summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2024-02-25Merge branch 'malf-braekerctf-2024'HEADmasterMalfurious7-35/+166
* malf-braekerctf-2024: Writeup BraekerCTF 2024 / e Writeup BraekerCTF 2024 / Eye Doctor Add image convolution topic doc Add x86 loop instruction callout Merge x86 tips into architecture topic doc BraekerCTF 2024 results
2024-02-25Writeup BraekerCTF 2024 / eMalfurious1-0/+103
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-25Writeup BraekerCTF 2024 / Eye DoctorMalfurious1-0/+0
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-25Add image convolution topic docMalfurious1-0/+2
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-25Add x86 loop instruction calloutMalfurious1-0/+15
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-25Merge x86 tips into architecture topic docMalfurious3-35/+45
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-25BraekerCTF 2024 resultsMalfurious1-0/+1
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-22Merge branch 'malf-lactf-2024'Malfurious4-16/+133
* malf-lactf-2024: Update docker guide x86 register correction lactf 2024 results
2024-02-22Update docker guideMalfurious2-15/+131
The docker reference guide now better explains various common situations. The file is moved to docs/nix since docker is not strictly a web technology. This location makes more sense. Signed-off-by: Malfurious <m@lfurio.us>
2024-02-22x86 register correctionMalfurious1-1/+1
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-22lactf 2024 resultsMalfurious1-0/+1
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-22Merge branch 'malf-bitsctf-2024'Malfurious6-5/+25
* malf-bitsctf-2024: RSA link to factordb Consolidate forensics links and add FTKImager and volatility BITSCTF 2024 results
2024-02-22RSA link to factordbMalfurious1-0/+6
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-22Consolidate forensics links and add FTKImager and volatilityMalfurious4-5/+17
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-22BITSCTF 2024 resultsMalfurious1-0/+2
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-14Add pwn Docker imageMalfurious3-0/+174
Intended to provide a base environment for working with binary exploitation challenges and enable process isolation of said binaries. Signed-off-by: Malfurious <m@lfurio.us>
2024-02-14Add Stegsolve v1.3Malfurious2-7/+0
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-14Leftover note from RITSECMalfurious1-0/+1
Signed-off-by: Malfurious <m@lfurio.us>
2024-02-14Remove sploit toolMalfurious17-645/+0
Sploit has been living on in another repository for the past year or so. Remove the stale files from this repository. Signed-off-by: Malfurious <m@lfurio.us>
2024-02-14RITSEC CTF 2023 resultsMalfurious1-0/+1
Signed-off-by: Malfurious <m@lfurio.us>
2023-03-29UMass CTF 2023 resultsMalfurious1-0/+1
Signed-off-by: Malfurious <m@lfurio.us>
2023-02-17Merge branch 'malf-lactf-2023'Malfurious5-0/+582
* malf-lactf-2023: Writeup LACTF 2023 / Switcheroo Writeup LACTF 2023 / CTFd plus Writeup LACTF 2023 / A hacker's notes Writeup LACTF 2023 / One more time pad lactf 2023 results
2023-02-17Writeup LACTF 2023 / SwitcherooMalfurious1-0/+296
Signed-off-by: Malfurious <m@lfurio.us>
2023-02-17Writeup LACTF 2023 / CTFd plusMalfurious1-0/+125
Signed-off-by: Malfurious <m@lfurio.us>
2023-02-16Writeup LACTF 2023 / A hacker's notesMalfurious1-0/+104
Signed-off-by: Malfurious <m@lfurio.us>
2023-02-16Writeup LACTF 2023 / One more time padMalfurious1-0/+55
Signed-off-by: Malfurious <m@lfurio.us>
2023-02-13lactf 2023 resultsMalfurious1-0/+2
Signed-off-by: Malfurious <m@lfurio.us>
2023-01-15Merge branch 'shellcoding-enhancements'Malfurious10-89/+116
Adds a reverse shell and other improvements for correctness, along with a general cleanup of the files. * shellcoding-enhancements: Ignore shellcode working files shellcode: Add sample for connecting a TCP socket shellcode: Update /bin/sh shellcodes shellcode: Remove shelltool shellcode: Update Makefile shellcode: Move example code to a new directory shellcode: Drop SYS_EXIT samples
2023-01-15Merge branch 'malf-xmas-2022'Malfurious3-0/+337
* malf-xmas-2022: Writeup X-MAS CTF 2022 / Krampus Greetings Writeup X-MAS CTF 2022 / Santas Complaint Hotline X-MAS CTF 2022 results
2023-01-15Ignore shellcode working filesMalfurious1-0/+1
Signed-off-by: Malfurious <m@lfurio.us>
2023-01-15shellcode: Add sample for connecting a TCP socketMalfurious1-0/+49
This sample can be used to create a reverse shell when combined with the shell64 sample: cat examples/{tcp64,shell64}.asm >code.asm make ... Signed-off-by: Malfurious <m@lfurio.us>
2023-01-15shellcode: Update /bin/sh shellcodesMalfurious2-28/+37
The shell-spawning shellcodes are rewritten to address the following concerns: - The array parameters to execve are now set properly, to valid arrays on the stack, instead of NULL pointers. - The cdq instruction is no longer used to sign-extend the rax register, since it has not been producing the expected results in gdb. - Labels, sections, and other file metadata are removed in order to support concatenation of shellcode samples to make more complex code. Signed-off-by: Malfurious <m@lfurio.us>
2023-01-15shellcode: Remove shelltoolMalfurious1-30/+0
shelltool is now deprecated, made redundant by the updated Makefile. Signed-off-by: Malfurious <m@lfurio.us>
2023-01-15shellcode: Update MakefileMalfurious1-12/+26
This patch brings various improvements to the shellcoding experience: - There is no longer a hardcoded assembly sample that gets built Although the default was pretty sane, it will be more convenient to experiment, or build more complex shellcodes using a new untracked filename as the main build target: code.asm If code.asm is missing, then as before, it will be created from shell64.asm (the old hard default). The Makefile targets will compile code.* files. - Hex string generation and bad char detection are improved grep is used to highlight detected bad chars right in place. This entire feature is now implemented directly in the Makefile using a couple command lines, making shelltool deprecated. - Builtin disassembly Just run 'make disas' instead of manually invoking objdump. The output is also filtered through grep for bad char detection. - ELF executable is optional Rather than linking an executable all the time, just run 'make elf' when you need it. Signed-off-by: Malfurious <m@lfurio.us>
2023-01-15shellcode: Move example code to a new directoryMalfurious2-0/+0
This is mainly done to keep the top working directory (where the Makefile lives) cleaner. Signed-off-by: Malfurious <m@lfurio.us>
2023-01-15shellcode: Drop SYS_EXIT samplesMalfurious2-16/+0
Signed-off-by: Malfurious <m@lfurio.us>
2022-12-23Writeup X-MAS CTF 2022 / Krampus GreetingsMalfurious1-0/+220
Signed-off-by: Malfurious <m@lfurio.us>
2022-12-23Writeup X-MAS CTF 2022 / Santas Complaint HotlineMalfurious1-0/+116
Signed-off-by: Malfurious <m@lfurio.us>
2022-12-23X-MAS CTF 2022 resultsMalfurious1-0/+1
Signed-off-by: Malfurious <m@lfurio.us>
2022-09-12Merge branch 'sploit/symtbl-base'Malfurious2-8/+15
This branch brings some conveniences to the semantics behind Symtbl base values. * sploit/symtbl-base: sploit: rev: Properly base Symtbls for non-PIC binaries sploit: Fix bugs involving Symtbl base value sploit: mem: Allow Symtbl base to be modified
2022-09-12Merge branch 'sploit/payload-rop-prep'Malfurious1-32/+32
This branch provides some payload-specific upgrades that have come out of the development so far on the automated ROP chain builder. * sploit/payload-rop-prep: sploit: payload: Promote private methods to "protected" access sploit: payload: Clean up automatic symbol naming sploit: payload: Class no longer extends Symtbl sploit: payload: Allow variadic insertions
2022-09-12sploit: rev: Properly base Symtbls for non-PIC binariesMalfurious1-1/+6
The baddr property identified by r2 is now used as the base address for ELF symbol tables. This should not change the addresses retrieved via the table normally, however should fix the internal offsets of the table so that rebasing makes sense. Note that for PIC/PIE binaries we would already get a Symtbl with 'correct' offsets, as r2 is unable to absolutely resolve them for us. In these cases, the Symtbl base value remains at zero. Signed-off-by: Malfurious <m@lfurio.us> Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-09-12sploit: Fix bugs involving Symtbl base valueMalfurious2-3/+3
