spnow

#!/usr/bin/python

# Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford (jspenguin@jspenguin.org)
# The author disclaims copyright to this source code.
#
# Modified slightly by Andreas Thienemann <athienemann@schubergphilis.com> for clearer exploit code
# and 64k reads
#
# This version of the exploit does write received data to a file called "dump" in the local directory
# for analysis.

spnow

import requests
import random


def send_combination(combination):
	URL = "http://slumdogmillionaire.quals.nuitduhack.com/"
	data = {"numbers": "%s" %(combination)}
	r = requests.post(URL, data=data)
	winning_combination =  r.content[r.content.find("Winning combination was: ")+25:r.content.find("Winning combination was: ")+54]
	return winning_combination

spnow

#!/usr/bin/python
# -*- coding: utf-8 -*-

import socket
import sys
import string
import time

def recv_until(s, data):
	res = ""

spnow

Awesome Pwnable

Meta

• awesome-ctf - A curated list of CTF frameworks, libraries, resources and softwares

Heap Exploitation

• malloc.c - malloc() implementation in glib-2.23 (as found in Ubuntu 16.04.1 LTS)
• how2heap - Awesome collection of various heap exploitation techniques

spnow

##########
# Win10 Initial Setup Script
# Author: Disassembler <disassembler@dasm.cz>
# Version: 1.7, 2016-08-15

# dasm's script: https://github.com/Disassembler0/Win10-Initial-Setup-Script/

# THIS IS A PERSONALIZED VERSION
# This script leaves more MS defaults on, including MS security features.
# Tweaked based on personal preferences for @alirobe 2016-11-16 - v1.7.1

spnow

def decrypt(func):
	"""
	Decryption of zeus strings
	"""
	ZBOT_INDEX_MIN = 0x0
	ZBOT_INDEX_MAX = 0xe7
	data = {}
	
	for i in range(ZBOT_INDEX_MIN, ZBOT_INDEX_MAX):
 

spnow

// What system are we connected to?
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

// Get the hostname and username (if available)
hostname
echo %username%

// Get users
net users
net user [username]

spnow

OmniCode! version 0.1.7
      Description for the New Net 

All codes are built in the following way:
  [code symbol][attribute].[modifier].[modifier].[modifier]...

	or for multiple codes:

	[code symbol][attribute].[modifier]&[attribute].[modifier]...

spnow

from angr import Project, surveyors
from sys import exit
import claripy


'''vars
pstr: where the dynamic input will be stored in the state
phcode: the address of hash to collide with (the program loads the correct hash from this address)
find: the address we want the path explorer to find (the "you win" address)
retn: the simulation starts in a function called from main (check_password) but the 'find' address is in main so I need a place to return

spnow

<?php
    /*
        sqlpwn by orange
        Don't brute force or you will be banned !
    */

    session_start();
    error_reporting(0);

    include "template.html";