| import trio | |
| DOMAIN = "example.com" | |
| PATH = "/" | |
| async def main(): | |
| s0 = await trio.open_ssl_over_tcp_stream(DOMAIN, 443, https_compatible=True) | |
| # Request a connection to the website | |
| await s0.send_all(f"GET {PATH} HTTP/1.1\r\nHost: {DOMAIN}\r\n\r\n".encode()) |
TL;DR: Grab this value jq -r '.location' $(sudo -u caddy caddy environ | awk -F'=' '/^caddy.AppDataDir=/{print $2"/acme/acme-v02.api.letsencrypt.org-directory/users/*/caddy.json"}') and jump to step 4.
In your Caddyfile you should add an email to the Global Options Block:
{
email demo@example.com
}
| import httpx | |
| from flask import Flask, request | |
| URL = 'http://example.com/vuln' | |
| client = httpx.Client(http2=True) | |
| app = Flask(__name__) | |
| @app.route("/vuln") | |
| def hello_world(): | |
| param = request.args['q'] |
| version: '3.8' | |
| services: | |
| web: | |
| build: ./ | |
| ports: | |
| - "5000:80" | |
| depends_on: | |
| - memcached |
| import angr | |
| proj = angr.Project("./chal", auto_load_libs=False) | |
| state = proj.factory.entry_state() | |
| simgr = proj.factory.simulation_manager(state) | |
| simgr.explore(find=lambda s: b"Correct!" in s.posix.dumps(1)) | |
| # Out[6]: <SimulationManager with 2 active, 34 deadended, 1 found> | |
| print(simgr.found[0].posix.dumps(0)) |
| import trio # python3 -m pip install --upgrade trio | |
| HTML = "<html>Hello World!</html>" | |
| HTTP_BANNER = f"HTTP/1.1 200 OK\nContent-Length: {len(HTML)+1}\n\n{HTML}\n".encode() | |
| async def forward_from_a_to_b(a, b): | |
| async for chunk in a: | |
| print(f"=> {chunk}", flush=True) | |
| await b.send_all(chunk) |
| /* | |
| Code to unlock all (176) levels: | |
| * face3 (sad face) | |
| * radioactive_ring | |
| * triangle | |
| * skull | |
| * square | |
| */ | |
| import java.util.Arrays; | |
| import java.util.Random; |
| #include <string.h> | |
| /* | |
| gcc -c -o hook.o hook.c | |
| gcc -shared -o hook.so hook.o | |
| LD_PRELOAD=./hook.so ./binary | |
| */ | |
| int getentropy(char *s, int size) { | |
| memset(s, 0x41, size); |
| # Edit: this doesn't work, I can't get the upstream part to be "raw" | |
| # Also this error: "http.request.tls.server_name" will be "signal.xn--sb-lka.org" and not the inner SNI | |
| signal.xn--sb-lka.org { | |
| #respond / "HELLO" | |
| map {http.request.tls.server_name} {my_placeholder} { | |
| chat.signal.org "chat.signal.org:443" | |
| ud-chat.signal.org "chat.signal.org:443" | |
| textsecure-service.whispersystems.org "chat.signal.org:443" |
| from io import BytesIO | |
| from time import sleep, time | |
| from picamera import PiCamera | |
| from PIL import Image, ImageChops | |
| import numpy as np | |
| def take_image(cam, stream): | |
| stream.seek(0) | |
| # stream.truncate() # resize to current position | |
| print("Taking image") |