shellcode on Hackropole

Bigorneau

Mon, 28 Apr 2025 00:00:00 +0000

We often try to obtain shellcodes with strange constraints, either in size, alphanumeric, etc. Here, we’re attempting a new weird constraint for an x64 shellcode: you are only allowed to use 6 different byte values (i.e., len(set(shellcode)) <= 6)!

Long Prime Shellcode

Mon, 28 Apr 2025 00:00:00 +0000

After Encrypted Shellcode and Hashed Shellcode, why not play with a large prime number? :-)

This challenge exists in a more difficult version: Small Prime Shellcode

Small Primes Shellcode

Mon, 28 Apr 2025 00:00:00 +0000

The version with just one large prime number was too easy, right? Here’s another one with more constraints :-)

Hashed Shellcode

Mon, 15 Apr 2024 00:00:00 +0000

Did you enjoy the Encrypted Shellcode challenge from FCSC 2021? Guess what? Here is a variant using a hash function!

Note : the Docker image base on the remote service is debian:bookworm-slim.

Keskidi

Mon, 25 Dec 2023 00:00:00 +0000

Pwn this!

Warning : the remote connection closes after 60 seconds.

Palindrome

Fri, 01 Dec 2023 00:00:00 +0000

Here is a shellcoding exercice as you like it! [At least I hope you do :-)]

A more complex variant of this challenge is available here: Palindrome (Harder).

Palindrome (Harder)

Fri, 01 Dec 2023 00:00:00 +0000

Here is a shellcoding exercice as you like it! [At least I hope you do :-)]

A simpler variant of this challenge is available here: Palindrome.

Shellcode

Fri, 15 Dec 2023 00:00:00 +0000

Do you know what a shellcode is?

asmophile

Fri, 22 Dec 2023 00:00:00 +0000

How well do you known x64 assembly?

Encrypted Shellcode

Tue, 19 Dec 2023 00:00:00 +0000

During an autit, you found these files and those commands:

$ dd if=/dev/urandom of=key.bin bs=16 count=1
$ ./esc -e < stereogram.png > stereogram.png.enc
$ ./esc < stereogram.png
[>] Done encrypting 1280731 bytes.
[2]    11735 segmentation fault  ./esc < stereogram.png

It seems that this crash has been exploited: can you figure out how and read flag.txt?

You don’t have key.bin, but the service provided gives access to esc (without arguments) using the same key.bin file as the one generated by the above command.

Risky Business

Tue, 19 Dec 2023 00:00:00 +0000

The challenge is not very risky: simply read the content of flag.txt.