disconnect3d

#!/usr/bin/env python3
# flask is required - install with `pip install flask`

import sys
import subprocess
from flask import Flask


if len(sys.argv) < 2:
    print("Usage: %s <public ip>" % sys.argv[0])

disconnect3d

Course name: Cryptography 1 URL: https://class.coursera.org/crypto-007/class

Lectures

Week 1

Course Overview (11 min)

• HTTPS is actually not a protocol of its own. It’s simply regular HTTP on top of SSL/TLS.

disconnect3d

def add(b1, b2):
    result = []

    carry = 0

    for i, j in zip(reversed(b1), reversed(b2)):
        tmp = int(i) + int(j) + carry # 0, 1, 2
        #print("i=%s, j=%s, carry=%d" % (i, j, carry))
        carry = tmp / 2
        tmp = tmp % 2

disconnect3d

# QIWI CTF 2016 reverse 3 [100 pts] solution
# The flag could have been calculated by hand, 
# but I've decided to write a brute force to train gdb scripting...
# (one had to see that input on particular index changed output on particular index linearly)

# thx to http://tromey.com/blog/?p=548
import gdb
import string

break_addr = 0x0000555555554B9F

disconnect3d

/*
//// Decompiled from .so compiled with Cython
//// hidden.pyx code:

import numpy as np

def bar(x):
    print "Hello from bar"
    arr = np.array(x)
    return arr * arr.T

disconnect3d

%%cython

# Minkowski Distance with p=0.5
# based on scikit-learn MinkowskiDistance cython's class
# https://github.com/scikit-learn/scikit-learn/blob/cbd3bca20f1d19461011b5f59d9416669eb30535/sklearn/neighbors/dist_metrics.pyx#L524


from libc.math cimport fabs, sqrt, pow
cimport numpy as np

disconnect3d

HIDDENSC:
02:00 <@crowell> disconnect3d: it's from the poking holes in information hiding paper
 https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/oikonomopoulos
POC: 02:11:16 <yrp> tezeb: https://gist.github.com/yrp604/82e4f1cb8ed553c7a995237062177a6c

MINESWEEPER:
02:00 <yyyyyyy> minesweeper writeup: https://hxp.io/blog/30

RSA:
02:00 <@gsilvis> RSA: 1 has a small factor [use pollard's rho]; 2 has a factor p where p-1 is smooth [use pollard's p-1]; 3 was GCD; 4 was Weiner's attack; 5 was Fermat's factorization algorithm

disconnect3d

"""
Solution from Disconnect3d [playing in Just Hit the Core]
"""

import os
import angr
import pwn
import subprocess

disconnect3d

In [8]: import ctypes
   ...: 
   ...: 
   ...: class Foo(ctypes.LittleEndianStructure):
   ...:     _fields_ = (('bar', ctypes.c_uint64),)
   ...: 
   ...:     def __str__(self):
   ...:         return 'Foo .bar={}'.format(self.bar)
   ...: 
   ...:     @classmethod

disconnect3d

import angr

# Just compile the modified code: `gcc modified.c`
# and run `python crack.py` (you need angr installed)

# NOTE: You can find WIN_ADDR with `objdump -Mintel -d a.out  | grep 1337`
WIN_ADDR = 0x40063e

p = angr.Project('./a.out')
pg = p.factory.path_group()