mrexcessive

C:\mrexcessive\games>java -jar Equilinox_0_30_Windows.jar
No uniform variable called fadeOutPeriod found!No uniform variable called worldCenter found!No uniform variable called fadeOutPeriod found!No uniform variable called worldCenter found!No uniform variable called fadeOutPeriod found!No uniform variable called worldCenter found!No uniform variable called worldRadius found!No uniform variable called fadeOutPeriod found!No uniform variable called worldCenter found!No uniform variable called worldRadius found!No uniform variable called fadeOutPeriod found!No uniform variable called worldCenter found!No uniform variable called worldRadius found!No uniform variable called fadeOutPeriod found!No uniform variable called worldCenter found!No uniform variable called worldRadius found!No uniform variable called fadeOutPeriod found!No uniform variable called worldCenter found!No uniform variable called worldRadius found!No uniform variable called fadeOutPeriod found!No uniform variable called worldCenter found!No u

mrexcessive

#!/usr/bin/python
# pwn.py for 0CTF2016.warmup
#@mrexcessive

import os, sys, code
import readline, rlcompleter
import socket
import time
import string
import struct

mrexcessive

#!/usr/bin/python
# pwnserver.py based on MyLittlePwnie challenge code from VolgaCTF 2015
# in turn based on my EBP challenge code from PLAID 
#@mrexcessive

import os, sys, code
import readline, rlcompleter
import socket
import time
import struct

mrexcessive

treewalker:     file format elf64-x86-64


Disassembly of section .init:

00000000004006d8 <_init>:
  4006d8:	48 83 ec 08          	sub    $0x8,%rsp
  4006dc:	48 8b 05 05 0b 20 00 	mov    0x200b05(%rip),%rax        # 6011e8 <_DYNAMIC+0x1d0>
  4006e3:	48 85 c0             	test   %rax,%rax

mrexcessive

#!/usr/bin/python
#pwnserver.py for 9447 CTF 2015 exploit / cards
#Whitehatters-uk

import os, sys, code
import readline, rlcompleter
import socket
import time
import struct
import telnetlib

mrexcessive

#!/usr/bin/python
#See article on https://whitehatters.academy/

#target server http:10.13.37.4  (on VPN for DCTFU 2015 quals CTF)

import requests            # see http://stackoverflow.com/questions/4476373/simple-url-get-post-function-in-python
import multiprocessing     # see http://stackoverflow.com/questions/6286235/multiple-threads-in-python

# we need to run register.php and login.php at the same time

mrexcessive

See article on https://whitehatters.academy/
ROP gadgets are:
0x0000000000000aeb : add bl, ch ; add eax, 0xb8 ; add cl, cl ; ret
0x0000000000000b6f : add bl, dh ; ret
0x0000000000000b6d : add byte ptr [rax], al ; add bl, dh ; ret
0x0000000000000b6b : add byte ptr [rax], al ; add byte ptr [rax], al ; add bl, dh ; ret
0x0000000000000aef : add byte ptr [rax], al ; add byte ptr [rax], al ; leave ; ret
0x0000000000000b6c : add byte ptr [rax], al ; add byte ptr [rax], al ; ret
0x0000000000000af0 : add byte ptr [rax], al ; add cl, cl ; ret
0x00000000000007db : add byte ptr [rax], al ; add rsp, 8 ; ret

mrexcessive

See article on https://whitehatters.academy/
e300:     file format elf64-x86-64


Disassembly of section .init:

00000000000007c8 <.init>:
 7c8:	48 83 ec 08          	sub    $0x8,%rsp
 7cc:	48 8b 05 0d 08 20 00 	mov    0x20080d(%rip),%rax        # 200fe0 <rand@plt+0x200730>
 7d3:	48 85 c0             	test   %rax,%rax

mrexcessive

See article on https://whitehatters.academy/
0000000: 7f45 4c46 0201 0100 0000 0000 0000 0000  .ELF............
0000010: 0300 3e00 0100 0000 c008 0000 0000 0000  ..>.............
0000020: 4000 0000 0000 0000 d011 0000 0000 0000  @...............
0000030: 0000 0000 4000 3800 0900 4000 1c00 1b00  [email protected]...@.....
0000040: 0600 0000 0500 0000 4000 0000 0000 0000  ........@.......
0000050: 4000 0000 0000 0000 4000 0000 0000 0000  @.......@.......
0000060: f801 0000 0000 0000 f801 0000 0000 0000  ................
0000070: 0800 0000 0000 0000 0300 0000 0400 0000  ................
0000080: 3802 0000 0000 0000 3802 0000 0000 0000  8.......8.......

mrexcessive

#!/usr/bin/python
#TrendJP CTF Prog300 - maze solving
#@mrexcessive @WHA

import sys
import copy
import math
from itertools import permutations

debug = True