# Main ## General * [The Human Mating Game: Evolusi Cinta dan Strategi Reproduksi Manusia](https://azizprabowo.com/human-mating-game) * [Fulfilling and Meaningful Life](/general/fulfilling-and-meaningful-life) * [Learning Mathematics](/general/learning-mathematics) ## Data Science * [Analisis Waktu Posting Paling Populer di Reddit terkait Konflik Israel-Palestina](/data-science/analisis-waktu-posting-paling-populer-di-reddit-terkait-konflik-israel-palestina) ## Writeups * [heap 0 - Binary Exploitation](/writeups/heap-0-binary-exploitation) (picoCTF 2024) * [Binary Search - General Skills](/writeups/binary-search-general-skills) (picoCTF 2024) * [WinAntiDbg0x300 - Reverse Engineering](/writeups/winantidbg0x300) (picoCTF 2024) # Fulfilling and Meaningful Life This article is more of a personal reflection and reminder for me. A decade from now, if I’m still around, I want to revisit this and see how much progress I’ve made. More than that, I hope it inspires others to look at life from a different perspective. This is a broad topic, and everyone will have their own explanation, but I want to distill it to what I believe is essential and relevant to most people. ### Do What You Love One of the most common pieces of advice we hear is, “Do what you love.” But figuring out what that actually means is complicated. It takes time, experimentation, and trying many different things. If you feel like you’ve explored multiple paths but still haven’t found what truly excites you, try categorizing your tasks into two groups: the things you *want to do* and the things you *have to do*. Ask yourself, “Am I doing this because I genuinely want to, or because I feel obligated to?” Most of the time, the things we *have* to do feel like burdens, while the things we *want* to do are what bring us fulfillment. That’s why it’s essential to focus on what you truly *want* to do, rather than what you feel you *have* to do. It’s also important to prioritize what’s *important* over what’s *urgent.* Important tasks contribute to your long-term goals and personal growth, while urgent tasks demand immediate attention but don’t necessarily help you achieve your bigger vision. If you spend too much time on tedious work, it can drain your energy and creativity. That’s why choosing something you genuinely love and are passionate about is not only meaningful but also worth it. A simple way to test whether you truly love something is to ask yourself: “Would I still do this if I weren’t getting paid?” If the answer is yes, you’re likely on the right path. If not, you need to take a deeper look and ask whether it genuinely brings you joy or if you’re doing it for external validation. It’s hard to become truly skilled at something you don’t find interesting, and it’s almost impossible to be great at something you’re not obsessed with. And if you’re stuck doing something you don’t enjoy, it becomes even harder to feel happy or fulfilled. That’s why trading long-term fulfillment for short-term gains is never worth it. Never try to win the moment at the expense of the decade. ### Be Internally Driven When you’re internally driven; when you’re competing with yourself and not with others; you don’t need someone else to motivate you. You’ll push through obstacles because you genuinely care about your goal. Because when you're competing with others, you will only compare, but when competing with yourself, you’ll improve. It’s also important to remember that your worth isn’t defined by what you achieve or how much you own. It’s about who you become and how you contribute to others. Instead of measuring success by external standards; like comparing yourself to others; focus on internal growth. Transformation isn’t about becoming a totally different person. It’s about gaining the ability to see who you truly are and then live your life as that authentic you. One of the worst habits we have is comparing ourselves to others. It’s never fair, because everyone’s journey is different. We are all unique, we have unique backgrounds, experiences, and challenges. So never compare yourself to others. The more comfortable you are with yourself, the less you need the approval of others. People who are comfortable with themselves are never worrying about what others think or chasing prestige. Instead, they focus on the opinions of those whose judgment they truly respect; mentors, close friends, or people who share their values. They know that prestige is just the world’s opinion; it’s a powerful magnet that can pull you away from what you truly love, making you work on what you *think* you love, rather than what you *truly* love. Ask yourself: “Would I be happy with this result if no one else saw it? If I didn’t compare it to anyone else’s success?” The happiest people aren’t the ones chasing the spotlight or popularity; they’re the ones quietly doing what they love, regardless of who’s watching. ### Don’t Chase Money Money can be tricky to talk about. While people debate whether it buys happiness, one thing is certain: it does buy freedom; and that matters. Not having enough money is stressful, so it’s important to earn enough to feel secure. But beyond that, true happiness doesn’t come from owning things; it comes from experiences, deep relationships, and doing meaningful work. And remember, the happiest people aren’t necessarily the richest; they’re the ones who enjoy what they do. When you love your work, you naturally become more engaged, more productive, and, in turn, better at it. And when you get better, you create more value, which leads to more opportunities; including financial ones. The key is to focus on doing work you truly enjoy, rather than chasing money as an end goal. If you become exceptional at something you love, money will follow. But if you chase money first, you might find yourself stuck in something that drains you. Another misconception is the idea that success is a *zero-sum game;* the idea that for one person to win, another must lose. But life doesn’t work that way. The world isn’t a fixed pie where someone else’s success takes away from yours. Opportunities expand when people create, innovate, and collaborate. A zero-sum mindset limits your thinking, making you see others as competitors instead of potential allies. Real growth happens when you understand that lifting others up doesn’t hold you back; it actually expands possibilities for everyone. ### Living with Purpose Life is short, and time is the most valuable resource you have. You can have anything you want, but not everything you want. That’s why it’s important to make time for things that truly matters to you. And most importantly, find your [reason to stay alive](https://www.amazon.com/Reasons-Stay-Alive-Matt-Haig/dp/0143128728). If you haven’t yet, keep searching. Find something meaningful and make it your guiding purpose. Don’t chase status; it’s empty without substance and won’t bring lasting fulfillment. Focus on what makes you truly happy, rather than what others expect from you. Prioritize contribution over validation. Your values should be rooted in principles; the laws of nature; not fleeting trends. Stick to them, no matter what. Don’t fall into the FOMO trap; it’s one of the biggest distractions from personal growth. Chasing what’s popular often means abandoning what’s truly meaningful. Trends come and go, but principles endure. Skepticism is a useful filter here; just because something is viral doesn’t mean it’s valuable. Also, set a long-term objectives and avoid short-term thinking. Long-term thinking is essential. Too many people get caught up in short-term pleasures or temporary wins, forgetting to build something that lasts. Set objectives that stretch over years, not just months. Short-term thinking leads to impulsive decisions, but long-term thinking builds a foundation for something truly worthwhile. If you like challenges, pick a goal or dream that most people think is impossible to achieve; so long as it doesn’t violate the