FrankSpierings

function ProgressHack() {
	progressObject = null
	intProgress = Interceptor.attach(Module.findExportByName("libRealRacing3.so", "_ZNK10Characters14CareerProgress16IsStreamUnlockedEi"), {
		onEnter: function(args) {
			progressObject = args[0]
		},
		onLeave: function(result) {
		}
	});

FrankSpierings

function unlockHack() {
	playerObject = null
	interceptPlayer = Interceptor.attach(Module.findExportByName("Fruit", "_ZN16FruitNinjaPlayer11GetInstanceEv"), {
		onEnter: function(args) {
		},
		onLeave: function(result) {
			playerObject = ptr(result.toInt32())
		}
	});

FrankSpierings

### Add this specific input

- input_type: log
  paths:
    - /var/log/ufw.log
  tags: ["iptables"]

FrankSpierings

#!/bin/bash

#
# Script requires `brew`
# - `/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"`
#
# Variables 
# - $IPA -> Source IPA
# - $MOBILEPROVISION -> Source embedded.mobileprovision
#                       find ~/Library/Developer/Xcode | grep embedded.mobileprovision

FrankSpierings

//Use this function to show an object's contents.
function showObject(obj) {
	var result = null
	if (obj && obj.constructor === Array) {
		result = []
	}
	else if (obj === null) {
		return null
	}
	else {

FrankSpierings

function getGenericInterceptor(className, func, parameters) {
	args = []
	for (i = 0; i < parameters.length; i++) { 
        	args.push('arg_' + i) 
    }
    var script = "result = this.__FUNCNAME__(__SEPARATED_ARG_NAMES__);\nlogmessage = '__CLASSNAME__.__FUNCNAME__(' + __SEPARATED_ARG_NAMES__ + ') => ' + result;\nconsole.log(logmessage);\nreturn result;"
    
    script = script.replace(/__FUNCNAME__/g, func);
    script = script.replace(/__SEPARATED_ARG_NAMES__/g, args.join(', '));
    script = script.replace(/__CLASSNAME__/g, className);

FrankSpierings

FROM ubuntu:latest
MAINTAINER Frank Spierings

# Base setup
RUN dpkg --add-architecture i386 && \
    apt-get update && apt-get upgrade -y && \
    apt-get install libstdc++6:i386 -y

# Locales setup
RUN apt-get install locales -y && locale-gen en_US.UTF-8

FrankSpierings

Project

• This is to demonstrate how to work with angr on a static/stripped binary

Source

• Source angrtest.c

#include <stdio.h>

FrankSpierings

Variables

• HTTP_DTD_SERVER = HTTP server that serves ext.dtd
• HTTP_DTD_SERVER_PORT = Port of the HTTP server that serves ext.dtd
• HTTP_EXFIL_SERVER = HTTP server that serves for the data exfiltration
• HTTP_EXFIL_SERVER_PORT = Port of the HTTP that serves for the data exfiltration
• FTP_EXFIL_SERVER = FTP server that serves for the data exfiltration
• FTP_EXFIL_SERVER_PORT = Port of the FTP server that serves for the data exfiltration

Vanilla

FrankSpierings

Command line scripts for CTF's

Linux

Improve shell

• Improve the prompt:

bash -i