Skip to content

Instantly share code, notes, and snippets.

View d4em0n's full-sized avatar
🧐
learning

M Ramdhan d4em0n

🧐
learning
View GitHub Profile
@d4em0n
d4em0n / rsa.py
Created May 23, 2020 02:41
RSA given p, q
def mod_inverse(x,y):
# See: http://en.wikipedia.org/wiki/Extended_Euclidean_algorithm
def eea(a,b):
if b==0:return (1,0)
(q,r) = (a//b,a%b)
(s,t) = eea(b,r)
return (t, s-(q*t) )
inv = eea(x,y)[0]
@d4em0n
d4em0n / confusion_matrix_pretty_print.py
Created April 15, 2020 08:29 — forked from shaypal5/confusion_matrix_pretty_print.py
Pretty print a confusion matrix with seaborn
import pandas as pd
import matplotlib.pyplot as plt
import seaborn as sns
def print_confusion_matrix(confusion_matrix, class_names, figsize = (10,7), fontsize=14):
"""Prints a confusion matrix, as returned by sklearn.metrics.confusion_matrix, as a heatmap.
Arguments
---------
confusion_matrix: numpy.ndarray
@d4em0n
d4em0n / solve.py
Last active August 31, 2020 07:45
poly1305 key recovering from pair of 32 bytes message and tag
#!/usr/bin/env python3
import gmpy2
import binascii
key = binascii.unhexlify("85:d6:be:78:57:55:6d:33:7f:44:52:fe:42:d5:06:a8:01:03:80:8a:fb:0d:b2:fd:4a:bf:f6:af:41:49:f5:1b".replace(":", ""))
def clamp(r):
return r & 0x0ffffffc0ffffffc0ffffffc0fffffff
def poly_mac(msg, key):
from z3 import *
"""
Riddle :
Cari nilai [x1, x2, x3]
Clue:
[6, 8, 2] (satu angka benar dan posisinya benar)
[6, 4, 5] (satu angka benar dan posisinya salah)
[2, 0, 6] (dua angka benar tetapi posisinya salah)
[7, 3, 8] (tidak ada angka yang benar)
[7, 8, 0] (satu angka benar tetapi posisinya salah)
@d4em0n
d4em0n / exploit.py
Last active July 7, 2019 02:42
pwnable.tw - secret of my heart
from pwn import *
context.terminal = "tmux splitw -h -f".split()
#p = process("./secret_of_my_heart", env={"LD_PRELOAD":"./libc_64.so.6"})
p = remote("chall.pwnable.tw", 10302)
libc = ELF("./libc_64.so.6")
DEBUG = 0
cmd = ""
if DEBUG:
gdb.attach(p, cmd, gdb_args=["--init-eval-command='source ~/ctf/tools/gef/gef.py'"])
@d4em0n
d4em0n / hhhhh.c
Created April 15, 2019 14:46
exploiting tcache: overwrite malloc_hook without libc leak
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
void setbff(void)
{
setvbuf(stdin,(char *)0x0,2,0);
setvbuf(stdout,(char *)0x0,2,0);
setvbuf(stderr,(char *)0x0,2,0);
@d4em0n
d4em0n / mantapmas.c
Created April 15, 2019 14:12
exploiting tcache: tricking malloc to return arbitrary fake chunk
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
void setbff(void)
{
setvbuf(stdin,(char *)0x0,2,0);
setvbuf(stdout,(char *)0x0,2,0);
setvbuf(stderr,(char *)0x0,2,0);
@d4em0n
d4em0n / exploit.py
Created October 26, 2018 12:49
Bsides Delhi CTF data_bank exploit
from pwn import *
context.terminal = "tmux splitw -h -f".split()
#p = process("./data_bank")
p = remote("35.200.202.92", 1337)
DEBUG = 0
cmd = ""
libc = ELF('./libc.so.6')
if DEBUG:
gdb.attach(p, cmd, gdb_args=["--init-eval-command='source /ctf/tools/gef/gef.py'"])
@d4em0n
d4em0n / exploit.py
Created October 18, 2018 03:26
CJ2018 Final p11-zeus
from pwn import *
context.log_level = 'error'
context.terminal = 'tmux splitw -h'.split()
DEBUG = 0
cmd = """
"""
libc = ELF('./libc.so.6')
elf = ELF('./zeus')
p = process("./zeus")
@d4em0n
d4em0n / main.py
Last active October 6, 2018 03:13
CTFd auto submit
from bs4 import BeautifulSoup
import requests
import json
url = "https://ctf.asgama.web.id"
class CTFDAutoSubmit:
nonce_submit = 0
def __init__(self, url, user, pasw):
self.ctf = requests.Session()