rev pwn

Unibw 2023/rev pwn/Baby Cyberdyne/README.md

@@ -0,0 +1,11 @@
+Baby Cyberdyne
+
+In the early years of Cyberdyne Dr. Miles Bennet Dyson was developing all the software himself. This software is up to date til now.
+
+Connect via SSH to baby-cyberdyne.codectf.localos.io:2222 to receive your IP.  Then use local forwarding to connect to your IP to port 8888.
+
+Credentials:
+
+    User:  aa43d20dbbbbfc662d960ab4d51d0fd8
+
+    Password: Ei1gkv2PYS9YFvbZJ1m0QOdCE1i2d90VRdLrvhOdd4I=

Unibw 2023/rev pwn/Baby Cyberdyne/ape.py

@@ -0,0 +1,20 @@
+from pwn import *
+elf = ELF(os.getcwd() + "/0d2dd2de6fc66a1b0e38dc299e38e0da")
+
+gs = '''
+unset env LINES
+unset env COLUMNS
+set follow-fork-mode child
+br *handle_conn+631
+# br *main+420
+continue
+'''
+
+def start():
+    if args.GDB:
+        return gdb.debug([elf.path], gs)
+    else:
+        return process([elf.path])
+
+io = start()
+io.sendline()

Unibw 2023/rev pwn/House of Munich/README.md

@@ -0,0 +1,11 @@
+House of Munich
+
+Since Arnold has retired, he wants to secure his new house. Since he is the best terminator ever developed by SkyNet, he is allowed to test SkyNet's new House Security System.
+
+Connect via SSH to house-of-munich.codectf.localos.io:2222 to receive your IP.  Then use local forwarding to connect to your IP to port 8888.
+
+Credentials:
+
+    User:  aa43d20dbbbbfc662d960ab4d51d0fd8
+
+    Password: Ei1gkv2PYS9YFvbZJ1m0QOdCE1i2d90VRdLrvhOdd4I=

Unibw 2023/rev pwn/shelly/ape.py

@@ -0,0 +1,28 @@
+s = "/code showtime"
+alphabet = "0123456789abcdefghijklmnopqrstuvwxyz .,-!?+*'<>#@$ۤ%&/()[]0"
+
+last_letter = "1"
+
+output = []
+
+for h in s:
+    int_h = int(alphabet.index(h))
+    int_ll = int(alphabet.index(last_letter))
+    diff = int_h - int_ll
+    sym = ""
+    if diff > 0:
+        sym = ">"
+    if diff < 0:
+        sym = "<"
+    if diff == 0:
+        pass
+    for i in range(abs(diff)):
+        print(sym)
+    if diff != 0:
+        print("!")
+    else:
+        pass
+    last_letter = h
+    pass
+
+print("p")

Unibw 2023/rev pwn/shelly/ape2.py

@@ -0,0 +1,4 @@
+for i in range(100):
+    print(">")
+    print("!")
+    print("p")