naiko
hi guys someone can help me with a script ?
Anonymous
i guess the file will be in the same directory
There you go. @Mysticial summed it up nicely for you. Now you just have to feed in the machine bytes corresponding to fileno call and a sendfile system call into the newly mapped memory page.