James Sanders jsanders

## shellcode.asm
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; A nice, small 32-bit x86 execve shellcode template. ;
; execve("//bin/sh", [ "//bin/sh", NULL ], [ NULL ]). ;
; Shellcode itself is 25 bytes.                       ;
; Provide definitions of PayloadSize and JumpAddress  ;
; to generate a self-contained buffer of the desired  ;
; size and with the desired address to jump to.       ;
; Build with "nasm -f bin -o shellcode shellcode.asm" ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

## level06_exploit.py
from os import pipe, write, close
from subprocess import Popen, PIPE
import select
import string
import sys

PIPE_MAX = 1<<16 # 64k
WELCOME_LEN = len("Welcome to the password checker!\n")

def args(guess):

## stripe-ctf-1.0.md

      
              1 file
            
          
              1 fork
            
          
              0 comments
            
          
              1 star
            
          
                jsanders
                / stripe-ctf-1.0.md
            
            
              Last active
              May 26, 2017 16:22
            
              
                Work-through of the Stripe CTF 1.0 focused more on system-level than web-level security.
              
          
    Stripe CTF 1.0

Level 1

Ok, start by ssh-ing to level01@ec2-23-22-123-94.compute-1.amazonaws.com with
password w5kjAsSKEjCT. Our goal is to read the file .password from the level02
user's home directory: /home/level02. Let's look for low-hanging fruit - maybe we
can just read the file directly:


## LICENSE
MIT License

Copyright (c) 2017 Martin Buberl

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

## blob.rb
# Public: Represent and manipulate arbitrary data.
class Blob
  # Public: Create Blob from an array of bytes.
  #
  # bytes - The Array of numbers in the range [0, 255]
  #
  # Examples
  #   Blob.new([ 97, 98, 99, 100 ]).to_str
  #   # => "abcd"
  #   Blob.from_str([ 97, 98, 99, 100 ]).to_hex

## aes_ctr_cbc.rb
require File.expand_path('../../utilities', __FILE__)
require 'openssl'

# Set to true to see debug output
DEBUG = false
def debug_puts(s=nil); puts(s) if DEBUG; end
def debug_print(s=nil); print(s) if DEBUG; end

# Encrypt data using given `mode`, `key_b`, `iv_b` and `data_b`, all as byte arrays
# Only uses padding in CBC mode

## gist:5551350
$ GOPATH=$HOME/go go get github.com/burke/zeus/go/cmd/zeus
../../../go/src/github.com/burke/zeus/go/cmd/zeus/zeus.go:14:2: no Go source files in /Users/james/go/src/github.com/burke/zeus/go/zeusversion

## subsets.clj
(use 'clojure.contrib.combinatorics)

(def small-numbers [ 1 2 3 4 6 ])
(def large-numbers [ 3 4 9 14 15 19 28 37 47 50 54 56 59 61 70 73 78 81 92 95 97 99 ])

(defn largest-sum-of-rest?
  [ col ]
  (let [ [ largest & others ] (reverse (sort col)) ]
    (= largest (reduce + others))))

## Gemfile
source 'https://rubygems.org'

gem 'sidekiq'

## Gemfile
source 'https://rubygems.org'

gem 'json'
gem 'resque', '1.19.0'
	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
	; A nice, small 32-bit x86 execve shellcode template. ;
	; execve("//bin/sh", [ "//bin/sh", NULL ], [ NULL ]). ;
	; Shellcode itself is 25 bytes. ;
	; Provide definitions of PayloadSize and JumpAddress ;
	; to generate a self-contained buffer of the desired ;
	; size and with the desired address to jump to. ;
	; Build with "nasm -f bin -o shellcode shellcode.asm" ;
	;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
	from os import pipe, write, close
	from subprocess import Popen, PIPE
	import select
	import string
	import sys

	PIPE_MAX = 1<<16 # 64k
	WELCOME_LEN = len("Welcome to the password checker!\n")

	def args(guess):
	MIT License

	Copyright (c) 2017 Martin Buberl

	Permission is hereby granted, free of charge, to any person obtaining a copy
	of this software and associated documentation files (the "Software"), to deal
	in the Software without restriction, including without limitation the rights
	to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	copies of the Software, and to permit persons to whom the Software is
	furnished to do so, subject to the following conditions:
	# Public: Represent and manipulate arbitrary data.
	class Blob
	# Public: Create Blob from an array of bytes.
	#
	# bytes - The Array of numbers in the range [0, 255]
	#
	# Examples
	# Blob.new([ 97, 98, 99, 100 ]).to_str
	# # => "abcd"
	# Blob.from_str([ 97, 98, 99, 100 ]).to_hex
	require File.expand_path('../../utilities', __FILE__)
	require 'openssl'

	# Set to true to see debug output
	DEBUG = false
	def debug_puts(s=nil); puts(s) if DEBUG; end
	def debug_print(s=nil); print(s) if DEBUG; end

	# Encrypt data using given `mode`, `key_b`, `iv_b` and `data_b`, all as byte arrays
	# Only uses padding in CBC mode
	$ GOPATH=$HOME/go go get github.com/burke/zeus/go/cmd/zeus
	../../../go/src/github.com/burke/zeus/go/cmd/zeus/zeus.go:14:2: no Go source files in /Users/james/go/src/github.com/burke/zeus/go/zeusversion
	(use 'clojure.contrib.combinatorics)

	(def small-numbers [ 1 2 3 4 6 ])
	(def large-numbers [ 3 4 9 14 15 19 28 37 47 50 54 56 59 61 70 73 78 81 92 95 97 99 ])

	(defn largest-sum-of-rest?
	[ col ]
	(let [ [ largest & others ] (reverse (sort col)) ]
	(= largest (reduce + others))))
	source 'https://rubygems.org'

	gem 'json'
	gem 'resque', '1.19.0'