{"id":222,"date":"2019-01-17T04:52:27","date_gmt":"2019-01-17T04:52:27","guid":{"rendered":"https:\/\/mrjsec.co.uk\/blog\/?p=222"},"modified":"2019-01-17T04:52:34","modified_gmt":"2019-01-17T04:52:34","slug":"shinny-upatree-sleigh-bell-lottery-cranberry-pi-terminal","status":"publish","type":"post","link":"https:\/\/mrjsec.co.uk\/blog\/shinny-upatree-sleigh-bell-lottery-cranberry-pi-terminal\/","title":{"rendered":"
Shinny Upatree – Sleigh Bell Lottery Cranberry Pi terminal<\/center>"},"content":{"rendered":"\n

Shinny Upatree, needs some help. “Winning”. The Sleighbell Lottery!<\/p>\n\n\n\n

They ask “Hey! Mind giving ole’ Shinny Upatree some help? There’s a contest I HAVE to win.
As long as no one else wins first, I can keep trying to win the Sleigh Bell Lotto, but this could take forever!
I’ll bet the GNU Debugger can help us. With the PEDA modules installed, it can be prettier. mean easier.”<\/p>\n\n\n\n

The hint URL<\/a>.<\/p>\n\n\n\n

When we first load up the terminal, we get this, and we need to “Complete this challenge by winning the sleighbell lottery for Shinny Upatree.” (I’m guessing luck isn’t on Shinny’s Upatree side.)<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

We have three files here (ok, gdb and objdump are links, but you know what I mean!)<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

\u2026\u2026\u2026. So I guess we’re not lucky either =(<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Well, I guess it’s time to change that! Also, no, we’re not going to cut off a rabbit’s foot. Using, nm .\/sleighbell-lotto to show interesting functions, we can see there is one called “winnerwinner”.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Let’s open sleighbell-lotto within GDP using “gdb -q .\/sleighbell-lotto” to start the debugging!<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

So let’s break main here.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Also, run it now.<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

So, now let’s jump to “winnerwinner” sounds good to us?<\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

Moreover, just like that, another rabbit get’s to save their legs. Oh, and we did it!<\/p>\n\n\n\n

I know this guide\/walkthrough is not too thick, and I don’t go into much detail mainly because GDP is a big program and somewhat hard to explain without making it too complicated.
If you liked this challenge, I would recommend using GDP more! Just look up guides on YouTube and other websites, I have included two links to learn more about GDP.<\/p>\n\n\n\n

References:
\nhttp:\/\/www.yolinux.com\/TUTORIALS\/GDB-Commands.html
\nhttps:\/\/www.ibm.com\/developerworks\/library\/l-gdb\/index.html<\/p>\n","protected":false},"excerpt":{"rendered":"

Shinny Upatree, needs some help. “Winning”. The Sleighbell Lottery! They ask “Hey! Mind giving ole’ Shinny Upatree some help? There’s a contest I HAVE to win.As long as no one else wins first, I can…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[10],"tags":[13,14,12],"class_list":["post-222","post","type-post","status-publish","format-standard","hentry","category-kringlecon-2018","tag-13","tag-ctf","tag-kringlecon"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/paD3U6-3A","_links":{"self":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/222","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=222"}],"version-history":[{"count":1,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/222\/revisions"}],"predecessor-version":[{"id":231,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/posts\/222\/revisions\/231"}],"wp:attachment":[{"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=222"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=222"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mrjsec.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=222"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}