12 ms·
Hack your way through Stripe's Capture the Flag
- jessepollak 15y agoanyone have any good resources for understanding the basics of all of this?
- simon_weber 15y agoThe venerable CMU binary bomb assignment covers a lot of useful concepts.
- zaptheimpaler 15y agoHaha we just had that last week ( finished Buffer Overflow Lab a few hours ago! ), its definitely helping.
- olalonde 15y agoFor level 1 to 3, Google those: system() exploit, never trust user input, buffer overflow
- jessepollak 15y agothanks! I got 1 and 2 before I saw this, but we'll see how I do on 3.
- turkeygizzard 15y agoI'm entirely new to hacking, and as such I'm struggling with level 1. I looked up the system() exploit, and I've managed to compile my own date program, but when I try to read the password from level02, I'm told I don't have permission. Could you point me in the right direction?
- pavel_lishin 15y agoI keep getting this: level01@ctf:/tmp/tmp.c6PoABNv99$ ls bash: fork: retry: Resource temporarily unavailable
- sdfjkl 15y agoSomeone set us up the (fork)bomb. That didn't take long. Sadly it's a bit silly and ruins all the fun for the rest of us :-/
- dbalatero 15y agoCould something like this (http://www.cyberciti.biz/tips/linux-limiting-user-process.html http://www.cyberciti.biz/tips/linux-limiting-user-process.ht...) be quickly implemented on the server?
- ab 15y agoYep, that's why you're seeing that error message rather than the machine immediately grinding to a halt! (Please don't forkbomb it, though.)
- jcromartie 15y agoSociopaths...
- deleted 15y ago[deleted]
- jetsnoc 15y agoI think people must be brute-forcing level03 instead of figuring out how to calculate the index they need?! That could work but you won't know how address math/pointer math actually works. This isn't really fair to yourself, you'll be skipping out on understanding what a word size is. But, for those uninterested in the minutiae of how it actually works if you are going to brute force this please compile this application on your OWN 64-bit system (gcc -g -o level03 level03.c) and run your nasty for() loop there so you aren't hosing the processes on this system!
- dbalatero 15y agoI'm getting a bunch of "bash: fork: retry: Resource temporarily unavailable" in my SSH session when running commands like `ls`, etc. Could be due to high traffic?
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- akukurt 15y agoim getting this.."bash: fork: retry: Resource temporarily unavailable" each and every time. is that a sign that i won this game without executing any cli yet?
- jetsnoc 15y agoIt's fun to feel like a nefarious hacker. I'm at level2, see you at level 6 guys!
- farnsworth 15y agoAny tips? I want to actually learn from this - I'm not just looking for the answers. But I've read wikipedia on setuid, googled around a bit, and am still not sure what to do.
- lftl 15y agoMy hint for level01 would be to look at the system line, and think about how it is executed.
- CZ-18 15y agoEDIT: doh, didn't know we had write access to /tmp, that makes it easy
- farnsworth 15y agoWhen you first connect, you are in a /tmp/tmp.something directory which you can edit.
- pvsnp 15y agoYou can also do cd $(mktemp -d) and get a new one if you need another one.
- sim0n 15y agoRemember that you have write access to /tmp(/date) ;)
- dmuino 15y agoYou can write to /tmp. But since most people are also doing that, /tmp/date gets overriden frequently. I'd recommend mkdir /tmp/CZ-18; PATH=/tmp/CZ-18:$PATH; And then you can figure it out :)
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- deleted 15y ago[deleted]
- lurker17 15y agoBonus to anyone who gets the answer by intercepting another solver's email message.
- sdfjkl 15y agoI just hope this machine is isolated from Stripe's network, in case someone makes it to secret level 99.
- gdb 15y agoYep, it's completely isolated. Someone rooting the machine is very much within our threat model :).
- heywire 15y agoMust be fun watching all of the attempts... Do you have any way to monitor progress?
- gdb 15y agoWe don't have an exposed way. We'll probably do a summary blog post in the future with stats though!
- chrisacky 15y agoI've been trying to read $ history Failed. :) I figured that would of been an easy way to progress through the levels. Read bash history from other users.
