zhangyoufu

import requests
import re

default_host = 'wx.qq.com'
# default_host = 'web.weixin.qq.com'
# default_host = 'web.wechat.com'
# default_host = 'web2.wechat.com'
# default_host = 'web.wechatapp.com'

# default_lang = 'en_US'

zhangyoufu

import requests

class DummyList( list ):
    def __len__( self ):
        return 1

requests.post( 'http://requestb.in/ul8ixpul', data={'a':'A'}, files=DummyList() )

zhangyoufu

/*******************************************************************************
 *
 * No cON Name Capture The Flag 2014 Qual
 *
 * NcN CTF 2014 Qual - eXPLicit - 500 pts
 *
 * Reverse Engineered by libmaru (libmaru#gmail.com)
 *
 * Produce identical binary (except Build ID) as the official one
 *

zhangyoufu

#include <stdio.h>

unsigned char shellcode[] = {
        0x4f, 0xf0, 0x00, 0x00,
        0xf0, 0x47,
};

int main()
{
        shellcode[2] = 0x01;

zhangyoufu

dpkg-query -W | cut -f1 | xargs apt-cache rdepends --installed | python2.7 -c 'import re,sys;sys.stdout.write(re.sub(".*\nReverse Depends:\n( [ |].*\n)+","",sys.stdin.read()).replace("Reverse Depends:\n",""))'

zhangyoufu

#!/bin/bash

# Usage:
#   (gdb) target extended-remote | ./gdbserver.sh

(echo 'stty raw -echo; exec gdbserver --multi - 2>/dev/nul'; cat) | adb shell | stdbuf -o0 dos2unix | (read -r; read -r; cat)

zhangyoufu

__all__ = ['curry']

# Modified from http://mtomassoli.wordpress.com/2012/03/18/currying-in-python/
# Not perfect, but almost there

# Note: func_name must be ascii string
def generate_curry_func_name(func, *args, **kwargs):
    argument = map(repr, args)
    argument += [u'%s=%s' % (k,repr(kwargs[k])) for k in func.func_code.co_varnames if k in kwargs]
    argument = u', '.join(argument)

zhangyoufu

#!/usr/bin/env python
# -*- coding: utf-8 -*-

stu_id = 'your student id'
username = password = 'use your own credential, hint: 00xxxxx'

host = '10.14.101.169'
login_url = 'http://10.14.101.169/LogOn'
lab_url ='http://10.14.101.169/TA/lab/Edit/114'
check_url = 'http://10.14.101.169/QianDao'

zhangyoufu

VMWare .vmx

debugStub.listen.guest64 = "TRUE"
debugStub.listen.guest64.remote = "TRUE"
debugStub.hideBreakpoints = "TRUE"


Note: IDA 64bit can only handle 64-bit long mode
Ref: http://bbs.pediy.com/showthread.php?p=1285364

zhangyoufu

# for test purpose only, do not use in production
# inspired by http://blog.pkh.me/p/4-simple_vhost-with-nginx.html

server {
    listen 80 default_server;
    listen [::]:80 default_server;
    server_name default;
    server_name_in_redirect off;

    set $vpath /srv/_vhost/$host;