laws of physics. Don’t worry about whether you’ll succeed; the outcome isn’t in your control. What *is* in your control is the process; figuring out *how* to achieve it and make it happen. The greatest achievements in history were once considered unrealistic, but they became possible because someone was bold enough to try. Don’t be an optimist or a pessimist; just get something done. If you fail, start over. Take risks, but make sure they’re calculated. There is a good heuristic for risk-taking: the greatest risk for a living organism is death; because after that, there are no more risks. So take risks; just not the ones that threaten your life. When you feel discouraged, remember that in the grand scale of the universe, we are just a [tiny fraction of an atom](https://youtu.be/FZsLYvs6gtw). Our egos, our worries, and our struggles seem enormous to us, but they are [insignificant in the cosmic perspective](https://fs.blog/ego-cosmic-perspective/). Sometimes, the best way to overcome stress or fear is to zoom out and see how small we really are. When it comes to relationships, surround yourself with people who support your goals and dreams. Cut out negativity, whether from real life or social media. Negativity doesn’t just slow your progress; it poisons your mind. Life is too short to waste energy on people who drag you down. Instead, focus on those who uplift and challenge you in the right ways. Also remember that life isn’t supposed to be easy. It’s simple, but not always smooth. The real problem is that we *expect* it to be easy; and that expectation complicates everything. Lastly, here's one thing to keep remember: > there is only one true success—to be able to spend your life in your own way. # Learning Mathematics This article is going to be short. I’m just going to share that maths is actually fun. It’s not scary or impossibly hard like people often say—once you understand the fundamentals. If you have maths phobia or anxiety, then you’re reading the right article. I know because I used to have maths phobia too. I still remember how I’d react when I came across anything maths-related—I’d quickly (and emotionally) avoid it. It’s like smelling durian when you don’t like the smell. You can’t handle it, so you just turn away. I’m not someone who knows a lot about maths or is especially good at it. I’m just an amateur who loves to explore and discover new patterns in maths. There’s still so much I don’t understand, and I make plenty of mistakes—like struggling with factoring, messing up integration by parts, or forgetting to put "+ C" while integrating :). But here’s what I’ve learned: the fundamentals are always the hardest part of learning anything, and that’s exactly why they’re so important to master. When it comes to learning maths, I think the most important thing is to develop a mathematical mindset—in other words, learning to think mathematically. This means truly understanding the basics. For example, asking questions like: * What are addition, subtraction, multiplication, and division? * What do they actually mean? * Is multiplication just the reverse operation of division? * What is an equation or inequality, and what do they represent? Once you understand these basics, you can start asking deeper questions, like: * Why, for any non-zero number 𝑎, does raising 𝑎 to the power of zero always produce 1? * What is a function, and what are its properties? * Why do we avoid dividing by zero or taking the square root of a negative number when finding the domain of a function? These questions might sound intimidating at first, but they’re the foundation of thinking mathematically. Of course, before you can dive into the basics, you need to deal with your maths phobia first. And here’s the hard truth: the only person who can remove it is you. (Unless you’re planning to ask a neurosurgeon to remove it from your brain—but I wouldn’t recommend that!) For me, the most effective way to overcome maths anxiety was to change my mindset. I started telling myself: > *"Hey brain, maths is just patterns. It’s the language of patterns. There’s no pattern that can threaten your life, so stop treating it like a threat!"* Once I reframed maths in my mind, I started gradually exposing myself to it. At first, it felt painful—really painful. I’m not joking. But this is how we learn. In the beginning, it’s hard and uncomfortable, but if you stick with it—say, for [66 days](https://jamesclear.com/new-habit#:~:text=On%20average%2C%20it%20takes%20more,to%20form%20a%20new%20habit.), long enough to form a habit—it becomes easier. Your brain adapts, and eventually, maths stops being painful. It becomes a habit, a skill, and even something fun. Anyway, I think this article is already longer than I expected. So, before I end it, I want to share a couple of resources that helped me when I started learning maths two years ago: 1. **The website** [**MathIsFun**](https://www.mathsisfun.com/) – This is a great supplemental resource. Whenever I got stuck on a specific topic, I’d check this site for a simple and clear explanation. 2. **The book** [***Thinking Mathematically***](https://www.amazon.com/Thinking-Mathematically-7th-Robert-Blitzer/dp/0134683714) **by Robert Blitzer** – This book (and almost [all his books](https://www.thriftbooks.com/a/robert-blitzer/197759/)) is great for understanding mathematical thinking and the basics. 3. [The AoPS Introduction Series](https://artofproblemsolving.com/store/online) – This series is excellent for building a strong mathematical foundation. It covers problem-solving techniques, logical reasoning, and deeper insights into math beyond standard school curricula. 4. [**Terence Tao’s blog**](https://terrytao.wordpress.com/career-advice/) – This blog by Terence Tao has fantastic posts with advice on learning maths and improving your skills. In my experience, the website *MathIsFun* worked best as a supplement while I was reading *Thinking Mathematically* and *AoPS*. But ultimately, it’s up to you to choose the resources and methods that work best for you. As Richard Feynman once said: > *"Study hard what interests you the most in the most undisciplined, irreverent, and original manner possible."* And always remember: maths is just patterns—the language of patterns. Once you see it that way, it stops being scary and starts becoming fascinating. # Analisis Waktu Posting Paling Populer di Reddit terkait Konflik Israel-Palestina Di artikel kali ini saya akan menjelaskan hasil analisis terkait opini publik harian tentang perang Israel-Palestina dari [Kaggle: Daily Public Opinion on Israel-Palestine War](https://www.kaggle.com/datasets/asaniczka/reddit-on-israel-palestine-daily-updated) yang hasil visualisasinya sudah pernah saya publikasi di [sini](https://public.tableau.com/app/profile/aziz.prabowo3984/viz/AnalisisJamPostingPalingPopuleruntukMenentukanLokasiPenulisnya/Dashboard1). Karena dataset ini memiliki banyak kolom dan bisa dilakukan untuk beberapa analisis dengan topik yang berbeda, maka di sini saya hanya akan fokus pada analisis terkait waktu posting paling populer berdasarkan komentar subreddit dengan memanfaatkan dua kolom yaitu `subreddit` dan `created_time`. Sebelum masuk ke bagian analisis, perlu diketahui bahwa setiap posting subreddit di dataset ini menggunakan waktu UTC (Coordinated Universal Time) sebagai standar waktu universal, dan data yang saya gunakan untuk analisis di Python (analisis ini) dengan hasil visualisasi di [Tableau Publik](https://public.tableau.com/app/profile/aziz.prabowo3984/viz/AnalisisJamPostingPalingPopuleruntukMenentukanLokasiPenulisnya/Dashboard1) adalah data yang diambil di waktu yang berbeda, jadi ada perbedaan pada jumlah posting dari kedua hasil visualisasi tersebut. Dalam analisis ini, saya akan mencoba untuk melihat bagaimana perubahan jumlah aktivitas posting untuk setiap subreddit, dan apakah jumlah posting di setiap subreddit dipengaruhi oleh kapan posting tersebut dipublikasi. ## **Dini Hari (00:00 - 04:59)**