- saurik 15y ago(This would certainly work if you can read my history: I don't consider the level "complete" until I get it down to a short bash one-liner that prints out the password. ;P)
- 15y ago
- chrisacky 15y agoLots of segfaults! Which by the looks of things, level03 is the furthest anyone is based on logs. > [32041.680408] level03[17009]: segfault at ffdc50c4 ip 00000000080487b2 sp 00000000ffe0aee0 error 4 in level03[8048000+1000]
- jcromartie 15y agoHello from segfault land!
- tlb 15y agoDamn Linux stack randomization. Some amount of brute force seems to be required.
- deleted 15y ago[deleted]
- olalonde 15y agoI'm getting the following (no source/binary file... is it part of the challenge or is there something wrong?): level01@ctf:~$ pwd;ls -al /home/level01 total 24 dr-x------ 2 level01 root 4096 2012-02-22 13:28 . drwxr-xr-x 9 root root 4096 2012-02-22 13:28 .. -rw-r--r-- 1 level01 level01 220 2010-04-19 02:15 .bash_logout -rw-r--r-- 1 level01 level01 3103 2010-04-19 02:15 .bashrc -rw------- 1 level01 root 11 2012-02-22 13:28 .password -rw-r--r-- 1 level01 level01 675 2010-04-19 02:15 .profile
- deleted 15y ago[deleted]
- farnsworth 15y agothat's the home directory, i think you want /levels
- olalonde 15y agoOops, thanks!
- ghost91 15y agoWhat am I doing wrong: Current time: cat: /home/level02/.password: Permission denied Does someone has a tip?
- dangrossman 15y agoSaying anything more would be ruining the contest.
- deleted 15y ago[deleted]
- jc4p 15y agoThe whole point is that you're supposed to find vulnerabilities in what you have access to and exploit them to view contents of things you don't have permission to.
- ghost91 15y agoI replaced the date with my own script, but it still gets executed as level01 user
- necubi 15y agoHint: not all shells blindly run scripts as the setuid user.
- alanstorm 15y agoHINT: For the purpose of this hint we'll assume your script is a bash script. If you've exploited the setuid program to run your script, bash may execute with the elevated permissions, but any program bash runs will run with your permissions.
- heywire 15y agoThis is fun! Kudos to Stripe for putting this together... level03, working on level04...
- jtchang 15y agoIs /home/level02/.password empty?
- jc4p 15y agoIt includes the password for the level02 account.
- mjijackson 15y agoRead this if you're stuck on level 3: http://destroy.net/machines/security/P49-14-Aleph-One http://destroy.net/machines/security/P49-14-Aleph-One
- dthunt 15y ago<3 I read this back in college, ages ago. Still relevant - not quite up there with K&R as far as technical writing goes, but it does indeed do the job of making a theoretical problem into an understandable & exploitable one, and for that reason "Smashing the Stack For Fun And Profit" is a phrase that has a special place in my heart.
- mirkules 15y agoThanks for that link. Reading through one of the first sections about pushing parameters to the stack, I noticed the call: gcc -S -o example1.s example1.c However, example1.s looks very different on Mac than on Linux, in particular, on Mac the parameters are pushed in reverse order: Leh_func_begin2: ... movl $1, %eax movl $2, %ecx movl $3, %edx movl %eax, %edi movl %ecx, %esi callq _function Whereas on Linux, they are pushed in the order specified in that link: movl $3, %edx movl $2, %esi movl $1, %edi call function What is the reason behind this? Is it that the stack on OS X is implemented to grow up instead of down?
- starnix17 15y agoAnyone having trouble connecting to this?
- jnorthrop 15y agoI am. I think their server must be overloaded. I bookmarked the blog post announcing this and I'm going to try again tomorrow.
- dthunt 15y agopeople were having fun with forkbombs a bit ago. Presumably we're on the synflood stage now.
- gdb 15y agoYeah, we're rebooting. Should be up in a few more minutes. Sorry about that.
- saurik 15y agoFor anyone building something similar, I imagine having an elastic load balancer for TCP port 22 with a health check on a web service that spawns a process as each of the user accounts before returning "good", combined with an auto-scaling group to make certain there are always a couple healthy instances, would be an automated way to keep something like this running through fork bombs.
