Skip to content

Instantly share code, notes, and snippets.

View ywkw1717's full-sized avatar
🌴
On vacation

yyy ywkw1717

🌴
On vacation
View GitHub Profile
#!/usr/bin/env python
from pwn import *
context(os="linux", arch="i386")
def main():
conn = process('./write432')
system = 0x08048430
#!/usr/bin/env python
from pwn import *
context(os="linux", arch="i386")
def main():
conn = process('./callme32')
argument = "\x01\x00\x00\x00" + \
@ywkw1717
ywkw1717 / badchars32-exploit.py
Last active December 6, 2017 18:23
badchars32
#!/usr/bin/env python
# coding: utf-8
from pwn import *
context(os="linux", arch="i386")
#
# badchars are: b i c / <space> f n s
#
#!/usr/bin/env python
from pwn import *
context(os="linux", arch="i386")
# context.log_level = 'debug'
def main():
conn = process("./fluff32")
system = 0x8048430
#!/usr/bin/env python
from pwn import *
context(os="linux", arch="i386")
def main():
conn = process('./pivot32')
elf = ELF('./pivot32')
using System;
using System.Text;
using System.Security.Cryptography;
public static class AESCryption
{
public static void Main()
{
AesCryptoServiceProvider aesCryptoServiceProvider = new AesCryptoServiceProvider();
aesCryptoServiceProvider.BlockSize = 128;
#!/usr/bin/env python
import angr
import claripy
def main():
p = angr.Project("./crackme")
key_length = 32
#!/usr/bin/env python
from z3 import *
def main():
solver = Solver()
s = [BitVec('s_%d' % i, 8) for i in range(16)]
for i in range(len(s)):
@ywkw1717
ywkw1717 / classic_pwn
Created October 28, 2018 08:01
SECCON 2018 Online CTF Classic Pwn
#!/usr/bin/env python
from pwn import *
def main():
# conn = process("./classic_aa9e979fd5c597526ef30c003bffee474b314e22")
conn = remote("classic.pwn.seccon.jp", 17354)
elf = ELF("./classic_aa9e979fd5c597526ef30c003bffee474b314e22")
# libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
libc = ELF("./libc-2.23.so_56d992a0342a67a887b8dcaae381d2cc51205253")
@ywkw1717
ywkw1717 / Runme
Created October 28, 2018 08:12
SECCON CTF 2018 Online Runme
#!/usr/bin/env python
def main():
a = [0x43,0x3a,0x5c,0x54,0x65,0x6d,0x70,0x5c,0x53,0x45,0x43,0x43,0x4f,0x4e,0x32,0x30,0x31,0x38,0x4f,0x6e,0x6c,0x69,0x6e,0x65,0x2e,0x65,0x78,0x65,0x22,0x20,0x53,0x45,0x43,0x43,0x4f,0x4e,0x7b,0x52,0x75,0x6e,0x6e,0x31,0x6e,0x36,0x5f,0x50,0x34,0x37,0x68,0x7d]
flag = ""
for i in a:
flag += chr(i)