Jumlah posting untuk rentang waktu dini hari

Pada rentang waktu ini, posting paling banyak terjadi pada pukul **2 AM** atau jam **2 pagi** dengan jumlah **9854 posting**. Jumlah posting di setiap jamnya juga tidak terlalu berbeda jauh satu sama lain. Jika dilihat, di sini terjadi peningkatan jumlah posting di awal rentang waktu dari pukul **12 pagi** hingga pukul **2 pagi**, kemudian terjadi penurunan sekitar **1000 posting** di setiap jam sampai pukul **4 pagi**. ## **Pagi (05:00 - 10:59)**

Jumlah posting untuk rentang waktu pagi hari

Di pagi hari, yaitu dari pukul **5** hingga **10 pagi**, puncak posting terjadi pada pukul **6 pagi** dengan jumlah **7383 posting**. Dan jika dilihat kembali, jumlah posting dari pukul **7** hingga **10 pagi** juga hampir tidak ada perubahan. Mungkin saja di rentang waktu ini mayoritas pengguna di setiap subreddit sedang bekerja atau tidur??? Saya sendiri juga tidak tahu, karena di dataset tidak ada kolom yang bisa digunakan untuk melihat persebaran geografis untuk setiap hasil posting. ## **Siang (11:00 - 14:59)**

Jumlah posting untuk rentang waktu siang hari

Hampir sama seperti di rentang waktu sebelumnya. Di rentang waktu siang hari, jumlah posting di setiap jamnya hampir sama, tidak ada kenaikan atau penurunan jumlah posting yang signifikan. Perubahan dari pukul **11** ke **1 siang** hanya sekitar **200 posting** dengan kenaikan sebelum pukul **12**, dan penurunan setelah itu. Di pukul **1** ke **2 siang** justru malah hampir tidak ada perubahan jumlah posting, hanya penambahan **40 posting** pada rentang waktu ini. Artinya, di rentang waktu ini topik bahasan terkait konflik Israel-Palestina sedang sepi di setiap subreddit. Mungkin saja di rentang waktu ini tidak ada update berita baru terkait topik tersebut, jadi hampir tidak ada perubahan jumlah posting saat itu. ## **Sore (15:00 - 17:59)**

Jumlah posting untuk rentang waktu sore hari

Untuk sore hari rentang waktunya sangat pendek, hanya **3 jam**, yaitu dari pukul **3** hingga **5 sore**. Setelah sepi bahasan di siang hari, di rentang waktu ini mulai terjadi peningkatan jumlah posting yang cukup konsisten. Jika dilihat, dari pukul **3** ke **4 sore** jumlah posting bertambah sekitar **1274 posting**, dan terjadi kenaikan lebih besar dari pukul **4** ke **5 sore**, yaitu sekitar **1547 posting**. Ini menunjukkan bahwa aktivitas posting semakin ramai mendekati sore hingga menjelang malam. ## **Malam (18:00 - 23:59)**

Jumlah posting untuk rentang waktu malam hari

Pada malam hari, puncak ativitas posting terjadi pada pukul **9 malam**. Jika dibandingkan dengan rentang-rentang waktu sebelumnya, aktivitas posting di rentang waktu ini menjadi yang paling ramai. Jumlah posting di setiap jamnya konsisten di rentang **9** hingga **10 ribu posting**. Dan jika kembali melihat jumlah posting di rentang waktu dini hari, jumlah postingnya juga tidak jauh berbeda, masih di sekitaran **9 ribu posting**. Ini artinya topik bahasan terkait konflik Israel-Palestina di setiap subreddit memang paling ramai di kedua rentang waktu ini, dengan rata-rata **9 ribu posting** di setiap jamnya. ## Posting di Setiap Subreddit

Jumlah posting di setiap subreddit untuk semua rentang waktu

Jika sebelumnya kita melihat perubahan jumlah posting di setiap jamnya. Sekarang saatnya kita melihat subreddit mana yang menghasilkan jumlah posting paling banyak dari keseluruhan jumlah posting di semua rentang waktu. Dari grafik di atas bisa dilihat jika subreddit **IsraelPalestine** berada di urutan teratas dengan jumlah **52,622 posting**. Jika dilihat dari namanya, subreddit ini sudah pasti diperuntukkan untuk membahas terkait topik konflik Israel-Palestina, jadi sangatlah wajar jika subreddit ini berada di urutan teratas dengan jumlah posting yang cukup banyak. Di urutan kedua hingga ke empat ada subreddit **worldnews**, **AskMiddleEast**, dan **CombatFootage**. Subreddit **worldnews** berisi bahasan terkait berita global, sedangkan **AskMiddleEast** dan **CombatFootage** dipenuhi oleh diskusi dari perspektif Timur Tengah dan diskusi terkait pertahanan, sehingga di subreddit ini ada banyak analisis atau opini mengenai konflik dari sisi militer dan geopolitik. Secara keseluruhan, topik terkait konflik Israel-Palestina ini tidak hanya dibahas di satu subreddit saja. Bahkan ada beberapa subreddit seperti **TerrifyingAsFuck**, **NoahGetTheBoat**, **AbruptChaos**, **CrazyFuckingVideos**, dan **ActualPublicFreakout** yang fungsi utamanya tidak diperuntukkan membahas terkait konflik ini juga ikut menambahkan jumlah posting. Meskipun ada kolom yang bisa digunakan untuk mengetahui posting seperti apa yang dipublikasi di setiap subreddit tersebut, tapi karena fokus analisis ini hanya pada waktu posting terpopuler, maka saya tidak akan menjelaskan tentang topik tersebut. Mungkin jika kamu tertarik untuk membuat analisis tersebut, kamu bisa menjadikan hasil analisis ini sebagai referensi atau acuan utama :) ## Kesimpulan

