Skip to content

rcvalle/blizzardctf2017

master
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 

Blizzard CTF 2017: Sombra True Random Number Generator (STRNG)

Sombra True Random Number Generator (STRNG) is a QEMU-based challenge I developed for Blizzard CTF 2017. The challenge was to achieve a VM escape from a QEMU-based VM and capture the flag located at /root/flag on the host.

Installation

The image used and distributed with the challenge was the Ubuntu Server 14.04 LTS Cloud Image. The host used the same image as the guest. The guest was reset every 10 minutes and was started with the following command:

./qemu-system-x86_64 \
    -m 1G \
    -device strng \
    -hda my-disk.img \
    -hdb my-seed.img \
    -nographic \
    -L pc-bios/ \
    -enable-kvm \
    -device e1000,netdev=net0 \
    -netdev user,id=net0,hostfwd=tcp::5555-:22

Access to the guest was provided by redirecting incoming connections to the host on port 5555 to the guest on port 22. The guest login was "ubuntu" with password "passw0rd".

Usage

STRNG is a QEMU-based emulated hardware device. The device has four 32-bit registers accessible through memory-mapped I/O and port-mapped I/O: rand's seed (0), rand (1), rand_r's seed (2), and rand_r (3). These registers can be accessed directly using memory-mapped I/O at BAR0 or indirectly through the STRNG_PMIO_ADDR (0) and STRNG_PMIO_DATA (4) 32-bit ports using port-mapped I/O at BAR1.

To generate a random number

  1. Write the rand's seed to register 0.
  2. Write to register 1 to call the device's rand implementation.
  3. Read the generated random number from register 1.

Or

  1. Write the rand_r's seed to register 2.
  2. Write to register 3 to call the device's rand_r implementation.
  3. Read the generated random number from register 3.
  4. Optional: Read the state of rand_r from register 2.

Contributing

See CONTRIBUTING.md.

License

Licensed under the MIT license. See LICENSE for license text and copyright information.

About

Blizzard CTF 2017: Sombra True Random Number Generator (STRNG).

Topics

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages