stypr

#!/usr/bin/python -u
#-*-coding: utf-8-*-
def list_directory(expression):
	try:
		_c = __import__("glob").glob(expression + "/*")
		for i in xrange(len(_c)):
			if "uploads" not in _c[i] and "userimage" not in _c[i] and "files" not in _c[i]:
				_c.extend(list_directory(_c[i]))
		return _c
	except:

stypr

import os
import urllib2
import urllib
import random
import sys
import time
import hashlib

def rand(sz=4):
    return str(random.randint(10**sz, 100**sz))

stypr

#!/usr/bin/python
'''
how to use

1) python pwn.py 1
2) python pwn.py 5
3) look at the "pwn.py 1" instance

'''

stypr

$ screen -X
$ cat /dev/zero > ~/zero.fill; sync; sleep 1; sync; rm -f ~/zero.fill;
(ctrl+a)

stypr

cd /tmp
apt-get build-dep nginx
apt-get source nginx
cd /tmp/nginx-1.4.2 && sudo dpkg-buildpackage -uc -b
service nginx stop
apt-get remove nginx
dpkg-deb -I /tmp/nginx_1.4.2-1~squeeze_armhf.deb
dpkg -i /tmp/nginx_1.4.2-1~squeeze_armhf.deb

# in case of dpkg error use the following command:

stypr

<?php
    error_reporting(0);
    if(__CHECK_INTERNAL__ == False) die();
    // SQL Query Selector for PHP5/PHP7, Who cares if it's vulnerable? \o/
    class Query{
        private $conn, $mysqli;
        function check(){
            return ($this->conn) ? True : False;
        }
        function connect($host, $username, $password, $db=""){

stypr

#!/usr/bin/python
#-*- coding:utf-8 -*-
# Developer: Harold Kim (ho.kim@linecorp.com)

import os
import sys
import time
import urllib
import urllib2

stypr

Note that the installiation of nginx+php5 on MACOSX IS NOT RECOMMENDED unless you know what you're trying to do.

• both services are going to be running as root
• there is no configuration file set for php-cgi53

Tested on OSX 10.10.2 (Yosemite)

Refer to https://gist.github.com/renjunkui/1267057 for lower versions of MACOSX.

# install MacPorts at http://www.macports.org/install.php

stypr

# derived from http://stackoverflow.com/questions/40046916/how-to-grant-permission-to-user-on-certificate-private-key-using-powershell
param (
    [string]$certThumbprint = "NothingToDoHere"
)
$serviceAccount = 'NETWORK SERVICE'
$permissionType = 'Read'
    try
    {
        Write-Host "Thumbprint: $certThumbprint"
        #Clear Existing Variables

stypr

Quick Summary

First-blooded this challenge. The server is down, I cannot explain briefly

1. Comment in the website shows get_perm.php

2. Another comment in the get_perm.php shows ?remote_debug=1.

3. Using a php trick, you get a write post privilege.