Jumlah posting di setiap subreddit pada rentang waktu yang berbeda

Dari analisis ini, dapat disimpulkan bahwa waktu posting di setiap subreddit terkait konflik Israel-Palestina sangat bervariasi. Aktivitas posting paling ramai terjadi di rentang waktu malam hari, yaitu dari pukul **6** hingga **11 malam**, yang menjadikan rentang ini sebagai rentang waktu tepopuler. **IsraelPalestina** dan **worldnews** menjadi subreddit paling ramai dan aktif untuk bahasan topik ini. Selain itu, topik terkait konflik Israel-Palestina ini juga dibahas di subreddit dengan macam-macam kategori, tidak hanya subreddit yang diperuntukkan untuk membahas konflik Israel-Palestina saja. {% hint style="info" %} Jupyter Notebook hasil analisis ini bisa dilihat di link [Kaggle ini](https://www.kaggle.com/code/azizp123/most-pop-posting-hours-to-determine-the-auths-loc), atau [Github ini](https://github.com/azizp128/Analysis-On-Daily-Public-Opinion-on-Israel-Palestine-War/blob/main/jam-posting.ipynb). {% endhint %} # heap 0 - Binary Exploitation ## Deskripsi
> Challenge ini bisa diakses melalui: ## Walkthrough Diberikan sebuah file binary ELF beserta source code-nya.
Ketika file ELF tersebut dieksekusi, maka akan menghasilkan output berikut:

output program

Program ini sebenarnya adalah contoh implementasi alokasi data pada memori menggunakan heap dengan beberapa opsi: * Opsi 1: menampilkan lokasi dan isi memori pada status saat ini (current state). * Opsi 2: menuliskan data pada memori. * Opsi 3: menampilkan isi variabel pada memori. * Opsi 4: menampilkan flag. * Opsi 5: keluar program. Jika dilihat dari source code-nya, terdapat fungsi `check_win` yang akan menampilkan isi flag. {% code overflow="wrap" fullWidth="false" %} ```c void check_win() { if (strcmp(safe_var, "bico") != 0) { printf("\nYOU WIN\n"); // Print flag char buf[FLAGSIZE_MAX]; FILE *fd = fopen("flag.txt", "r"); fgets(buf, FLAGSIZE_MAX, fd); printf("%s\n", buf); fflush(stdout); exit(0); } else { printf("Looks like everything is still secure!\n"); printf("\nNo flage for you :(\n"); fflush(stdout); } } ``` {% endcode %} Di fungsi ini, untuk menampilkan flag, saya perlu memenuhi kondisi `if (strcmp(safe_var, "bico") != 0)` yang artinya adalah: jika variabel `safe_var` tidak berisi string "bico", maka eksekusi perintah di dalam block. Kondisi ini hanya bisa dipenuhi dengan cara menimpa isi variabel `safe_var` di memori, atau dengan kata lain melalui [heap overflow](https://en.wikipedia.org/wiki/Heap_overflow). Untuk melakukan ini, saya perlu melihat terlebih dahulu apa yang sebenarnya dilakukan oleh opsi `2. Write to buffer` pada fungsi `write_buffer` di source code. 
void write_buffer() {
    printf("Data for buffer: ");
    fflush(stdout);
    scanf("%s", input_data);
}
Jika dilihat dari isinya, fungsi ini berisi perintah untuk menerima input user menggunakan fungsi `scanf`. Dan jika melihat pada manual page fungsi `scanf` melalui console menggunakan perintah `man scanf`, ternyata fungsi ini memiliki bugs.

bug fungsi scanf

Fungsi `scanf` tidak melakukan pemeriksaan jumlah [buffer](https://en.wikipedia.org/wiki/Data_buffer) pada input yang diberikan, atau dengan kata lain akan memasukkan semua input data sampai karakter spasi ditemukan. Kondisi ini akan menimbulkan [buffer overflow](https://en.wikipedia.org/wiki/Buffer_overflow), ketika sebuah program mencoba menyimpan data yang melebihi kapasitas buffer atau blok memori yang sudah dialokasikan untuk menyimpan data tersebut. Dan ketika buffer terisi lebih dari kapasitasnya, data akan "meluber" ke area memori lain yang berdekatan, sehingga akan menimpa data lain.

