Skip to content

Instantly share code, notes, and snippets.

View mkow's full-sized avatar

Michał Kowalczyk mkow

View GitHub Profile
[P5564] set tcb to 0xffe9658
[P5564] host: Linux-SGX
[P5564] initial random value: 6b40e37d9d091092
[P5564] allocate internal heap at 0xb9a4000 - 0xbaa4000
[P5564] User space range given from PAL: 0x10000-0xbaa4000
[P5564] setting initial heap to 0x10000-0xbaa4000
[P5564] bkeep_mmap: 0xb9a4000-0xb9ae000
[P5564] bkeep_mmap: 0xbaa0000-0xbaa4000
[P5564] bkeep_mmap: 0xba9b000-0xbaa0000
[P5564] bkeep_mmap: 0xba94000-0xba9b000
@mkow
mkow / nope.py
Created January 1, 2018 20:29
nope challenge solution from 34C3 CTF
from struct import pack, unpack
from sys import stdout, stderr, stdin
import socket
host = '35.198.126.67'
port = 4444
s = socket.create_connection((host, port))
def p64(x):
return pack('<Q', x)
@mkow
mkow / baby_vm2_assembler.py
Created April 4, 2018 20:27
Baby VM 2 - 0CTF 2018 - solver
from struct import pack
def make_insn(op, mode):
assert 0 <= op < 0x40
assert 0 <= mode < 4
return chr(op | (mode << 6))
DATA=0
ADDR=2
BOOL=3
@mkow
mkow / baby_vm_assembler.py
Created April 4, 2018 20:25
Baby VM - 0CTF 2018 - solver
from struct import pack
def make_insn(op, mode):
assert 0 <= op < 0x40
assert 0 <= mode < 4
return chr(op | (mode << 6))
DATA = 0
ADDR = 2
BOOL = 3
@mkow
mkow / rar4_vm_asm.py
Created September 24, 2019 15:15
Assembler for RAR v4 VM (anti-antivirus challenge, Real World CTF 2019 Quals)
import sys
VMCF_OP0 = 0
VMCF_OP1 = 1
VMCF_OP2 = 2
VMCF_OPMASK = 3
VMCF_BYTEMODE = 4
VMCF_JUMP = 8
VMCF_PROC = 16
VMCF_USEFLAGS = 32
@mkow
mkow / lost_modulus_solver.py
Created October 19, 2019 15:47
Lost Modulus Again (HITCON Quals 2019, solver by adami)
e = 1048583
d = 20899585599499852848600179189763086698516108548228367107221738096450499101070075492197700491683249172909869748620431162381087017866603003080844372390109407618883775889949113518883655204495367156356586733638609604914325927159037673858380872827051492954190012228501796895529660404878822550757780926433386946425164501187561418082866346427628551763297010068329425460680225523270632454412376673863754258135691783420342075219153761633410012733450586771838248239221434791288928709490210661095249658730871114233033907339401132548352479119599592161475582267434069666373923164546185334225821332964035123667137917080001159691927
x = 22886390627173202444468626406642274959028635116543626995297684671305848436910064602418012808595951325519844918478912090039470530649857775854959462500919029371215000179065185673136642143061689849338228110909931445119687113803523924040922470616407096745128917352037282612768345609735657018628096338779732460743
y = 13835601215715092703311781486294192443763777504037974697077837692193374
@mkow
mkow / not_so_hard_rsa_solver.py
Created October 19, 2019 15:54
not so hard RSA (HITCON Quals 2019, solver by adami)
import random
a=[
(61608417975397048843788515638593839325111098880518441270527767841153782846066445099077365303960932518098100778959123136871039627996767023258612684873083420234538156646585282154245553305607644427220207313162116929585370583379703086997585339296145409828300576290109728682441066135201997295424597733433471586151L, 60032368056605168202792776655067640210910930719068898740685488293392455428589220656480049668823171895161714617099267690524276842795335016835073541061601545456195765907623303970146386500563913899580929779870429659650425339185233299118860275385880359287380867251468679962048998842668813298548390941601249105855L, '1e4433543ad3eab1d5a5490e33ee98c34785945c7b69dd0fd0a371c28e5ff45f6627ad0559d9837fd6439367543ff5670f4df4fd36cbee75950db62e51811f98e3f34db66b07196a5dfbd9867952d8e6d67c43becf086087181e5f78582e98945e5c8c08d754b998ef01e836729f9620cdcd2cc8aae9cb4bf3d8e4beec3ca8fd'),
(520845950547682175226769793427553933063050991694149479605080490571193295371620790711007735401727806998429748389734535178
@mkow
mkow / compilerbot_solver.py
Created December 31, 2019 01:42
Solver for compilerbot challenge from hxp 36C3 CTF (misc/medium/256 pts/30 solves)
import socket
from base64 import b64encode, b64decode
from string import printable
def test(code):
host = '88.198.154.157'
port = 8011
s = socket.create_connection((host, port))
s.sendall(b64encode(code) + '\n')
@mkow
mkow / ridl.py
Last active March 24, 2020 19:26
RIDL (Google Capture The Flag 2019 Finals solution)
#!/usr/bin/env python2
# Challenge: https://gctf-2019.appspot.com/#challenges/sandbox-sandbox-ridl
from pwn import *
import os
def split_by(data, cnt):
return [data[i : i+cnt] for i in xrange(0, len(data), cnt)]
@mkow
mkow / verifier2_solver.py
Created April 4, 2020 16:26
Solver for Verifier 2 from Midnight Sun CTF 2020 Quals
#!/usr/bin/env python3
from pwn import *
from hashlib import sha1, sha256
from random import randint
def h(msg):
# hash = sha256()
hash = sha1()
hash.update(msg.encode('ascii'))
hash = hash.digest()