Skip to content

Instantly share code, notes, and snippets.

View ywkw1717's full-sized avatar
🌴
On vacation

yyy ywkw1717

🌴
On vacation
View GitHub Profile
@ywkw1717
ywkw1717 / key_maker.py
Created April 22, 2019 12:13
ASIS CTF Quals 2019 Key maker
#!/usr/bin/env python
from z3 import *
def main():
cmp_to_local_148 = [0x758, 0x2c0, 0x808, 0x306, 0x251, 0x116, 0x2c9, 0x144, 0x5f7, 0x2d5, 0x3d7, 0x298, 0x88a, 0x2bf, 0xa86, 0x347]
cmp_to_local_188 = [0x14f, 0x6e8, 0x6db, 0x69b, 0x3ae, 0x403, 0x3ff, 0x6fd, 0x2f6, 0x515, 0x4fa, 0x6fa, 0x30c, 0x310, 0x26c, 0x540]
cmp_to_local_1c8 = [0x4ab, 0x3d4, 0x47c, 0x56f, 0x58a, 0x4ec, 0x32b, 0x3f1, 0x556, 0x486, 0x3cb, 0x481, 0x42c, 0x2e0, 0x3a4, 0x348]
cmp_to_local_208 = [0x798, 0x3ef, 0x5a0, 0x3d2, 0x4ad, 0x127, 0x585, 0x15e, 0x622, 0x385, 0x53a, 0x382, 0x3ae, 0x2d0, 0x24a, 0x2b1]
cmp_to_local_248 = [0x3ca, 0x5a7, 0x567, 0x8b1, 0x089, 0x48b, 0x538, 0x488, 0x15c, 0x505, 0x533, 0x4fd, 0x120, 0x2ca, 0x291, 0x2df]
@ywkw1717
ywkw1717 / special_instructions
Created October 28, 2018 09:01
SECCON 2018 Online CTF Special Instructions
#!/usr/bin/env python
def main():
key = ["35c36d03",
"c8fa2132",
"9f72275c",
"3ed1ca90",
"e32b4951",
"1c29ac51",
@ywkw1717
ywkw1717 / special_device_file
Created October 28, 2018 08:46
SECCON 2018 Online CTF Special Device File
#!/usr/bin/env python
def main():
key = [
"fbde15b0",
"ae2cc59b",
"27529ad0",
"432a8be5",
"271687b2",
@ywkw1717
ywkw1717 / Runme
Created October 28, 2018 08:12
SECCON CTF 2018 Online Runme
#!/usr/bin/env python
def main():
a = [0x43,0x3a,0x5c,0x54,0x65,0x6d,0x70,0x5c,0x53,0x45,0x43,0x43,0x4f,0x4e,0x32,0x30,0x31,0x38,0x4f,0x6e,0x6c,0x69,0x6e,0x65,0x2e,0x65,0x78,0x65,0x22,0x20,0x53,0x45,0x43,0x43,0x4f,0x4e,0x7b,0x52,0x75,0x6e,0x6e,0x31,0x6e,0x36,0x5f,0x50,0x34,0x37,0x68,0x7d]
flag = ""
for i in a:
flag += chr(i)
@ywkw1717
ywkw1717 / classic_pwn
Created October 28, 2018 08:01
SECCON 2018 Online CTF Classic Pwn
#!/usr/bin/env python
from pwn import *
def main():
# conn = process("./classic_aa9e979fd5c597526ef30c003bffee474b314e22")
conn = remote("classic.pwn.seccon.jp", 17354)
elf = ELF("./classic_aa9e979fd5c597526ef30c003bffee474b314e22")
# libc = ELF("/lib/x86_64-linux-gnu/libc.so.6")
libc = ELF("./libc-2.23.so_56d992a0342a67a887b8dcaae381d2cc51205253")
#!/usr/bin/env python
from z3 import *
def main():
solver = Solver()
s = [BitVec('s_%d' % i, 8) for i in range(16)]
for i in range(len(s)):
#!/usr/bin/env python
import angr
import claripy
def main():
p = angr.Project("./crackme")
key_length = 32
using System;
using System.Text;
using System.Security.Cryptography;
public static class AESCryption
{
public static void Main()
{
AesCryptoServiceProvider aesCryptoServiceProvider = new AesCryptoServiceProvider();
aesCryptoServiceProvider.BlockSize = 128;
#!/usr/bin/env python
from pwn import *
context(os="linux", arch="i386")
def main():
conn = process('./pivot32')
elf = ELF('./pivot32')
#!/usr/bin/env python
from pwn import *
context(os="linux", arch="i386")
# context.log_level = 'debug'
def main():
conn = process("./fluff32")
system = 0x8048430