https://www.imperva.com/learn/application-security/buffer-overflow/

Setelah mengetahui terdapat bug buffer overflow pada program ini, langkah selanjutnya adalah melakukan eksploitasi!!! ## Ekploitasi Karena saya sudah mengetahui terdapat bug buffer overflow pada program ini, maka saya akan men-triggernya melalui opsi `2. Write to buffer`. Ketika saya mencoba memasukkan 40 karakter `A` tanpa spasi sebagai input dan menampilkan status heap, data pada heap yang mulanya berisi string "bico" menjadi berisi karakater `A` berjumlah 8.
Dari sini bisa disimpulkan bahwa variabel `input_data` (untuk menerima input user) hanya dapat menyimpan buffer sebesar 33 bytes (32 bytes + [null terminator](https://en.wikipedia.org/wiki/Null_character)). Ketika memasukkan input lebih dari itu, maka sisa karakter tersebut akan menimpa variabel terdekat yang ada di memori, yang di kasus ini adalah variabel `safe_var` yang berisi string "bico." Karena untuk mendapatkan flag saya hanya perlu menimpa atau memodifikasi variabel `safe_var`, maka di percobaan sebelumnya saya sebenarnya sudah bisa menampilkan flagnya. Saya akan mencobanya sekali lagi, tetapi kali ini eksekusi program dilakukan pada instance yang diberikan di deskripsi challenge. Kali ini saya akan mencoba memasukkan string `AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAApico` sebagai input data, dan mengecek status heap.
Sekarang variabel `safe_var` berhasil ditimpa dengan string "pico." Dan saya hanya perlu memilih opsi `4. Print Flag` untuk memenangkan permainan dan mendapatkan flagnya.
## Solver Berikut adalah solver untuk challenge ini: ```python from pwn import * conn = remote(HOST, PORT) payload = b"A"*32 + b"pico" conn.recvuntil(b"Enter your choice: ") conn.sendline(b"2") conn.sendline(payload) conn.recvuntil(b"Enter your choice: ") conn.sendline(b"4") print(conn.recvall().decode()) ``` Hasil running solver:
## Challenges Serupa Jika kalian ingin mengetahui variasi lain dari buffer overflow dan cara eksploitasinya, kalian bisa membaca [writeup ini](https://guyinatuxedo.github.io/04-bof_variable/csaw18_boi/index.html). # Binary Search - General Skills ## Description
## Walkthrough When I read the challenge's description above, two keywords stood out: `the shell` and `Binary Search`. From that information, I assumed this challenge was meant to introduce players to the idea of the [Shell](https://en.wikipedia.org/wiki/Shell_\(computing\)) and the [Binary Search](https://en.wikipedia.org/wiki/Binary_search) algorithm. So, I downloaded the challenge files directly from the terminal: ```sh wget https://artifacts.picoctf.net/c_atlas/19/challenge.zip -O challenge.zip ``` I extracted the zip file, and there was only one shell script `guessing_game.sh` inside the folder `/home/ctf-player/drop-in/`:
I took a look at the script, read them, and realized it’s a simple 'Binary Search' guessing game:
This game asks the users to guess a number between 1 and 1000, and only get 10 tries to get it right. If the guess is too high, it tells to go lower. If it’s too low, it tells to go higher. Once I guess the correct number, it congratulates me and gives me the flag. To solve this challenge, I needed to play the game by guessing the correct number using the Binary Search formula: `mid_idx = (low_idx + high_idx) / 2`. Since Binary Search works by cutting the range in half each time, I started by guessing the middle number between 1 and 1000, which is 500. Depending on whether the game told me to guess higher or lower, I adjusted my next guess and kept narrowing it down. If you want to understand how the Binary Search algorithm works, you can watch [this](https://www.youtube.com/watch?v=YzT8zDPihmc\&list=PLhQjrBD2T380ntcBDFlEfDCsYISod_jHy\&index=2) or read [this](https://www.khanacademy.org/computing/computer-science/algorithms/binary-search/a/binary-search). Now let's check the program's source code, and see how they actually work. ```sh #!/bin/bash # Generate a random number between 1 and 1000 target=$(( (RANDOM % 1000) + 1 )) echo "Welcome to the Binary Search Game!" echo "I'm thinking of a number between 1 and 1000." # Trap signals to prevent exiting trap 'echo "Exiting is not allowed."' INT trap '' SIGQUIT trap '' SIGTSTP # Limit the player to 10 guesses MAX_GUESSES=10 guess_count=0 while (( guess_count < MAX_GUESSES )); do read -p "Enter your guess: " guess if ! [[ "$guess" =~ ^[0-9]+$ ]]; then echo "Please enter a valid number." continue fi (( guess_count++ )) if (( guess < target )); then echo "Higher! Try again." elif (( guess > target )); then echo "Lower! Try again." else echo "Congratulations! You guessed the correct number: $target" # Retrieve the flag from the metadata file flag=$(cat /challenge/metadata.json | jq -r '.flag') echo "Here's your flag: $flag" exit 0 # Exit with success code fi done # Player has exceeded maximum guesses echo "Sorry, you've exceeded the maximum number of guesses." exit 1 # Exit with error code to close the connection ``` This shell script generates a random number between 1 and 1000 and gives the players chance to guess the correct number up to 10 guesses. If the players guess the number that is higher than the correct number, it will respond with a message: `Lower! Try Again`, otherwise, it will respond: `Higher! Try Again`, until the players guess the correct number and then it will give them the flag. So, this is basically a simple challenge. I just need to play the game by guessing the correct numbers and get the flag. Here's one of my attempt to get the flag by playing the game:
## Bu(t|g) Here’s the interesting part, though: while playing around with the script, I noticed a *bug*. Let’s break it down, and check the code again. ```sh if ! [[ "$guess" =~ ^[0-9]+$ ]]; then echo "Please enter a valid number." continue fi ``` In the code above, we can see that it checks if the user’s input is a number (0 to 9). If it’s not, the script just asks for a valid number and moves on to the next try. 
if (( guess < target )); then
    echo "Higher! Try again."
elif (( guess > target )); then
    echo "Lower! Try again."
else
    echo "Congratulations! You guessed the correct number: $target"

