Skip to content

Instantly share code, notes, and snippets.

View hellman's full-sized avatar
🍊

Aleksei Udovenko hellman

🍊
View GitHub Profile
@ShikChen
ShikChen / birthday.cpp
Created August 18, 2014 18:31
HITCON CTF 2014, WTF6
#include <cstdio>
#include <cstring>
#include <cassert>
#include <cstdint>
#include <algorithm>
#include <queue>
#include <openssl/sha.h>
#define LOG(fmt, ...) \
fprintf(stderr, "[%.2f] %s:%d - " fmt, 1.0 * clock() / CLOCKS_PER_SEC, \
@g05u
g05u / alewife_exploit.py
Last active August 29, 2015 14:16
Boston ctf party alewife writeup/exploit
#!/usr/bin/env python
import struct, sys, time
from nulllife import *
import ast
# @_g05u_
#boston ctf party 2015
# exploit alewife chall
# www.null-life.com
@KvanTTT
KvanTTT / RationalNumberCounting.cs
Created September 22, 2012 09:04
Rational numbers counting (with inverse)
public static long RationalNumber(long i, long j)
{
if (j == 1)
{
if (i == 0)
return 1;
else if (i == 1)
return 2;
}
[DISASM]
000000 //Instruction
aaaaaa //Directive
f3c5ff //Macro name
7e6082 //Register name
666666 //Other keywords
ffffff //Dummy data name
b9ebeb //Dummy code name
b9ebeb //Dummy unexplored name
bbecff //Hidden name
@thejh
thejh / bettersystem.c
Last active December 18, 2015 15:25
ULTIMATE VULN FIX
#define _GNU_SOURCE
#include <dlfcn.h>
#include <string.h>
int system(const char *cmd) {
static int (*realsystem)(const char *);
if (!realsystem) realsystem = dlsym(RTLD_NEXT, "system");
if (strchr(cmd, ';') || strchr(cmd, '`') || strstr(cmd, "&&") || strstr(cmd, "../")) {
return 1;
}
@zachriggle
zachriggle / README.md
Last active May 25, 2016 07:20
DEFCON CTF Qualifiers 2016 -- heapfun4u Exploit

DEFCON CTF Qualifiers 2016 -- heapfun4u Exploit Write-Up

The write-up is the exploit.

Example Output

[*] './heapfun4u'
    Arch:     amd64-64-little
    RELRO:    Partial RELRO
#include <cassert>
#include <NTL/mat_GF2.h>
#include <NTL/GF2.h>
using NTL::GF2;
using NTL::mat_GF2;
using NTL::conv;
int g(GF2 x1, GF2 z1, GF2 x2, GF2 z2) {
@hellman
hellman / generate.py
Created October 11, 2016 18:00
HITCON QUALS 2016 - Reverse (Reverse 500)
from binascii import crc32
def lcg_step():
global lcg
lcg = (0x5851F42D4C957F2D * lcg + 0x14057B7EF767814F) % 2**64
return lcg
def extract(val):
res = 32 + val - 95 * ((
((val - (0x58ED2308158ED231 * val >> 64)) >> 1) +
#!/usr/bin/env python2
import socket
import struct
import telnetlib
import sys, time
import pwn
HOST, PORT = "127.0.0.1", 1234
HOST, PORT = "reeses_fc849330ede1f497195bad5213deaebc.quals.shallweplayaga.me", 3456
@elliptic-shiho
elliptic-shiho / solve.py
Last active September 10, 2017 18:02
ASIS CTF Finals 2017: Interested Message
from scryptos import *
import hashlib
import gmpy
'''
References:
[1] Hitachi, Ltd. 2001. Specification of HIME(R) CryptoSystem - http://www.hitachi.com/rd/yrl/crypto/hime/HIME_R_specE.pdf
'''
SECRET = 'ASISCTF-17'
C0 = [ hashlib.sha1(SECRET[i:] + SECRET[:i]).digest()[:16] for i in xrange(10) ]