Boris Larin oct0xor

## nn8ed - pokedex_nn2k18.py
from pwn import *

def menu():
	r.recvuntil("option> ")

def create(pos, name, height, weight, power):
	menu()
	r.sendline("1")
	r.recvuntil("Enter the new pokemon ID: ")
	r.sendline(str(pos))

## Readme.md

      
              2 files
            
          
              2 forks
            
          
              0 comments
            
          
              8 stars
            
          
                sroettger
                / Readme.md
            
            
              Last active
              January 2, 2019 10:02
            
              
                Set Theory (part 1) from Hack Dat Kiwi 2017 CTF.
              
          
    This challenge gave parts of the points as soon as you find a crash in the binary, which was a forking network service.
With a short LD_PRELOAD library, you can bypass all the networking code and fuzz the handler function directly with afl using the qemu mode.
The basic steps:

find a libc function that gets called after all initialization is done and overwrite it. Alternatively: define a constructor and do the initialization yourself
for position-independent executables, find the load address with dl_iterate_phdr
call whatever function you want to fuzz in the binary
run afl with -Q and AFL_PRELOAD


## SGX_pwn.html
<!DOCTYPE html>
<html>
<head>
	<title>SGX PWN</title>
</head>
<body>
	<h1>PWN!!!</h1>
	<script type="text/javascript">
		function print(text)
		{

## eternalblue_merge_shellcode.py
# This file has no update anymore. Please see https://github.com/worawit/MS17-010
import sys
from struct import pack

if len(sys.argv) < 4:
	print('Usage: {} sc_x86 sc_x64 sc_out'.format(sys.argv[0]))
	sys.exit()

sc_x86 = open(sys.argv[1], 'rb').read()
sc_x64 = open(sys.argv[2], 'rb').read()

## gist:59c689a14f1fc2302d858ae0aa3f6b86
	DWORD Error, bytesIO;
	NTSTATUS Status;
	HANDLE hProcessToken = NULL, hNewToken = NULL, hTest;
	BOOL bCond = FALSE;
	SHELLEXECUTEINFO shinfo;
	SID_IDENTIFIER_AUTHORITY MLAuthority = SECURITY_MANDATORY_LABEL_AUTHORITY;
	TOKEN_MANDATORY_LABEL tml, *ptml;
	PSID pIntegritySid = NULL;
	STARTUPINFO si;
	PROCESS_INFORMATION pi;

## EventVwrBypass.cs
using System;
using System.Linq;
using System.Reflection;
using System.Configuration.Install;
using System.Runtime.InteropServices;

using Microsoft.Win32;
/*
InstallUtil.exe C# version of Event Viewer UAC bypass

## BadTalkTitles
😒🙅🙄

$thing for fun and profit
all your $thing are belong to $shutup
honey I $verbed the $thing
$thing demystified
$thing: a deep dive
$verb all the things
make $thing great again
$x and $y and $z, oh my!

## rsa_timing_attack_d_Montgomery.py
#-*- coding:utf-8 -*-
'''
DEF CON 2017 Quals - Godzilla (Reverse)
Timing attack on RSA decryption.
Based on http://www.cs.jhu.edu/~fabian/courses/CS600.624/Timing-full.pdf

Another solutions:
https://gist.github.com/nneonneo/367240ae2d8e705bb9173a49a7c8b0cd by b2xiao
https://gist.github.com/Riatre/caac24840b176cf843b3f66ad9a5eeaf by riatre

## exploit.js
////////////////////////////////////////////////////////////////////////////
//
// The vulnerability was that the following line of code could change the type of the
// underlying Array from JavascriptNativeIntArray to JavascriptArray:
//
//  spreadableCheckedAndTrue = JavascriptOperators::IsConcatSpreadable(aItem) != FALSE;
//
// As can be seen in the provided .diff, the check for whether the type of the pDestArray has changed
// was removed. If the aItem then is not a JavascriptArray, the following code path is taken:
//     else

## jochemsz_may.sage
from sage.all import *
import itertools

# display matrix picture with 0 and X
# references: https://github.com/mimoo/RSA-and-LLL-attacks/blob/master/boneh_durfee.sage
def matrix_overview(BB, bound):
  for ii in range(BB.dimensions()[0]):
    a = ('%02d ' % ii)
    for jj in range(BB.dimensions()[1]):
      a += ' ' if BB[ii,jj] == 0 else 'X'
	from pwn import *

	def menu():
	r.recvuntil("option> ")

	def create(pos, name, height, weight, power):
	menu()
	r.sendline("1")
	r.recvuntil("Enter the new pokemon ID: ")
	r.sendline(str(pos))
	<!DOCTYPE html>
	<html>
	<head>
	<title>SGX PWN</title>
	</head>
	<body>
	<h1>PWN!!!</h1>
	<script type="text/javascript">
	function print(text)
	{
	# This file has no update anymore. Please see https://github.com/worawit/MS17-010
	import sys
	from struct import pack

	if len(sys.argv) < 4:
	print('Usage: {} sc_x86 sc_x64 sc_out'.format(sys.argv[0]))
	sys.exit()

	sc_x86 = open(sys.argv[1], 'rb').read()
	sc_x64 = open(sys.argv[2], 'rb').read()
	DWORD Error, bytesIO;
	NTSTATUS Status;
	HANDLE hProcessToken = NULL, hNewToken = NULL, hTest;
	BOOL bCond = FALSE;
	SHELLEXECUTEINFO shinfo;
	SID_IDENTIFIER_AUTHORITY MLAuthority = SECURITY_MANDATORY_LABEL_AUTHORITY;
	TOKEN_MANDATORY_LABEL tml, *ptml;
	PSID pIntegritySid = NULL;
	STARTUPINFO si;
	PROCESS_INFORMATION pi;
	using System;
	using System.Linq;
	using System.Reflection;
	using System.Configuration.Install;
	using System.Runtime.InteropServices;

	using Microsoft.Win32;
	/*
	InstallUtil.exe C# version of Event Viewer UAC bypass
	😒🙅🙄

	$thing for fun and profit
	all your $thing are belong to $shutup
	honey I $verbed the $thing
	$thing demystified
	$thing: a deep dive
	$verb all the things
	make $thing great again
	$x and $y and $z, oh my!
	#-- coding:utf-8 --
	'''
	DEF CON 2017 Quals - Godzilla (Reverse)
	Timing attack on RSA decryption.
	Based on http://www.cs.jhu.edu/~fabian/courses/CS600.624/Timing-full.pdf

	Another solutions:
	https://gist.github.com/nneonneo/367240ae2d8e705bb9173a49a7c8b0cd by b2xiao
	https://gist.github.com/Riatre/caac24840b176cf843b3f66ad9a5eeaf by riatre
	////////////////////////////////////////////////////////////////////////////
	//
	// The vulnerability was that the following line of code could change the type of the
	// underlying Array from JavascriptNativeIntArray to JavascriptArray:
	//
	// spreadableCheckedAndTrue = JavascriptOperators::IsConcatSpreadable(aItem) != FALSE;
	//
	// As can be seen in the provided .diff, the check for whether the type of the pDestArray has changed
	// was removed. If the aItem then is not a JavascriptArray, the following code path is taken:
	// else
	from sage.all import *
	import itertools

	# display matrix picture with 0 and X
	# references: https://github.com/mimoo/RSA-and-LLL-attacks/blob/master/boneh_durfee.sage
	def matrix_overview(BB, bound):
	for ii in range(BB.dimensions()[0]):
	a = ('%02d ' % ii)
	for jj in range(BB.dimensions()[1]):
	a += ' ' if BB[ii,jj] == 0 else 'X'