    # Retrieve the flag from the metadata file
    flag=$(cat /challenge/metadata.json | jq -r '.flag')
    echo "Here's your flag: $flag"    
    exit 0  # Exit with success code
fi
Next, the script compares the user's guess to the target number. If the guess is too low, it says, `"Higher! Try again"` If it’s too high, it says, `"Lower! Try again."` And if it's right, it prints the flag. The logic works fine overall, but there’s a catch. If you enter a number with a leading zero followed by something greater than 7 (like `099`), the program crashes—and it *still* prints the flag to the console:
The issue arises from how the script handles input with leading zeros, such as `099`. In Bash, numbers starting with `0` are interpreted as octal (base 8) instead of decimal (base 10). Octal numbers only allow digits `0` through `7`, so entering something like `099` confuses Bash since `9` isn’t valid in octal. This causes the program to crash, but instead of handling the error properly, the script continues running and inadvertently prints the flag to the console. This bug can be exploited to bypass the game entirely and retrieve the flag without playing. By simply entering an invalid octal number, the error is triggered, causing the program to behave unexpectedly. Fixing this bug requires ensuring that user input is always treated as decimal and properly validated to prevent such edge cases. Simple changes, such as stripping leading zeros or enforcing base-10 interpretation, can safeguard against this issue. For example, using the following code: ```sh guess=$((10#$guess)) ``` > If you want to know more about the bug, you can simply Google it using the keyword 'leading zeros in bash,' or just read [this](https://www.oasys.net/fragments/leading-zeros-in-bash/) simple article. ## Solver You can see the solver (by playing the game) [here](https://github.com/azizp128/ctf-exploits/blob/main/picoCTF/picoCTF-2024/general-skills/binary-search/exploit.py). # WinAntiDbg0x300 ## Deskripsi
## Walkthrough Diberikan sebuah file zip yang berisi 3 file berikut:
Ketika file `WinAntiDbg0x300.exe` dijalankan, maka akan menghasilkan output berikut:
Dari deskripsi tersebut bisa diketahui bahwa flag bisa diperoleh dengan menjalankan program ini di debugger. Seperti biasanya, sebelum melakukan analisis lebih dalam, saya mengecek terlebih dahulu kumpulan string yang ada di program ini dengan perintah: `strings WinAntiDbg0x300.exe` untuk menemukan flagnya.
Setelah mencari menggunakan grep dan ekplorasi manual dengan `ltrace`, `strace`, dan `strings`, saya tetap tidak menemukan flagnya. Tetapi, saya menemukan bahwa program ini dikompresi dengan UPX, sebuah packer yang digunakan untuk memperkecil ukuran program atau “menyembunyikan” bagian kode aplikasi dari analisis awal di reverse engineering.
### Dekompresi Program Untuk melakukan dekompresi UPX ini sangatlah mudah, saya hanya perlu mendownload UPX dari [GitHub](https://github.com/upx/upx) dan menjalankan perintah: `upx -d WinAntiDbg0x300.exe -o WinAntiDbg0x300_unpacked.exe`
Setelah melakukan dekompresi, saya kemudian mengecek kembali kumpulan string yang ada di program ini dengan `strings`, `strace`, dan `ltrace`. Namun, tetap saja tidak menemukan flagnya dengan cara ini.
### Analisis Statik Setelah langkah awal tidak memberikan hasil, saya kemudian melakukan analisis statik lanjutan dengan Ghidra. Jika kalian ingin mempelajari cara menggunakan Ghidra, bisa lihat [tutorial ini](https://www.youtube.com/watch?v=fTGTnrgjuGA).
Di bawah ini adalah tampilan awal ketika program hasil dekompresi dibuka di Ghidra.
Di window sebelah kiri paling atas berisi struktur segmentasi dari program yang sedang dianalisis. Ini merepresentasikan layout memori dari file binari. Di window dengan garis warna hijau berisi daftar dependensi yang digunakan oleh file binari. Sedangkan di kotak warna biru adalah daftar fungsi internal yang ditemukan dalam file binari. Karena ada terlalu banyak fungsi lokal dan saya malas untuk mengecek isi dari setiap fungsi satu persatu :), jadi saya langsung mencoba untuk mencari flagnya melalui fitur `Program Text`.
Saya tidak menemukan flag aslinya dari hasil search text ini. Namun, saya menemukan sejumlah string berisi pesan untuk menampilkan flagnya.
