Paweł Łukasik pawlos

## index.html
<!DOCTYPE html>
	<html>
	<head>
		<title>Pwn2Win | MessageKeeper</title>
	</head>
	<body>
		<script>
			let alphabet = "0123456789abcdef";

			const sleep = (ms) => {

## fix vmwp.bat
REM open cmd.exe as admin to run this

REM Creates a patched vmwp.exe replacing these bytes:
REM  0F B6 43 64 41 89 47 64 0F B6 43 65 41 89 47 68 0F B6 43 66 41 89 47 6C 0F B6 43 67 41 89 47 70
REM  41 C7 47 64 01 00 00 00 41 C7 47 68 01 00 00 00 41 C7 47 6C 01 00 00 00 41 C7 47 70 01 00 00 00
REM Enables PMU, LBR, PEBS, IPT

cd %TEMP%
copy %windir%\system32\vmwp.exe .

## VCXSrv.0
# It looks like -multiwindow mode triggers the static color visual in both the internal x2go xserver and the external vcxsrv
# But it also looks like -multiwindow mode is how x2go client allows resizing of the remote desktop
# ...so I'm looking for a way to allow resizing of remote desktop w/out triggering static color visual.
#
# ...output of vcxsrv.exe's usage note:

Usage...
Vcxsrv [:<display>] [option]

:display-number

## WADParser.py
#!/usr/bin/env python3

import struct
import re

class Wad(object):
    """Encapsulates the data found inside a WAD file"""

    def __init__(self, wadFile):
        """Each WAD files contains definitions for global attributes as well as map level attributes"""

## post_install.sh
#!/bin/bash

if [[ $EUID -ne 0 ]]; then
   	echo "This script must be run as root"
   	exit 1
fi

user=$(who | awk '{print $1}')
#Update and Upgrade
echo "Updating and Upgrading"

## spectre.c
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#ifdef _MSC_VER
#include <intrin.h> /* for rdtscp and clflush */
#pragma optimize("gt",on)
#else
#include <x86intrin.h> /* for rdtscp and clflush */
#endif

## feuerfuchs.html
<!-- 33c3ctf feuerfuchs exploit -->
<script>
var buffer;
var ua;
var vuln;
var ay = new Array(0x800);
var magic = 0x51535759;
var magic1 = 0x71737779;

function gc() {

## untrusted-lvl7-solution.js
/*************
* colors.js *
 *************
 *
 * You're almost at the exit. You just need to get past this
 * color lock.
 *
 * Changing your environment is no longer enough. You must
 * learn to change yourself. I've sent you a little something
 * that should help with that.

## untrusted-lvl6-solution.js

/****************
 * drones101.js *
 ****************
 *
 * Do you remember, my dear Professor, a certain introductory
 * computational rationality class you taught long ago? Assignment
 * #2, behavior functions of autonomous agents? I remember that one
 * fondly - but attack drones are so much easier to reason about
 * when they're not staring you in the face, I would imagine!

## untrusted-lvl2-solution.js
/********************
 * theLongWayOut.js *
 ********************
 *
 * Well, it looks like they're on to us. The path isn't as
 * clear as I thought it'd be. But no matter - four clever
 * characters should be enough to erase all their tricks.
 */

function startLevel(map) {
	<!DOCTYPE html>
	<html>
	<head>
	<title>Pwn2Win \| MessageKeeper</title>
	</head>
	<body>
	<script>
	let alphabet = "0123456789abcdef";

	const sleep = (ms) => {
	REM open cmd.exe as admin to run this

	REM Creates a patched vmwp.exe replacing these bytes:
	REM 0F B6 43 64 41 89 47 64 0F B6 43 65 41 89 47 68 0F B6 43 66 41 89 47 6C 0F B6 43 67 41 89 47 70
	REM 41 C7 47 64 01 00 00 00 41 C7 47 68 01 00 00 00 41 C7 47 6C 01 00 00 00 41 C7 47 70 01 00 00 00
	REM Enables PMU, LBR, PEBS, IPT

	cd %TEMP%
	copy %windir%\system32\vmwp.exe .
	# It looks like -multiwindow mode triggers the static color visual in both the internal x2go xserver and the external vcxsrv
	# But it also looks like -multiwindow mode is how x2go client allows resizing of the remote desktop
	# ...so I'm looking for a way to allow resizing of remote desktop w/out triggering static color visual.
	#
	# ...output of vcxsrv.exe's usage note:

	Usage...
	Vcxsrv [:<display>] [option]

	:display-number
	#!/usr/bin/env python3

	import struct
	import re

	class Wad(object):
	"""Encapsulates the data found inside a WAD file"""

	def __init__(self, wadFile):
	"""Each WAD files contains definitions for global attributes as well as map level attributes"""
	#!/bin/bash

	if [[ $EUID -ne 0 ]]; then
	echo "This script must be run as root"
	exit 1
	fi

	user=$(who \| awk '{print $1}')
	#Update and Upgrade
	echo "Updating and Upgrading"
	#include <stdio.h>
	#include <stdlib.h>
	#include <stdint.h>
	#ifdef _MSC_VER
	#include <intrin.h> /* for rdtscp and clflush */
	#pragma optimize("gt",on)
	#else
	#include <x86intrin.h> /* for rdtscp and clflush */
	#endif
	<!-- 33c3ctf feuerfuchs exploit -->
	<script>
	var buffer;
	var ua;
	var vuln;
	var ay = new Array(0x800);
	var magic = 0x51535759;
	var magic1 = 0x71737779;

	function gc() {
	/*************
	* colors.js *
	*************
	*
	* You're almost at the exit. You just need to get past this
	* color lock.
	*
	* Changing your environment is no longer enough. You must
	* learn to change yourself. I've sent you a little something
	* that should help with that.

	/****************
	* drones101.js *
	****************
	*
	* Do you remember, my dear Professor, a certain introductory
	* computational rationality class you taught long ago? Assignment
	* #2, behavior functions of autonomous agents? I remember that one
	* fondly - but attack drones are so much easier to reason about
	* when they're not staring you in the face, I would imagine!
	/********************
	* theLongWayOut.js *
	********************
	*
	* Well, it looks like they're on to us. The path isn't as
	* clear as I thought it'd be. But no matter - four clever
	* characters should be enough to erase all their tricks.
	*/

	function startLevel(map) {