ammaraskar

#include                                     <math.h>
#include                                   <sys/time.h>
#include                                   <X11/Xlib.h>
#include                                  <X11/keysym.h>
                                          double L ,o ,P
                                         ,_=dt,T,Z,D=1,d,
                                         s[999],E,h= 8,I,
                                         J,K,w[999],M,m,O
                                        ,n[999],j=33e-3,i=
                                        1E3,r,t, u,v ,W,S=

ammaraskar

import socket
import sys

def get_info(host, port):
    #Set up our socket
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.settimeout(2.0)
    s.connect((host, port))

    #Send 0xFE: Server list ping

ammaraskar

/*
  aprilFools.css
  Written by Wes Bos
  I assume no responsibility for angry co-workers or lost productivity 

  Put these CSS definitons into your co-workers Custom.css file.
  
  They will be applied to every website they visit as well as their developer tools.
  
*/

ammaraskar

import socket
import struct
 
def get_info(host='localhost', port=25565):
    #Set up our socket
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    
    #Send 0xFE: Server list ping
    s.send('\xfe\x01')

ammaraskar

{
    "preNetty": {
        "78": {
            "0": "Keep Alive",
            "1": "Login Request",
            "2": "Handshake",
            "3": "Chat Message",
            "4": "Time Update",
            "5": "Entity Equipment",
            "6": "Spawn Position",

ammaraskar

Description

This challenge was interesting, in that it involved reverse engineering an NES game. An architecture that most people aren't likely to be familiar with: 6502. Thankfully, the architecutre is stupidly simple, one accumulator and two registers, once you get past the hurdle of getting proper tools to debug the program, it isn't too difficult.

Solution

First things first, we need to run the game, so I quickly looked up the most popular NES emulator and FCEUX was the top hit. Once you load up and run the .nes file provided, it goes through a lot of text and button pressing after which you are required to enter a 24 digit password to proceed. After you enter the password, you need to press a button to proceed which kinda hints that the raw letters must be stored somewhere in memory.

Luckily FCEUX has great in built debugging tools, including a HEX editor that allows you to inspect the entirety of the NES's memory. By entering an easily identifiable passphras

ammaraskar

For this challenge we're given a file called calcpop. Running it puts us in an interactive shell, where typing help gives us the following output:

➜  9447  ./calcpop
Welcome to calc.exe
help
Type 'exit' to exit.
Type two numbers and I will calculate their sum

ammaraskar

Challenge

We're given a web page where we can enter javascript code which the servers executes in a "sandboxed" environment.

Solution

So the first really critical part is getting information out about our execution, if our code runs perfectly fine we get a message saying Your plant is working...

Not terribly helpful. However, if your code throws an Error, you get the error message back like so:

ammaraskar

import sys
import struct
from pwn import *
context(arch='amd64', os='linux')


#r = gdb.debug(["./sandman"])
#r = remote("52.72.171.221", 9982)

url = 'http://'

ammaraskar

#!/usr/bin/env python3

inputs = """qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq
abcd5
aBcDeF
aBcDeFgHiJkLmNoPqRsTuVwXyZaBcDe
aBc9F1
aBcDeFg94JkLmNo8qRsTuVwXyZaBcD2
aBcDeF@
aBcDeF$