- mirkules 15y agoI was in there 5 minutes ago, did cat /levels/level02.c and then it stopped responding. I don't think cat could crash the server, but if it did, I'm sorry?
- derwildemomo 15y agopretty sure it wasn't you. but then again, you never know with cats.
- zobzu 15y agoSomeone already fork-bombed it ;-)
- mjijackson 15y agoAw, sad. The server seems to be non-responsive.
- albertogh 15y agoIt looks like the machine is under heavy load. My shell just stopping responding and now ssh hangs while connecting :-(.
- balloot 15y agoBah. Looks like the server is now not responding. Bummer, because this is really fun.
- why-el 15y agoI can't connect to it.
- deleted 15y ago[deleted]
- gravitronic 15y agoIs this based on the classic digital evolution wargames? :D
- toblender 15y agoI think we ended up dDosing the machine...
- spydum 15y agoWas up and working, got to level 3, and network died. I love CTF's.. Got a chance to do the CTF @ Sans (netwars) Orlando in 2011, and it was a blast.
- pranjalv123 15y agoI'm getting a Remote Host Identification Changed error, did you guys change your certificate or is someone trying to MITM me?
- jazzychad 15y agouh oh, remote host identification has changed... new host or mitm? as this is a cracker-centric event, i'm now very hesitant to reconnect... perhaps you could publish the correct fingerprint somewhere?
- jessepollak 15y agosame...hopefully it will get resolved soon.
- gdb 15y agoNew host :). We brought up a new machine for this, and didn't copy over the SSH keys. Never hurts to be paranoid though.
- jcr 15y agoYou should note that the SSH key has been changed. $ dsocks.sh ssh level01@ctf.stri.pe @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY! Someone could be eavesdropping on you right now (man-in-the-middle attack)! It is also possible that a host key has just been changed. The fingerprint for the RSA key sent by the remote host is 74:67:32:4a:04:b8:9f:05:b6:e8:29:43:26:12:75:11. Please contact your system administrator. Add correct host key in /home/jcr/.ssh/known_hosts to get rid of this message. Offending RSA key in /home/jcr/.ssh/known_hosts:8 RSA host key for ctf.stri.pe has changed and you have requested strict checking. Host key verification failed. It may be something harmless/simple like round-robin DNS combined with a failure to replicate the key, or more likely, someone has rooted the box. EDIT: As confirmed by gdb and ab below, there's a good reason for the key change.
- jetsnoc 15y agoI'm estimating they booted a few new EC2 systems up. Right before the system got a new key it was unavailable.
- awm 15y agoGot that also, then keep getting: ssh_exchange_identification: Connection closed by remote host Looks fun too!
- gdb 15y agoThat's what happens when hundreds of people try to SSH into a machine at once :). (That error due to SSH's maxstartups being exceeded.)
- mjijackson 15y agoCan anyone from Stripe confirm that this box is not rooted?
- gdb 15y ago
- gqwo 15y agoAm i just too stupid or is there a problem with level2, i can open files like /etc/passwd but not /home/level03/.password
- lftl 15y agoPretty sure it's broken right now. It was working earlier, but it returns nothing now, and the password that was in place doesn't work any more.
- gravitronic 15y agoFor a second I thought it was a brilliant trick and the password for level03 was blank.. but no. haha.
- gdb 15y agoWe're taking a look! (Bleh, spinup scripts not working as well as you'd like....)
- gqwo 15y agoah, now it works thanks
- jessepollak 15y agoIt's working now! Before it wasn't even printing my user agent and info though.
- deleted 15y ago[deleted]
- gdb 15y agoI think the machine was actually hosed due to fork bomb. (I kept bumping the rlimits as more people logged in and ran up against nprocs, but the last time I clearly just bumped nprocs way too high. Live and learn....) You certainly should be able to solve all of the levels without tons of brute force though.
- phzbOx 15y agoJust a word on level2, I don't think that's a hint, if you think so I'll remove this comment asap. The login to get on the page is: level02 and the password is what you've found in level01. I.e. The challenge is not to crack that "Authorization required" dialog.
