Segflow

package main

import (
	"encoding/json"
	"net/http"
	"strconv"
	"time"

	"github.com/prometheus/client_golang/prometheus"
	"github.com/prometheus/client_golang/prometheus/promauto"

Segflow

package benchmark

import (
	"runtime"
	"testing"
)

func switchImplementation() int {
	switch runtime.GOARCH {
	case "amd64":

Segflow

# -*- coding: utf-8 -*-

from pwn import *
import sys

LOCAL = True
ASLR = False

BINARY = "./GroceryList"
HOST = "chal.noxale.com"

Segflow

package main

import (
	"fmt"
	"log"
	"net/http"
	"os"
	"strings"

	"golang.org/x/net/html"

Segflow

# -*- coding: latin-1 -*-
# 
'''
STRUCT: item->next + 4 Random Byte + READ1(0x20) + READ2(0x100) + PRICE(4)

Items are stored in a linked list:
0x0000000001bcaba0 -> 0x0000000001bcaa60 -> 0x0000000001bca920
    ^- HEAD
    
Mapped address spaces:

Segflow

from ctypes import *
from pwn import *
from z3 import *
import datetime
import calendar


libc = CDLL("libc.so.6")

r = remote("securelogin.acebear.site", 5001)

Segflow

from pwn import *

r = remote('localhost', 12345)
pop_rdi = 0x00401550
puts_got = 0x602018
call_puts = 0x0040122f


rop = p64(pop_rdi)
rop += p64(puts_got)

Segflow

import sys

# Same as build 3133 patch (patch and explanation can be found here https://gist.github.com/Segflow/05544363d6bb5d16517c032e028f6386)
# Except the offset which is now `0xe25f`

offset=0xe25f

if len(sys.argv) != 2:
    print('Usage: {} SUBLIME_TEXT_BIN'.format(sys.argv[0]))
    print('Exemple: {} /opt/sublime_text/sublime_text'.format(sys.argv[0]))

Segflow

import sys


# The license check happens at sub_40E0B0
# 40E13D:  call    sub_419226
# 40E142:  dec     eax
# 40E144:  setnz   al
# 40E147:  test    al, al
# 40E149:  mov     cs:byte_A0E630, al
# 40E14F:  jz      loc_40E1D8

Segflow

from pwn import *
from struct import pack
import hashlib
import sys
import os.path
import re
import sys

# START READING FROM LINE: 89