Package: ctfbox
ctfboxA box for CTF challenges with some sugar functions, Just enjoy itCurrent version:1.12.5中文文档点这里Please use python3.6+GuidectfboxGuideInstallUsageCommonPWNFunctionsutilsWEBREVERSEMISCPWNTechniquesDependsContributorsLogsInstallAll you need to do ispipinstallctfboxUsageCommonfromctfboximport*# Will not import the pwn part, please check the PWN Usage section below# enjoy itPWNPWN UsageFunctionsPlease refer to docstring for function's signatures and usagesutilsSome useful functions, close to intuitionurl:url_encode(),url_decode(),force_url_encode()html:html_encode(),html_decode()base16:base16_encode(),base16_decode()base32:base32_encode(),base32_decode()base64:base64_encode(),base64_decode()json:json_encode(),json_decode()hex:bin2hex(),hex2bin()jwt:jwt_encode(),jwt_decode()rot:rot_encode()hash:md5(),sha1(),sha256(),sha512()random:random_int(),random_string()prase od command data:od_parse()A decorator to make it multi-threaded:Threader()Decrypted in the usual way:auto_decode()WEBgenerate flask pin:get_flask_pin()generate flask session:flask_session_encode(),flask_session_decode()(⚠️ There is no flask dependency in ctfbox itself, the following two functions need to install the dependency by yourself)build a simple file server:provide()burte force hash for ctf verification code:hashAuth()Send raw request by python-requests:httpraw()generate gopher reuqests:gopherraw()generate php serialize escape payload:php_serialize_escape,php_serialize_escape_s2l(),php_serialize_escape_l2s()change normal stirng to php serialize S string:php_serialize_S()php serializeserialize()unserialize()serialize_to_file()unserialize_from_file()...for more information, please check docstring andheregenerate php soapClient class payload for ssrf:soapclient_ssrf()network scanscan network path:scan()scan for network backup file:bak_scan()generate reverse shell command:reshell()use for out of band:OOB()build a server for blindXXE:blindXXE()generate gopher payload for attack rediswrite webshell:gopherredis_webshell()write crontab:gopherredis_crontab()ssh authorized keys:gopherredis_ssh()rce by master-slave replication:gopherredis_msr()generate gopher payload for attack fastcgiarbitrary code execution:gopherfastcgi_code()source code leaks, support .git .svn .DS_Store:leakdump()reverse mt_rand seed without brute force:reverse_mt_rand()REVERSEprint data in hex format:printHex()pack number into bytes:p16(),p32(),p64()unpack number from bytes:u16(),u32(),u64()MISCprovide common file signatures and function to patch a filepatch file signature:repair_fileheader()fix zip fake encrypt:repair_zip_fake_encrypt()CRYPTOsrand for multiple platforms:windows_srand(),linux_srand(),android_srand(),get random integer from multiple platforms:windows_rand(),linux_rand(),android_nextInt(),android_nextInt_bound()PWNUsage# Doesn't support Windowsfrompwnimport*# import pwntools# set pwntools config...# context.os = 'linux'# context.log_level = 'debug'# context.arch = 'amd64'fromctfbox.pwntools.configimportConfig# import confit for pwn part of ctfbox# set necessary config"""Attributes:- local(bool) : connect to local binary / remote address, default: True- bin(str)    : the binary path, e.g. './pwn'- address(str): the remote address, e.g. '127.0.0.1:2333'- pie(bool)   : whether the memory address is randomized, default: False"""Config.local=TrueConfig.address="127.0.0.1:2333"Config.bin="./bin"# import pwn partfromctfbox.pwnimport*now you can use the attributes/functions belowslog // empty dictionary, you can set the leaked address and corresponding name. e.g. slog['libc'] = libc_addr
elf  // pwntools.ELF(binaray)
cn   // a connect to local binary or remote address
re   // lambda of cn.recv(m, t)
recv // lambda of cn.recv()
ru   // lambda of cn.recvuntil(x)
rl   // lambda of cn.recvline()
sd   // lambda of cn.send(x)
sl   // lambda of cn.sendline(x)
ia   // lambda of cn.interactive()
sla  // lambda of cn.sendlineafter(a, b)
sa   // lambda of cn.sendafter(a, b)
ft   // ft(arg, f=pwnlib.util.cyclic.de_bruijn(), l=None) lambda of flat(*arg, filler=f, length=l)
gdba // gdba(bps) debug, argument bps save the breakpoint address, breakpoint can also be automatically set when pie is turned on, need pmap command
slog_show // print all set slogs, in hexadecimal formatTechniquespdmversion-helperDependsrequestsPyJWTpython-socketio[client]==4.6.0python-engineio==3.14.2ContributorsSycloverLongloneF4dedlingzepjxAFKLkodosanOtherMorouuLogs1.12.5fix a bug:utilscan't work1.12.0add a function:webgopherfastcgi_code1.11.0update some function:hashAuth: add prefix and suffix arguments1.10.0remove dependencies:python-socketio[client]==4.6.0python-engineio==3.14.2update some functions:printHexrewrite some functions:OOBadd some functions:cryptowindows_srandwindows_randlinux_srandlinux_randandroid_srandandroid_nextIntandroid_nextInt_bound1.9.0add some functions:force_url_encode1.8.0add some functions:php_serialize_S1.7.0update some functions:leakdumpupdate docstringsupport .DS_Storebetter error outputfix some bugsadd some functions:reverse_mt_rand1.6.0添加中文文档add some functions:leakdumpupdate some functions:get_flask_binupdate docstringprint_hexpretty output1.5.0add some functions:scanbak_scanreshellOOBblindXXEphp_serialize_escapegopherredis_webshellgopherredis_crontabgopherredis_sshgopherredis_msrrepair_fileheaderrepair_zip_fake_encryptbase16_encode, base16_decode, base32_encode, base32_decode, html_encode, html_decodeadd dependencies:python-socketio[client]==4.6.0python-engineio==3.14.21.4.2fix bugs:Threaderretry can't workupdate some functions:Threaderadd docstringadd task attributes: traceback1.4.1fix bugs:soapclient_ssrfdocstring about encode is errorencode arugment not workmd5can't importhashAuthcan't workreturn type incorrect1.4.0addallfor limit exportadd some functions:soapclient_ssrfrot_encodethirdparty: phpserialize(Origin)add tests:php_serialize_escape_l2sphp_serialize_escape_s2lhttprawupdate some functions:httprawadd kwargs: session, sendfix bugs:php_serialize_escape_l2scon't work correctlyhttprawurl irregularno headers will be sendpost data may be incorrect1.3.0refactor project structureadd some functions:flask_session_encodeflask_session_decodephp_serialize_escape_l2sphp_serialize_escape_s2lgopherraw1.2.1httpraw:fix a bug that httpraw may not be able to send post request correctlyfix a bug that could not solve portfix a bug that real_host could not usefix a bug that may cause encoding error1.2.0add dev dependencies: icecreamadd some functions:od_parseget_flask_pinhttprawp16 p32 p64 and uXX functionsBase32 and Base64 table getterv1.1.1move project to new directoryupdate Readme.md, added missing functionsv1.1.0add pwn part, please see Pwn Usageadd some functions that may be used in reverseupdate hashAuth functionserror if startIndex is less than endIndexif startIndex is zero and length of hash(endIndex - startIndex) is not equal to length of answer, endIndex will be set to length of answerupdate Readme.md, add usage and contributors, Supplementary dependency: PyJWTv1.0.2update Readme.mdV1.0.1update Readme.mdV1.0.0first commit