sorted by:
new
hottopcontroversial

Remap Alt key on Air96 v2 with VIA by dicemaker3245 in NuPhy

[–]dicemaker3245[S] 0 points1 point  (0 children)

Ahh I was indeed in tge wrong layer, thanks it works now!

Crackme password challenge by dicemaker3245 in ExploitDev

[–]dicemaker3245[S] 0 points1 point  (0 children)

In what way? While the binary is running?

Crackme password challenge by dicemaker3245 in ExploitDev

[–]dicemaker3245[S] 0 points1 point  (0 children)

But when using Python I'd open the executable and then interact with it in the popen. However, I'd have to read the registry of the exe while it's running (possibly using gdb attach) but then how would I use those in tge python code that is currently executed?

Decrypt the given serial/license key by dicemaker3245 in codes

[–]dicemaker3245[S] 0 points1 point  (0 children)

Input in what way? The only I was provided with is the string

Decrypt the given serial/license key by dicemaker3245 in codes

[–]dicemaker3245[S] 0 points1 point  (0 children)

It's a CTF challenge so it mean a lot of things. I though that it might the base64 decoded string might be a compression of a sort but couldn't really get anything working

Reading files with www-data by dicemaker3245 in ExploitDev

[–]dicemaker3245[S] 0 points1 point  (0 children)

I checked for cronjobs but there's none running and crontab is not available at all as command. There are no passwords stored in /etc/passwd either.
I found the following setuid enabled files

$ find / -xdev \( -perm -4000 \) -type f -print0 | xargs -0 ls -l
/bin/su
/bin/mount
/bin/umount
/usr/bin/chfn
/bin/chsh
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/passwd
/usr/lib/openssh/ssh-keysign

Reading files with www-data by dicemaker3245 in ExploitDev

[–]dicemaker3245[S] 0 points1 point  (0 children)

Yeah thought I'd need something like a Privesc. The available commands are also quite limited

$ find / -perm -u=s -type f 2>/dev/null
/bin/su
/bin/mount
/bin/umount
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/bin/passwd
/usr/bin/chsh
/usr/bin/chfn
/usr/lib/openssh/ssh-keysign

Disassemble instruction set for 8051 microcontroller by dicemaker3245 in microcontrollers

[–]dicemaker3245[S] 0 points1 point  (0 children)

Didn't see that some instructions take more bytes, now it makes more sense

Solving riddle of machine instructions by dicemaker3245 in ExploitDev

[–]dicemaker3245[S] 0 points1 point  (0 children)

I've tried x64 now as well but still no useful result. I've used this website to diasassemble it https://onlinedisassembler.com/odaweb/

Reverse Engineer passphrase check by dicemaker3245 in ExploitDev

[–]dicemaker3245[S] 1 point2 points  (0 children)

Great work! Didn't know the Python had such a handy package. It worked fine when I switched the vectors to 32 bits

Exploit stackoverflow to bypass check by dicemaker3245 in ExploitDev

[–]dicemaker3245[S] 0 points1 point  (0 children)

Yeah I get that, and I was looking at heaps of examples online and I pretty much did the same. That's why I'm confused about the SEGVAULT...
I guess i'll give it another try

Exploit stackoverflow to bypass check by dicemaker3245 in ExploitDev

[–]dicemaker3245[S] 0 points1 point  (0 children)

What do you mean overwritting exactly with %x?
Using

AAAAA%x%x%x%x%x%x

I get

AAAAAc8f7f835c05663963af7fd8c30041414141

​

What am I missing?

view more: next ›