Skip to content

Instantly share code, notes, and snippets.

View kos0ng's full-sized avatar
🎯
Focusing

Ryuk kos0ng

🎯
Focusing
View GitHub Profile
@kos0ng
kos0ng / solver_toomuch.py
Created February 22, 2021 03:19
darkCON CTF 2021 - Too Much [ RE ]
from z3 import *
a = [BitVec("x{}".format(i), 8) for i in range(200)]
arr=[70, 22, 39, 182, 52, 244, 228, 183, 67, 39, 51, 245, 151, 3, 87, 245, 39, 51, 67, 198, 198, 151, 245, 71, 134, 19, 230, 182, 19, 230, 147, 245, 71, 134, 67, 71, 245, 151, 3, 87, 245, 54, 67, 230, 245, 71, 39, 151, 245, 71, 134, 19, 83, 245, 214, 67, 230, 87, 67, 198, 198, 151, 243, 243, 243, 245, 244, 182, 245, 148, 245, 71, 134, 19, 230, 182, 245, 151, 3, 87, 245, 38, 51, 71, 71, 51, 39, 245, 87, 55, 51, 245, 55, 3, 214, 51, 245, 22, 87, 71, 3, 214, 67, 71, 51, 70, 245, 71, 3, 3, 198, 55, 245, 198, 19, 182, 51, 245, 67, 230, 147, 39, 245, 3, 39, 245, 165, 51, 245, 71, 3, 245, 214, 67, 182, 51, 245, 151, 3, 87, 39, 245, 198, 19, 102, 51, 245, 214, 87, 54, 134, 245, 86, 67, 55, 19, 51, 39, 226, 52, 3, 230, 118, 39, 67, 71, 55, 245, 102, 3, 39, 245, 55, 3, 198, 103, 19, 150, 230, 147, 245, 71, 134, 51, 245, 86, 67, 55, 151, 245, 54, 134, 67, 198, 198, 51, 230, 118, 51, 215]
s=Solver()
for i in range(200):
eval("s.add((16 * a["+str(i)+
@kos0ng
kos0ng / helper_toomuch.py
Created February 22, 2021 03:19
darkCON CTF 2021 - Too Much ( Helper ) [ RE ]
#!/usr/bin/python3
static_val=[]
class SolverEquation(gdb.Command):
def __init__ (self):
super (SolverEquation, self).__init__ ("solve-equation",gdb.COMMAND_OBSCURE)
def invoke (self, arg, from_tty):
address_arr =['0x0000000000001189','0x00000000000011b4','0x00000000000011df','0x000000000000120a','0x0000000000001237','0x0000000000001262','0x000000000000128f','0x00000000000012bc','0x00000000000012e9','0x0000000000001314','0x000000000000133f','0x000000000000136a','0x0000000000001397','0x00000000000013c4','0x00000000000013ef','0x000000000000141a','0x0000000000001447','0x0000000000001472','0x000000000000149d','0x00000000000014c8','0x00000000000014f5','0x0000000000001522','0x000000000000154f','0x000000000000157c','0x00000000000015a7','0x00000000000015d4','0x00000000000015ff','0x000000000000162c','0x0000000000001659','0x0000000000001684','0x00000000000016b1','0x00000000000016de','0x000000000000170b','0x0000000000001736','0x0000000000001763','0x000000000000178e','0x00000000000017b9','0x0000000000
@kos0ng
kos0ng / solver_read.py
Created February 22, 2021 02:39
darkCON CTF 2021 - Read [ RE ]
def lababa():
alalalalalalal = [
73, 13, 19, 88, 88, 2, 77, 26, 95, 85, 11, 23, 114, 2, 93, 54, 71, 67, 90, 8, 77, 26, 0, 3, 93, 68]
result = ''
for belu in range(len(alalalalalalal)):
b2a = ''
a2b = [122, 86, 75, 75, 92, 90, 77, 24, 24, 24, 25, 106, 76, 91, 84, 80, 77, 25, 77, 81, 92, 25, 92, 87, 77, 80, 75, 92, 25, 74, 77, 75, 80, 87, 94, 25, 88, 74, 25, 95, 85, 88, 94]
for bbb in a2b:
b2a += chr(bbb ^ 57)
else:
@kos0ng
kos0ng / solver_crypt.py
Created November 15, 2020 01:51
ASCIS 2020 - crypt
N_ROUNDS = 10
xtime = lambda a: (((a << 1) ^ 0x1B) & 0xFF) if (a & 0x80) else (a << 1)
s_box = (
0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
@kos0ng
kos0ng / solver_l7vm.py
Created November 14, 2020 16:58
Layer 7 CTF 2020 - L7VM
import string
list_char=string.printable[:-6]+'\x00\n'
list_char=map(ord,list_char)
tmp="A"*19+'\n'+'\x00'*1
key=[0x14,0x56,0x23,0x76,0x89,0x72,0x45,0x78,0x94,0x20,0x5a,0x7d,0x99,0x6,0x64,0x79,0x2a,0x1f,0x71,0x65,0x50]
target=[0x51,0x11,0x50,0xb2,0x90,0x32,0x9d,0x78,0xf4,0x60,0xda,0xa1,0x0f,0xf6,0x9b,0x1c,0xbd,0x9d,0x8d,0xf9,0x6d]
cnt=0
flag=['*' for i in range(21)]
while cnt!=7:
@kos0ng
kos0ng / solver_signal.py
Created October 23, 2020 14:18
[ RE - Signal ] Cyber Security Gemastik 13
import string
flag=[]
target="a270f530f13ce2d0e5ceacb78fc7b4d109e911ccd92bdf8708a471bdd8855bf238cd94d3fa7982f9013269a6a501ec3dfa88".decode('hex')
byte_4041A0=[0x69,0xb3,0x3b,0xf8,0x9f,0x23,0x91,0x0e,0x2b,0x14,0x8c,0xd4,0xe3,0xfb,0xb9,0x47,0x99,0xf3,0x27,0xec,0xbc,0x11,0x5a,0x94,0x8e,0xe6,0x04,0xfe,0x37,0xbb,0x6b,0x79,0x19,0x06,0x77,0x5e,0xe0,0x6e,0x10,0x96,0x53,0x58,0xa6,0x09,0x67,0xf5,0x51,0x32,0x6a,0x83,0xd8,0x3f,0x0c,0x5b,0x9d,0x89,0xa5,0xaf,0x62,0x00,0x03,0xfd,0x9c,0x05,0x88,0x2a,0x40,0xf7,0xde,0x52,0xee,0x29,0xed,0xf6,0xe2,0xcb,0xd0,0xc7,0x7e,0x01,0x30,0x1d,0x42,0x18,0xff,0x1b,0x7f,0xc3,0x57,0x4f,0x6d,0x61,0x76,0x90,0xad,0x41,0x4b,0x5f,0xd5,0xc6,0x72,0x3d,0x1a,0x92,0x43,0x20,0xa8,0x5c,0x0b,0xc1,0xbe,0xb2,0x2e,0x66,0xbd,0x0f,0x50,0xf2,0x33,0x60,0xb4,0xda,0x86,0x75,0x81,0x9b,0x15,0x38,0xce,0x2f,0x82,0x2d,0x8a,0x49,0xb8,0x68,0x70,0x55,0xdd,0x7c,0x02,0xca,0x07,0x93,0x7d,0x3c,0x45,0xe7,0xe5,0xc9,0xac,0x8b,0xd7,0x28,0x31,0x4c,0xaa,0xc4,0x46,0x0a,0x17,0xeb,0xdf,0x6f,0x95,0xf1,0x4d,0x87,0x98,0x22,0xdc,0xc0,0xb5
@kos0ng
kos0ng / solver_bitlevel.py
Created October 11, 2020 00:07
Bsides Delhi CTF 2020 - Bit level h4xx04r
z="AVDI_Et5f6mrsT3tvkex"
a=[]
fix=[]
for i in z:
a.append(ord(i)&0xf)
fix.append(ord(i)>>4)
for i in range(len(a)):
tmp=a[i:]+a[:i]
res=""
for j in range(len(tmp)):
@kos0ng
kos0ng / solver_log.py
Created October 10, 2020 23:44
Bsides Delhi CTF 2020 - A Log of Work
import gmpy2
import codecs
import base64
list_char="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/="
target=8089390364467735077698396472118844991784106353624232752188925117000642749078392477000726461474971635917016810390936570526153112519081470670206265855935361540194194923977832689103430508815864607887175397925922606678257211908276404240676101731946520582573307113692772061443045502502491987593439178171359818088442419721372220822555
val=2**21
res=""
while target!=0:
for i in list_char:
@kos0ng
kos0ng / basicchall.cs
Created October 10, 2020 23:29
Bsides Delhi CTF 2020 - A Log of Work
using System;
using System.Linq;
using System.Numerics;
using System.Text;
namespace basicchall
{
// Token: 0x02000002 RID: 2
internal class Program
{
@kos0ng
kos0ng / solver_decryptor.py
Created October 10, 2020 23:17
Bsides Delhi CTF 2020 - Advanced Encryption
a=[0 for i in range(0x18)]
a[0]=0x42
a[0x1]=0x53
a[0x2]=0x44
a[0x3]=0x43
a[0x4]=0x54
a[0x5]=0x46
a[0x6]=0x7b
a[0x7]=0x73
a[0x8]=0x75