- spicyj 15y agoThe welcome message says: > This one is a web-based vulnerability, so go ahead and point your browser to XXXXX. You'll need to provide the password for level02 using HTTP digest authentication. so no, it's not the challenge. :)
- phzbOx 15y agoYeah.. but I somewhat didn't realized it was the same l/p of the ssh and was trying to crack it ;) Or, more particularly, find a way around that protection to access the challenge behind it.
- deleted 15y ago[deleted]
- archivator 15y agoSPOILERS! In all seriousness, you're giving away way too much information, please edit it away!
- ryan-c 15y agoIt seems to be down again.
- sgricci 15y agoIs part of the challenge dealing with the server timeouts? In all seriousness, thanks for this!
- jcr 15y agoJust a quick note on the claimed fork bomb. It may not have been all that nice to other users, but there may have been a method to their madness: http://dtors.org/2010/08/25/reversing-latest-exploid-release/ http://dtors.org/2010/08/25/reversing-latest-exploid-release...
- a1k0n 15y agoASLR and non-executable stack make level 4 a huge pain in the ass. (But it's not me doing that)
- a1k0n 15y agoUpdate: they helped a brother out, and the stack is actually executable on those binaries. I found out after mailing the organizers in exasperation. I was under this impression because newly-compiled binaries had no-exec on the stack, and I was off by a little when I tried to exploit it the first time. Doh!
- saurik 15y agoHa! Last night I read your comment, assumed you were right, and then came up with a solution that did not assume an executable stack. ;P (I'm actually quite glad, as messing around with the stack would have been much harder.)
- swolchok 15y agoFor both of you, were your solutions 100% reliable? I ended up with an exploit that required a little brute forcing (i.e., just run it a hundred times or whatever).
- saurik 15y agoNeither of our solutions were "reliable", and also required being run in a loop. (I know this about a1k0n's solution, as he sent me an e-mail asking me about my solution).
- semisight 15y agoCan anyone give me a hint on level 02? I have absolutely no background in PHP, and only a little in HTML. If you wanna keep the message thread private you can email me too at billyman3 at gmail.
- david_xia 15y agoFirst play with the webpage after entering the correct credentials. Then read through the PHP script that generates that page and understand what's going on behind it. Do you see any vulnerabilities in it?
- dillona 15y agoI got to level 5, but I think it is time to call it a night
- mhartl 15y agoOnce they've run this for a while, I'd love to see a post and screencast on some of the techniques needed to solve it. I don't know much about this subject, and I'd enjoy having a chance to learn in a setting unlikely to get me arrested.
- david_xia 15y agoI would also like to see a detailed explanation of how they prepared the box to safely allow people to play (ie logins, permissions, etc). How to restrict privileges yet allow just enough to make it varied and fun.
- saurik 15y agoThe big thing is that we are connected into a chroot that has neither /proc nor /sys mounted, and which itself is on a read-only filesystem.
- mirkules 15y agoI'd love to see how people solved #2, and if they used any special tools like I did or if there's an easier way to do it. And I can't wait to delve deeper into #3 tomorrow :)
- EwanToo 15y agoFor 2, I just used this short command line: http://pastebin.com/4nAWNrgV http://pastebin.com/4nAWNrgV I've stuck it on pastebin instead of in this comment, so it doesn't spoil it for anyone not looking.
- mkopinsky 15y agoTool used: One line of javascript, entered in location bar. (Seems Chrome resource inspector doesn't allow the edit I needed.)
- Ideka 15y agoDamn, I always forget you can actually just use javascript to "do it", and end up using a Firefox add-on.
- deleted 15y ago[deleted]
- le_isms 15y agoHere's the descriptions for all the levels from /usr/local/bin/ctfsh... https://gist.github.com/1890401 https://gist.github.com/1890401
- azernik 15y agoFor CTF on shared servers, there need to be some explicit rules about DOSing shared resources; otherwise things get really dull really fast. If people are going to be using brute-force tactics, they're probably each going to need separate virtual machines.
- deleted 15y ago[deleted]
- mirkules 15y agoGuys, I gotta say, this is SO much fun! I am actually learning a ton, and while I'm only up to level 3, I feel this is such an awesome learning experience! Plus, I feel totally "leet" for figuring out levels 2 and 3. The world definitely needs more of these.