Some code previously assumed a Symtbl's base value to always be zero. This was often the case, however the assumption would break (for example) when attempting to rebase() a mapped Symtbl. As of the previous patch enabling freer modification of base, the potentiality of these bugs will be higher. Signed-off-by: Malfurious <m@lfurio.us> Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-09-12sploit: mem: Allow Symtbl base to be modifiedMalfurious1-6/+8
Allow a Symtbl's base to be modified in-place, without mapping into a new object. This is useful when working with the Symtbl aspect of a Payload. This includes setting a non-zero base on construction. As usual, when defining base on construction, any additional kwargs symbols are interpreted relative to the given base. The order of arguments does not matter. Signed-off-by: Malfurious <m@lfurio.us> Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-09-12sploit: payload: Promote private methods to "protected" accessMalfurious1-15/+15
Lift restriction (name mangling) to Payload helper functions, as their use will be useful in Payload subclasses. Signed-off-by: Malfurious <m@lfurio.us> Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-09-12sploit: payload: Clean up automatic symbol namingMalfurious1-10/+11
This is just a slight code reduction, but will make any future code simpler as well. Explicit comparision to None is more correct as well; centralizing this for reuse better justifies the wordier if statement. Signed-off-by: Malfurious <m@lfurio.us> Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-09-12sploit: payload: Class no longer extends SymtblMalfurious1-11/+8
Given the current design of Symtbl, creating subclasses of it gets more tedious the further one goes down a potential class hierarchy. As I am planning to introduce new features in the future that explicitly extend Payload, make this change now to minimize the impact. Additionally, switching Payload's relationship with Symtbl from "is-a" to "has-a" makes it more consistent with rev.ELF, the other major user of Symtbl. (And in both cases, the member is named 'sym') Signed-off-by: Malfurious <m@lfurio.us> Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-09-12sploit: payload: Allow variadic insertionsMalfurious1-13/+15
Often times, users of the Payload module wish to push a list of integers to a payload buffer. Currently, the best (and intended) way to do this is to make several calls to .int(). However, as part of the ROP effort, I am planning to add function 'gadget(addr, *params)' to the Payload class. Per the design of this function, calling it with an expanded list of values would be equivalent to passing each to .int() individually. In order to discourage the use of .gadget(), as a shortcut to a series of .int()s, .int(), and most other insertion functions, now accept arbitrarily many value arguments. Functions that support additional options (such as .int()'s 'signed' parameter) will apply such options to all values. If a symbol name is defined, it will reference the beginning of the block of values. Keep in mind, this will also allow inserting zero values. For example, obj.bin(sym='end') will tag the end of the payload without extending its content. This use-case is not intended to be particularly useful, but exists as a consequence of the change. Payload.rep() and the pad functions are not affected by this commit, as I don't think changing their semantics in this way makes sense. Signed-off-by: Malfurious <m@lfurio.us> Signed-off-by: dusoleil <howcansocksbereal@gmail.com>
2022-08-21Merge branch 'malf-angstrom-2022'Malfurious5-0/+370
* malf-angstrom-2022: Writeup angstromCTF 2022 / whatsmyname Writeup angstromCTF 2022 / uninspired Writeup angstromCTF 2022 / baby3 Writeup angstromCTF 2022 / Auth Skip angstromCTF 2022 results
2022-05-07Writeup angstromCTF 2022 / whatsmynameMalfurious1-0/+115
Signed-off-by: Malfurious <m@lfurio.us>
cgit-1.2.3-r5 | srcnode v0.4.0