Skip to content

Instantly share code, notes, and snippets.

View Jinmo's full-sized avatar

Jinmo Jinmo

389 followers · 1 following
View GitHub Profile
@Jinmo
Jinmo / unload.py
Created May 5, 2019 14:10
Force unloading IDA plugin (or not)
from pkg.internal_api import _ida_lib
import ctypes
functype, lib = _ida_lib()
class qstring(ctypes.Structure):
_fields_ = [
('array', ctypes.c_void_p),
@Jinmo
Jinmo / poc.py
Last active April 16, 2019 12:26
child process console realtime output in IDAPython
import subprocess
import Queue
import threading
import time
import sys
def Popen(*args, **kwargs):
q = Queue.Queue()
done = []
@Jinmo
Jinmo / virtualenv_installer.py
Last active April 4, 2019 13:24
virtualenv installer using builtin modules (python 2.7), also installs pip and wheel
from hashlib import sha256
import os
import sys
import logging
import urllib2
import tempfile
# extracted from https://pypi.org/simple/virtualenv/
VIRTUALENV_URL = 'https://files.pythonhosted.org/packages/33/5d/' \
@Jinmo
Jinmo / tcache-memcpy.c
Created February 15, 2019 15:27
A hard way to do memcpy
// The whole code below does container[2] = buf[0]
#include <stdio.h>
#include <stdlib.h>
#define SIZE 0x100
__attribute__((aligned(0x10)))
long container[] = {0, 0x100 + 0x11, 0};
@Jinmo
Jinmo / exp.py
Created January 27, 2019 18:07
codegate 2019 qual: kingmaker execve
from pwn import *
HOST, PORT = "110.10.147.104", 13152
# HOST, PORT = "0.0.0.0", 31338
r = remote(HOST, PORT)
ii = lambda x: r.sendline(str(x))
go = lambda x: (menu(), ii(x))[0]
ii("""1 lOv3 1 2
@Jinmo
Jinmo / remote
Last active August 3, 2019 16:47
scripts
#!/bin/bash
# ./remote server port 'menu string'
touch "$1" || (echo "Cannot create file named $1" && exit 1)
exec > "$1"
echo 'from pwn import *'
echo ''
echo -e "HOST, PORT = \"$2\", \"$3\""
if [ ! -n "$HOST" ]; then HOST=0.0.0.0; fi
@Jinmo
Jinmo / gis.py
Last active August 28, 2018 02:40
SCTF 2018 Finals: Ghost in the Spectre
from pwn import *
HOST, PORT = "gis.eatpwnnosleep.com", "9999"
# HOST, PORT = "0.0.0.0", 31337
menu = lambda: r.recvuntil(":")
ii = lambda x: r.sendline(str(x))
go = lambda x: (menu(), ii(x))[1]
context.endian = 'big'
@Jinmo
Jinmo / _source.c
Last active October 10, 2018 20:24
32/64bit return-to-dl-resolve, when libc is known. couldn't find original article, so rewrote it from memory.. will add link if found.
// gcc % -fno-stack-protector
#include <unistd.h>
int main() {
char buf[16];
read(0, buf, 0x10000);
return 0;
}
@Jinmo
Jinmo / arm.py
Last active June 16, 2018 15:08
from pwn import *
HOST, PORT = "49.236.136.140", "15010"
# HOST, PORT = "0.0.0.0", 31337
r = remote(HOST, PORT)
def ii(x): return r.sendline(str(x))
@Jinmo
Jinmo / test.html
Last active June 3, 2018 02:00
Excess Ess 2
<html>
<head>
</head>
<body>
<style type="text/css">
body {
margin: 0;
}