

Tell HN: Come learn how to solve Stripe's Capture The Flag - pc
http://www.meetup.com/Stripe/events/54071002/

======
icebraining
Meh, I got to level 4 but didn't go any further.

Learned a lot, but I'm still not sure if there wasn't a much simpler solution
that I missed. Was return-to-libc really required to exploit it, or was I
trying to kill a fly with a sledge hammer?

~~~
mpakes
Return-to-libc (a.k.a. ret2libc) is usually used to bypass NX-bit / DEP, but
NX was disabled for level04 - the solution does not require return-to-libc.

~~~
icebraining
But it did have ASLR enabled, right? I didn't get how to bypass that without
ret2libc.

I think I'll try again tomorrow morning and see what I missed.

~~~
rzhou
On 32-bit machines, you can disable mmap randomization (and thus library
randomization) using ulimit -s unlimited.

Also, there's another useful place you can return to that isn't in libc.

------
mpakes
Nice.. looking forward to the meetup.

In the meantime, if anyone wants tips/tricks or just to chat about it, feel
free to contact me (email in my profile). I captured the flag late last last
week.

FWIW, Stripe has a campfire room setup for this as well -
<http://stripe.com/campfire>.

~~~
gdb
The CTF-specific room we set up is at:
<https://stripechat.campfirenow.com/59127>

------
silverlight
Any chance this would be webcast live or recorded for later viewing?

~~~
gdb
Unfortunately, we won't be webcasting. We will be releasing official solutions
at some point however.

~~~
karanlyons
That's a little bit of a shame. I'm not close enough to make it to the meetup,
but I and others would love some way to take part and chat with everyone.

------
mrchess
You guys should stream this meetup so us east-coasters can watch too.

------
CZ-18
I sent an email after I beat it, but never got a response =(

~~~
gdb
We'll be sending out replies within the next week or two. Don't worry, there
will be T-shirts for all!

~~~
CZ-18
Awesome, thanks for the update. I was starting to get worried, but I guess it
makes sense you're swamped with requests.

------
why-el
Will the challenge continue on after you guys post the solutions? I have not
had enough free time to have a go at it and would like to.

~~~
gdb
We're taking it down on Wednesday at noon PST. We'll probably bring it back
sometime in the future though!

------
antonID
If only this was Friday instead, I really wish I could make it, sounds like it
would be interesting :(

------
jblock
Dammit. It starts not 5 hours after I leave SV for Chicago :(

------
speednoise
I'd sign up in a heartbeat for a meetup like this in NYC.

~~~
heywire
I'm so close on level06. If Real Life(TM) would just stop getting in the way,
i'd be done by now :). I guess its going to be another late night...

