| Description='33C3 WPA2 802.1x WiFi' | |
| Interface=wlp4s0 | |
| Connection=wireless | |
| Security=wpa-configsection | |
| IP=dhcp | |
| Essid=33C3 | |
| WPAConfigSection=( | |
| 'ssid="33C3"' | |
| 'proto=RSN WPA' | |
| 'key_mgmt=WPA-EAP' |
wtf.sh was a challenge that included two flags, one for 150pts and one for 400pts.
In the first part we needed to call the function get_flag1 in order to receive the flag. The post parameter of post.wtf was vulnerable to a path traversal:
GET /profile.wtf?user=../posts HTTP/1.1
| for i in $(curl -s "https://api.github.com/orgs/openstack/repos?per_page=999" |jq -r '.[] .clone_url');do git clone $i;done |
| #include <stdio.h> | |
| #include <stdio.h> | |
| #include <string.h> | |
| #include <unistd.h> | |
| #include <pty.h> | |
| #include <termios.h> | |
| #include <fcntl.h> | |
| #include <sys/select.h> |
| #!/usr/bin/env python3 | |
| import socket | |
| import ssl | |
| import sys | |
| try: | |
| from pyasn1.codec.der import decoder | |
| from pyasn1_modules import rfc2459 | |
| except ImportError: | |
| print('Run: pip install pyasn1 pyasn1-modules') | |
| sys.exit(1) |
| # FreeBSD SCTP ICMPv6 error message vulnerability (FreeBSD-SA-16:01.sctp / CVE-2016-1879) PoC | |
| # https://www.freebsd.org/security/advisories/FreeBSD-SA-16:01.sctp.asc | |
| # https://github.com/freebsd/freebsd/commit/51f55053b6565d2fe9b61f63460dddc23284a103 | |
| import sys | |
| from scapy.all import * | |
| if len(sys.argv) is not 3: | |
| print('{} target_ip interface'.format(sys.argv[0])) | |
| exit(1) |
| function proxy () { | |
| UNSET="" | |
| PROXY="http://127.0.0.1:8080" | |
| PROXY_ENV=(http_proxy https_proxy ftp_proxy HTTP_PROXY HTTPS_PROXY FTP_PROXY) | |
| if [ $1 == on ]; then | |
| for i in $PROXY_ENV; do | |
| export $i=$PROXY | |
| done | |
| echo "proxy set" | |
| elif [ $1 == off ]; then |
| for jail in $(jails);do jexec $(jid $jail) portmaster -ay;done |
| for jail in $(jails);do print $jail;jexec $(jid $jail) portmaster -L --index-only|egrep '(ew|ort) version|total install';print;done |
| #!/bin/zsh | |
| # xrandr wrapper; switch between single/extended/cloned desktop; | |
| CONFIGURED_DEVICES=($(xrandr|egrep -o '[[:alnum:]]+ [dis]{0,3}connected [0-9]{3,}x[0-9]{3,}'|awk '{print $1}')) | |
| CONNECTED_DEVICES=($(xrandr|grep ' connected '|awk '{print $1}')) | |
| PRIMARY=${CONFIGURED_DEVICES[1]} | |
| RES_PRIMARY=$(xrandr|grep ${PRIMARY} -A1|tail -n1|egrep -o '[0-9]{3,}x[0-9]{3,}') | |
| if [ ${#CONFIGURED_DEVICES[*]} -eq 1 ]; then | |
| [ ${#CONNECTED_DEVICES[*]} -lt 2 ] && { print 'only one display conencted';exit; } | |
| CUR_MODE='single' |