- ianbishop 15y agoAh man, I couldn't agree more. I've learned a ton just messing around with the first few, though getting this was a real bummer: Run till exit from #0 run (str=0xffece7ec "cat /home/level04/.password") at level03.c:53 cat: /home/level04/.password: Permission denied Ah well, a sign to go to sleep. Tomorrow I'll have to learn more things to figure it out if it's still up.
- jsharpe 15y agosetuid doesn't work inside of GDB. You have to run the program without a debugger to get level04 permissions. (Disclaimer: I haven't succeeded yet.)
- mirkules 15y agoI mostly live inside a Java world or XCode world, so GDB is almost a totally foreign concept to me - and I definitely welcome the challenge. Never really had to look at assembly before either, so this is a fun learning experience.
- Rudisimo 15y agoSame here, but I'm stuck on level 3 though...maybe my strategy is wrong. I am able to execute the function run from /levels/level03 with the following command: cat /home/level04/.password But I'm still getting access denied. I thought that would have done it for sure. The program runs under the following credentials: uid=1003(level03) gid=1004(level03) groups=1001(chroot),1004(level03) Which is kind of weird since /levels/level03 has a setuid of level04. It could be gdb...
- 15y ago
- emeraldd 15y agoWell, it looks like the vm is slammed again. I keep getting failures trying to run a shell after logging in.
- qdqss 15y agosdfh史蒂夫
- tzs 15y agoThe asshole who fork bombed it is boasting on Reddit: http://www.reddit.com/r/programming/comments/q1qii/want_to_try_your_hand_at_writing_exploits_try/c3u09kc http://www.reddit.com/r/programming/comments/q1qii/want_to_t... Anyone else not at all surprised who it is?
- bmohlenhoff 15y agoThis actually made me laugh a little bit as it brought me back to my college days. The first week of February every year was when the yearly OS class covered fork(), and as a result the compute clusters all over campus were basically unusable due to people trying to run their homework. Ahh, memories.
- deleted 15y ago[deleted]
- fatbat 15y agoThis person? http://www.linkedin.com/in/teddziuba http://www.linkedin.com/in/teddziuba I don't get the "not surprised" part? :\
- bound008 15y agoted used to run uncov. think maddox but actually coherent about startups and programming. here is an idea of his now grown up writing style: http://teddziuba.com/2010/10/taco-bell-programming.html http://teddziuba.com/2010/10/taco-bell-programming.html and here is an old hackernews post dicussing uncov... http://news.ycombinator.com/item?id=328217 http://news.ycombinator.com/item?id=328217
- look_lookatme 15y agoUgh, this sucks. Got to #3 and which looks pretty challenging for me and took some time to document my steps there and now someone has pulled this again. It just seems childish.
- aw3c2 15y agoThat is only one of them and please do not give such people the attention they try to get through this.
- deleted 15y ago[deleted]
- saurik 15y agoFYI: the worker process for level05 isn't working anymore (I'm pretty confident it was not me that broke it, btw ;P); even with the simple "hello friend" example (exactly as given in the MOTD on the account), the server always returns "job timed out" (it is now about 3am PST). (edit:) ...and as of almost 3:30am PST, it is no longer possible to log in to the server. :( (...and while typing the next paragraph, I finally got in, but spawning processes is now taking forever, and the two-second job timeout has worked its way up to almost 5 seconds. Maybe another sill attack.) (Regardless, overall this has been rather well put together, and quite fun. I taught a freshman class at UCSB/CSS today on "how absinthe, the iPhone 4S jailbreak works", and got a few of the students interested in trying out the CTF to see what they might learn by working on it.)
- nviennot 15y agoSame here, I guess we are done. Not my fault ;)
- mpetrov 15y agoI'm also stuck at this point. Have the python exploit working on my localhost, now just need to run it live.
- saurik 15y agoYeah, same here. :( Part of me wonders whether someone with access to level06 went mucking around in the /tmp/level05 folder (which is itself 770 root.level06, so a level06 user can probably chmod 000 the queue folders) to keep other people from being able to get past that point.
