The remote service ask for a name, if you send more than 64 bytes, a memory leak happens.
The buffer next to the name's is the first random value used to init the srand()
If we get this value, and set our local srand([leaked] ^ [luckyNumber]) we will be able to predict the following randoms and win the game, but we have to see few details more ;)
The function used to read the input until the byte \n appears, but also up to 64 bytes, if we trigger this second condition there is not 0x00 and the print shows the random buffer :)
The nickname buffer:
The seed buffer:
So here it is clear, but let's see that the random values are computed with several gpu instructions which are decompiled incorrectly:
We tried to predict the random and aply the gpu divisions without luck :(
There was a missing detail in this predcitor, but there are always other creative ways to do the things.
We use the local software as a predictor, we inject the leaked seed on the local binary of the remote server and got a perfect syncronization, predicting the remote random values:
The process is a bit ugly becouse we combined automated process of leak exctraction and socket interactive mode, with the manual gdb macro.
The macro:
More articles
- Pentest Tools Kali Linux
- Pentest Tools Tcp Port Scanner
- Hacking Tools For Kali Linux
- Github Hacking Tools
- Hackers Toolbox
- Hacking Tools Download
- Pentest Tools Bluekeep
- Hacking Tools Github
- Pentest Tools Android
- Tools 4 Hack
- Best Hacking Tools 2019
- Pentest Tools For Android
- Hack Tools Pc
- Pentest Tools Windows
- Hacking Tools And Software
- Android Hack Tools Github
- Hacker Tools 2020
- Hacking Tools Hardware
- Hack Tool Apk
- Hacks And Tools
- Hacker Tools Software
- Hack Tools For Ubuntu
- Hacker Tools Linux
- Hack Website Online Tool
- Hacker Tools Mac
- Pentest Tools For Ubuntu
- Pentest Tools Apk
- New Hack Tools
- Pentest Tools Github
- Hacker Tools Github
- Hacker Search Tools
- Pentest Tools For Android
- Hacking Tools For Mac
- Pentest Reporting Tools
- Hacker Search Tools
- Hack Website Online Tool
- Pentest Box Tools Download
- Hack Tools For Mac
- Beginner Hacker Tools
- Hacking Tools Free Download
- World No 1 Hacker Software
- Hacking Tools 2020
- Pentest Reporting Tools
- Hacker Tools Hardware
- Black Hat Hacker Tools
- Hacker Tools List
- Pentest Tools Nmap
- Pentest Recon Tools
- Pentest Tools Bluekeep
- Hack Tools Download
- Termux Hacking Tools 2019
- Hacking Tools 2019
- Pentest Tools For Windows
- Hacking Tools Mac
- Hacker Tools Apk Download
- Easy Hack Tools
- Hack Apps
- Computer Hacker
- Best Pentesting Tools 2018
- Pentest Reporting Tools
- Hack Tools
- Black Hat Hacker Tools
- Tools 4 Hack
- Hacker Security Tools
- Wifi Hacker Tools For Windows
- Hacking Tools For Windows Free Download
- Hacker Tools Apk
- New Hack Tools
- Hacker Tools For Windows
- Underground Hacker Sites
- Pentest Tools Tcp Port Scanner
- Hacker Tools Free Download
- Physical Pentest Tools
- Pentest Tools List
- Hacking Tools Windows
- Pentest Tools Apk
- Pentest Tools Alternative
- Hackrf Tools
- Hacker Tools List
- How To Install Pentest Tools In Ubuntu