Siguza

#include <spawn.h>
#include <stdint.h>
#include <stdio.h>

extern char **environ;

typedef struct
{
    uint32_t version;
    uint32_t size;

stong

import sys
import os
from pwn import *

def tee_process(p):
    import threading
    import ctypes
    libc = ctypes.CDLL(None)
    splice = libc.splice
    tee = libc.tee

Siguza

// Bugs by NSO Group / Ian Beer.
// Exploit by Siguza & tihmstar.
// Thanks also to Max Bazaliy.

#include <stdint.h>             // uint32_t, uint64_t
#include <stdio.h>              // fprintf, stderr
#include <string.h>             // memcpy, memset, strncmp
#include <unistd.h>             // getpid
#include <mach/mach.h>
#include <stdlib.h>

farazsth98

I played Harekaze Mini CTF 2020 for about 3 hours this weekend. The pwn challenges were nice (I especially enjoyed nm-game-extreme). Here are some short writeups.

shellcode

The program just tells you to provide shellcode that will execute execve("/bin/sh", NULL, NULL). It gives you the address of the "/bin/sh" string, so you just create shellcode to do the job and send it:

#!/usr/bin/env python3

from pwn import *

stong

// TLDR:
// Whitebox 128-bit rsa with e=17. Input is multiplied by a constant before the RSA

#include <Windows.h>
#include <stdio.h>
#include <stdint.h>

extern "C" void __fastcall rsa_encrypt (uint8_t* in, uint8_t* out);

// 1. Func is ~90kb, and control flow is simple. Should be decompilable just extremely SLOW.

geohot

%pylab inline
%load_ext autoreload
%autoreload 2

from tools.lib.route import Route
from tools.lib.logreader import LogReader
r,num = Route("ce2fbd370f78ef21|2020-11-27--16-27-28"),10
#r,num = Route("f66032c2b5aa18ac|2020-12-04--09-33-54"),30
alr = []
for n in range(num-1, num+5):

LiveOverflow

byt3bl33d3r

# Crash the Windows Event Log Service remotely, needs Admin privs
# originally discovered by limbenjamin and accidently re-discovered by @byt3bl33d3r
#
# Once the service crashes 3 times it will not restart for 24 hours
#
# https://github.com/limbenjamin/LogServiceCrash
# https://limbenjamin.com/articles/crash-windows-event-logging-service.html
#
# Needs the impacket library (https://github.com/SecureAuthCorp/impacket)

Siguza

#include <fcntl.h>
#include <stdio.h>
#include <sys/mman.h>
#include <sys/stat.h>
#include <mach-o/loader.h>
#include <mach-o/nlist.h>

int main(int argc, const char **argv)
{
    if(argc != 2)

muff-in

Assembly Language / Reversing / Malware Analysis / Game Hacking -resources

⭐Assembly Language

Modern x64 Assembly

https://www.youtube.com/playlist?list=PLKK11Ligqitg9MOX3-0tFT1Rmh3uJp7kA