- mpetrov 15y agoI actually just found a way to kill the worker process remotely (on my localhost). Perhaps they don't have it hooked up to supervisord for autorestart. It's almost trivial to run sys.exit() on that worker. That being said, your tmp folder permissions theory is much more interesting though and that would be a brilliant way keep everyone else from catching up. :)
- mds_ 15y agoAny subtle--no spoiler--hints for level03? I got the mem address for run() but can't seem to find the correct index for it.
- chubot 15y agoCopy the source locally, compile it, and use printf("%p") and void* casting on various variables. That will help figure out the required pointer arithmetic. You will likely encounter stack randomization but there is a way to do it without worrying about that.
- Drbble 15y agoIf you like this, you may enjoy the ICFP 2006 Cult of the Bound Variable puzzle http://www.boundvariable.org/task.shtml http://www.boundvariable.org/task.shtml
- z02d 15y agoI stuck even at lvl1 but I think how to solve it. Could anyone may help me? I want to learn and I don't want to spoiler here. Jabber: .thing@jabber.ccc.de ICQ: 366509265 Thanks
- z02d 15y agoDid it. Lvl 3 now
- RegEx 15y agoLooking forward to trying this! I bookmarked it for later and noticed the title was just "Stripe Blog". Could you put the title of your blog post in the title tag? Makes bookmarking and also sharing via bit.ly extension much easier :)
- ioquatix 15y agoTrying 0xfff86350 Trying 0xff94b1a0 Trying 0xffdfb0a4 Trying 0xff85e754 $ whoami level05 It is 5am - time for bed =)
- heywire 15y agoI can't stop thinking about this, but I have real work to do. Do you see what you've done Stripe??? :) It's going to be another long night...
- jarin 15y agoI feel like I just leveled up in programming several times by completing level 3 :)
- jetsnoc 15y agoI need a tutor for level03! I am SO close but obviously so far. Any one up for checking my current notes and homework and hinting at me as to my next move?
- CZ-18 15y agoAny tips for level05 (the python one)?
- CZ-18 15y agonvm, got it
- zx2c4 15y agoSPOILER SPOILER SPOILER Don't look at this if you actually want to enjoy the contest. http://pastebin.com/VJ4xpawq http://pastebin.com/VJ4xpawq
- xdissent 15y agoWow, I read in this very thread that NX was for sure disabled on level03 so I've been barking up the wrong tree completely. Your direction is brilliant! I never would have come up with that. Here's my attempt: http://pastebin.com/XVkfLaiB http://pastebin.com/XVkfLaiB Wait. wtf how is yours working with NX on? Edit: OH! Yours doesn't actually manipulate the stack so it doesn't get caught? That makes sense. I should have noticed the __stack_chk_fail calls.
- mpetrov 15y agoFor level 06, I came up with a completely different solution. After hitting my head against the wall all day trying to fight with blocking/non-blocking IO, I resorted to a timing attack on the system call which worked really well. Check it out: https://gist.github.com/1899389 https://gist.github.com/1899389 (SPOILERS!)
- zx2c4 15y agoThat's neat. Timing. Awesome. I made mine a bit more reliable and made a movie. Source: http://pastebin.com/6M4cq8gB http://pastebin.com/6M4cq8gB Video: http://www.youtube.com/watch?v=_q2wTd1jgUQ http://www.youtube.com/watch?v=_q2wTd1jgUQ
- benmmurphy 15y agoi did it a different way to both of you but similar to zx2c4 's :) i found a way to block the child process from writing to stderr. i thought the way they were writing to stderr/ stdout was too much of a coincidence. all stdout writes end with \n
- zx2c4 15y agoWadja end up doin'? Source?
- mekarpeles 15y agoIs it intended behaviour for users to be able to access other people's files via /tmp/tmp, tmp/hacks, etc?
- chubot 15y ago4 days later: level06@ctf6:/tmp/tmp.0fPRsmsetz$ /levels/level06 /home/the-flag/.password %%%%%%%%% Welcome to the password checker! ........................ Wait, how did you know that the password was %%%%%%%%%? Level 5 seemed too easy -- it seems like they forgot a much easier exploit. The code was carefully constructed in a way that suggested a pickle injection attack which required understanding the pickle stack machine, but you didn't need that. Level 6 was interesting. Some people got it with a timing attack. I used a different, more elegant method with a hint from reddit. Very well done, stripe.