Saya kemudian langsung mengecek lokasi di mana string flag ini pertama kali ditemukan, ternyata berada di lokasi `0040392b`. Dan setelah menuju ke lokasi tersebut, muncul hasil dekompilasi kode berikut: ```c /* WARNING: Removing unreachable block (ram,0x004038e0) */ /* WARNING: Removing unreachable block (ram,0x00403911) */ /* WARNING: Removing unreachable block (ram,0x00403929) */ undefined4 FUN_00403740(void) { WCHAR local_384 [260]; CHAR local_17c [272]; _STARTUPINFOA local_6c; BOOL local_24; DWORD local_20; _PROCESS_INFORMATION local_1c; DWORD local_8; memset(&local_6c,0,0x44); local_6c.cb = 0x44; local_1c.hProcess = (HANDLE)0x0; local_1c.hThread = (HANDLE)0x0; local_1c.dwProcessId = 0; local_1c.dwThreadId = 0; local_8 = 0; local_20 = GetCurrentProcessId(); GetModuleFileNameW((HMODULE)0x0,local_384,0x104); thunk_FUN_00403e50(local_17c,0x110,"%ws %d",(char)local_384); thunk_FUN_00402bc0(2); do { local_24 = CreateProcessA((LPCSTR)0x0,local_17c,(LPSECURITY_ATTRIBUTES)0x0, (LPSECURITY_ATTRIBUTES)0x0,0,0,(LPVOID)0x0,(LPCSTR)0x0,&local_6c, &local_1c); if (local_24 == 0) { MessageBoxW(DAT_0040c704, L"[FATAL ERROR] Unable to create the child process. Challenge aborted.", (LPCWSTR)&lpWindowName_0040c3e0,0x10); thunk_FUN_00402e00(0xff); } WaitForSingleObject(local_1c.hProcess,0xffffffff); GetExitCodeProcess(local_1c.hProcess,&local_8); if (local_8 == 0xff) { MessageBoxW(DAT_0040c704,L"Something went wrong. Challenge aborted.", (LPCWSTR)&lpWindowName_0040c3e0,0x10); thunk_FUN_00402e00(0xff); } else if (local_8 == 0xfe) { MessageBoxW(DAT_0040c704, L"The debugger was detected but our process wasn\'t able to fight it. Challenge ab orted." ,(LPCWSTR)&lpWindowName_0040c3e0,0x10); thunk_FUN_00402e00(0xff); } else if (local_8 == 0xfd) { MessageBoxW(DAT_0040c704, L"Our process detected the debugger and was able to fight it. Don\'t be surprised if the debugger crashed." ,(LPCWSTR)&lpWindowName_0040c3e0,0x10); } CloseHandle(local_1c.hProcess); CloseHandle(local_1c.hThread); Sleep(5000); } while( true ); } ```
Setelah mengecek kode hasil dekompilasi tersebut, ternyata di sana tidak berisi fungsi untuk men-trigger flagnya. Namun, jika dilihat kembali, terdapat dua fungsi yang dieksekusi di awal sebelum perintah looping `Do While`, yaitu `thunk_FUN_00403e50` dan `thunk_FUN_00402bc0` Namun, setelah mengecek kedua fungsi tersebut dan tidak menemukan clue yang jelas untuk mendapatkan flagnya, saya kemudian melihat flow fungsi `FUN_00403740` melalui graph.
Dan jika mengikuti flow graph di sebelah kiri, yaitu fungsi `LAB_004038e0` dan melihat isinya, bisa dilihat bahwa fungsi inilah yang sebenarnya akan menampilkan flagnya.
### Patching Setelah mengetahui flow untuk mendapatkan flag, kemudian langkah selanjutnya adalah saya perlu memanipulasi flow program ini untuk mendapatkan flagnya. Supaya fungsi `LAB_004038e0` dieksekusi dan selanjutnya akan mengeksekusi `LAB_00403929` (flag), maka saya perlu memanipulasi hasil dari instruksi `TEST EAX, EAX` di fungsi `LAB_004037c0` supaya instruksi `JZ LAB_004038e0` dieksekusi dan melompat ke arah flow sebelah kiri yang menuju ke fungsi yang men-trigger flag (`LAB_00403929`).
Di sini, terdapat instruksi `TEST EAX, EAX` yang melakukan operasi bitwise AND pada `EAX`, dan dilanjutkan eksekusi instruksi `JZ LAB_004038e0` yang akan melakukan lompatan ke fungsi `LAB_004038e0` jika hasil `TEST EAX, EAX` adalah `0`. Karena `TEST EAX, EAX` akan selalu menghasilkan output `1`, maka instruksi `JZ LAB_004038e0` tidak akan pernah dieksekusi, dan program akan melanjutkan ke instruksi di flow graph sebelah kanan (looping do while), yang artinya fungsi untuk men-trigger flag (flow sebelah kiri) tidak akan pernah dieksekusi. Supaya flow di sebelah kiri dieksekui, maka saya perlu memanipulai flow instruksi di fungsi ini supaya instruksi `JZ LAB_004038e0` dieksekusi. Dan untuk melakukan ini sangatlah mudah, saya hanya perlu mengubah instruksi `JZ` (Jump Zero) dengan `JNZ` (Jump Not Zero) melalui `Patch Instruction`:
Dan setelah berhasil melakukan patching instruksi dari `JZ` ke `JNZ`, maka hasil dekompilasi dari fungsi yang men-trigger flag akan tampil secara otomatis di window dekompilasi kode:
Kemudian langkah selanjutnya adalah mengeksport hasil patching dan menjalankan programnya.
Dan saat program hasil patching dijalankan, maka flag akan secara otomatis muncul dalam bentuk pop up alert window.