Elkamika

#include <stdio.h>
#include <string.h>
#include <stdlib.h>


void vuln()
{

	char key = 'A';
	char name[32];

Elkamika

SECTION .text
global  _start
 
_start:
		add rsp, 0x8
		cmp WORD [rsp], 0x0002
		jne _start
		cmp DWORD [rsp + 4], 0x100007f

Elkamika

from pwn import *
from struct import pack
import sys
import os

def u8(x):
    return pack("B", x)


conn = remote('localhost',8080)

Elkamika

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include <sys/types.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <netdb.h>

Elkamika

/**
*  FreeBSD net stack hooking
*  Used as demo for debugging and RCE in kernel space
*/

#include <sys/types.h>
#include <sys/systm.h>
#include <sys/module.h>
#include <sys/errno.h>
#include <sys/param.h>

Elkamika

SRCS=nethook.c
KMOD=nethook
.include <bsd.kmod.mk>

Elkamika

import pymod

paths = 'A' * 10
pymod.func(paths)

Elkamika

#include <Python.h>

#define BUFF_ZIZE 30


static PyObject *
pymod_func(PyObject *self, PyObject *args)
{
    const char *buffargs;
    char *buffer[536];

Elkamika

from distutils.core import setup, Extension

module1 = Extension('pymod',
                    sources = ['pymod.c'])

setup (name = 'pymod',
       version = '1.0',
       description = 'This is a modules',
       ext_modules = [module1])

Elkamika

#include <stdio.h>
#include <stdlib.h>
#include <apr-1/apr_allocator.h>

#define ALLOC_SIZE 100
int main(int argc, char const *argv[])
{
	/* code */
    apr_allocator_t *allocator;
    apr_memnode_t   *memory;