trietptm

###########################################################################
# Rotating bits (tested with Python 2.7)
 
from __future__ import print_function   # PEP 3105
 
# max bits > 0 == width of the value in bits (e.g., int_16 -> 16)
 
# Rotate left: 0b1001 --> 0b0011
rol = lambda val, r_bits, max_bits: \
    (val << r_bits%max_bits) & (2**max_bits-1) | \

jehugaleahsa

function join($path)
{
    $files = Get-ChildItem -Path "$path.*.part" | Sort-Object -Property @{Expression={
        $shortName = [System.IO.Path]::GetFileNameWithoutExtension($_.Name)
        $extension = [System.IO.Path]::GetExtension($shortName)
        if ($extension -ne $null -and $extension -ne '')
        {
            $extension = $extension.Substring(1)
        }
        [System.Convert]::ToInt32($extension)

marians

We install certutil and pk12util if necessary:

sudo apt install libnss3-tools

On Linux, Chromium uses the NSS Shared DB. Check if you have the ~/.pki/nssdb directory:

ls $HOME/.pki/nssdb

thomasheller

Install Arch Linux in VirtualBox

Quick install guide for Arch -- if you're looking for an automated installer, consider Arch Anywhere.

Download

Download the latest version from: https://www.archlinux.org/download/

someguynamedmatt

FILE SPACING:

 # double space a file
 sed G

 # double space a file which already has blank lines in it. Output file
 # should contain no more than one blank line between lines of text.
 sed '/^$/d;G'

curi0usJack

	# 
	# TO-DO: set |DESTINATIONURL| below to be whatever you want e.g. www.google.com. Do not include "http(s)://" as a prefix. All matching requests will be sent to that url. Thanks @Meatballs__!
	#
	# Note this version requires Apache 2.4+
	#
	# Save this file into something like /etc/apache2/redirect.rules.
	# Then in your site's apache conf file (in /etc/apache2/sites-avaiable/), put this statement somewhere near the bottom
	# 
	# Include /etc/apache2/redirect.rules
	#

ricardo2197

0ctf babystack with return-to dl-resolve

In this write-up I will discuss how I managed to solve the challenge "babystack" from 0ctf with a technique called return to dl-resolve. I did not know this kind of return-to attack before the contest. In the following sections a detailed explanation of the entire exploit will be presented.

1. Binary analysis

I downloaded the provided binary babystack and quickly fired up binaryninja alongside with gdb to analyze it. I quickly realized a buffer overflow vulnerability is present within sub_804843b. My first approach was to solve this challenge using a return-to-libc attack by leaking the base address of the library and call system in order to get a shell.
This technique is contingent on:

1. Leaking libc base address
2. Knowing the version of libc to get the offset of system.

However, the version of libc on the remote server was unknown and the ELF did not provide any function that can be us

landzz

<?php

if ( ! function_exists('getCurlPostwithFile')){
  function getCurlPostwithFile($_url='', $_param=array(), $_file_name=array()){

    if($_url !=''){
      ini_set("memory_limit", "512M");

      $_file_data = array();
      foreach ($_file_name as $_key => $_val){

syndrill

FROM phusion/baseimage

EXPOSE 5000

ARG binary
ENV binary=${binary}

# update
RUN apt update && apt upgrade -y && apt update --fix-missing
RUN apt install curl python netcat-openbsd vim nano socat lib32ncurses5 -y

skizhak

#Run build-v8.sh to setup deps.
gn gen "--args=is_clang=true is_component_build=false v8_static_library=true use_custom_libcxx=false target_cpu=\"x64\"" out.gn/x64.Release
ninja -C out.gn/x64.Release/