This is a collection of CTF, pentesting, binary exploitation, and miscellaneous snippets that I use often. Click on the snippets to copy them.

Binary Security

patchelf

Use a different libc by patching the ELF's loader and base directory.

Get libc from a .deb

If you're looking for a libc (for example, one you found on blukat.me, like this one), you can download the package for it (this example uses a .deb).

The ld and libc will be inside ./lib.

GDB Base Address

GDB uses the same base address when a progam is launched from GDB (with default settings) or when ASLR (on the whole system) is turned off.

CPIO Operations

Initial ramdisks for Linux-based operating environments are often stored in cpio files.

Here is a script for rebuilding a cpio archive.

#!/bin/bash

set -e
cd initramdisk
gcc -static exploit.c -o exploit
find . | cpio -o -H newc | gzip -c > ../new.cpio.gz 

pwntools

Here is an example setup/preamble for a pwntools script.

# CTF Challenge Name
# 20XX-XX-XX
 
from pwn import *

#################
# --- SETUP --- #
#################

context.terminal = ["tmux", "splitw", "-h"]
context.binary = binary = ELF("./binary-name", checksec=False)

if args.REMOTE:
    context.noptrace = True
    p = remote("challenge.host.example.org", 1024)
else:
    p = process(binary.path)

gdb.attach(p, gdbscript="""
""")

GDB

Syscalls

You can break on syscalls by using "catch", for example, 'catch syscall read' or 'catch syscall 0':

Search

Search for byte pattern (gef).

Set Memory

You can set arbitrary memory at arbitrary addresses with GDB.

Source Code Vulnerability Analysis

scan-build

Run clang's static code analyzer (C/C++), and run the web GUI (allowing all hosts to access it, useful for headless VMs):

weggli

Find patterns in source code (see: this blog post)

Compile with clang ASAN

Network Enumeration

nmap

This is my go-to command. It will scan all TCP ports and print them out (-v, verbose) when found.

If stuck, hit 'em with the UDP scan:

GoBuster

Enumerate a site's directories:

GoBuster binaries here.

Shells

Reverse Shells

First method is using netcat (without the -e option, for example, netcat-openbsd). On your local computer:

On remote computer:

Second approach uses bash's built-in networking features. On local:

On remote:

PHP Shells

Weevely can generate compact binding webshells. Build:

Connect:

Alternatively, you can just use p0wny. It can be found here.

Linux

Convert ova to qcow2

Down with VMWare, long live QEMU.

Optionally if the VM's declared disk size is big, shrink it:

Compile the Linux Kernel

It's surprisingly easy. First clone the repo:

Make the config (use menuconfig for a TUI):

And compile it. -j8 means use 8 CPU cores.

If you want to run it with qemu, you can use this:

Exit QEMU with C-a c p (CTRL-a, then c, then p).

Build Docker Image

You have a docker file and you want to run it. This example uses an image called carrots that runs a service on port 80.

Killing Network Connections

If your net utils are up to date, you can kill all connections (or, all sockets) not from your IP address.

Reverse SSHFS

This is not secure (a malicious guest sshd could retrieve arbitrary files from host). But it's very useful for "trusted" VMs! dpipe is from vde2.

Media

pandoc

Convert anything to anything else.

ghostscript

Reduce PDF size without it looking noticeably bad.

XLSX to CSV

Convert XLSX sheet to a CSV with gnumeric: