from pwn import * local = 0 pc = './chal' aslr = True context.log_level = "debug" libc = ELF('./libc.so.6') elf = ELF(pc) if local == 1: #p = process(pc,aslr=aslr,env={'LD_PRELOAD': './libc.so.6'}) p = process(pc,aslr=aslr) else: remote_addr = ['wfw1.2023...
pwn-kconcat pwn-storygen pwn-ubf pwn-watthewasm pwn-write-flag-where pwn-write-flag-where2 pwn-write-flag-where3 rev-auxin rev-flangton rev-jxl rev-oldschool rev-png2 rev-turtle rev-zermatt sandbox-fastbox sandbox-gvisor sandbox-lightbox sandbox-v8box web-biohazard web-noteninja web-post...
2018 open source pwn-mojo from finals 2018 Jul 1, 2019 2019 open source web-gphotos Nov 22, 2019 2020/quals Open source 2020 quals challenges Sep 11, 2020 infrastructure Move to kctf repo Feb 25, 2020 other/re-risky Adding an old guest challenge made for Winja CTF Nov 28, 2019 third...
from pwn import * elf_path = "./chal" ip = "gradebook.2023.ctfcompetition.com" port = "1337" content = 0 context(os='linux',arch='amd64') if content == 1: os.system('tmux set mouse on') context.terminal = ['tmux','splitw','-h'] # p = process(elf_path) p_fake = pr...
这篇文章是我第一次接触V8的漏洞分析,从环境搭建开始,分析了题目中提供的代码,对涉及到的javascript和v8知识点进行了简单介绍,同时针对存在的OOB漏洞,从最终目的——写入执行shellcode——倒退分析,最终一步步达到目标,并与saelo大神提出的addrof和fakeobj概念进行了对照介绍。
https://github.com/JeremyFetiveau/pwn-just-in-time-exploit但是后期用这个版本调试的时候出现了点问题方法3同时也可以使用博客上的build.sh文件https://github.com/google/google-ctf/tree/master/2018/finals/pwn-just-in-time简单分析一下build.sh文件...
querySelector()只匹配一个元素,我们只要加一个额外的,就可以绕过过滤器: 通过这个 payload,我们就可以将如下 HTML 加到 DOM: 绕过CSP
可以看到,每次连接,我们可以选择和一个服务端通信,也可以选择和一个客户端通信。服务端和客户端共享一个password,flag在服务端。当然,我们可以把服务端的数据转发给客户端,把客户端数据转发给服务端,而且能任意修改这些数据再转发,相当于一个中间人。 Client ...
[0]; } let AB_LENGTH = 0x100; let AB_LENGTH_64 = 0x0000010000000000; let OOB_LENGTH_64 = 0x0000006400000000; let MARKER1 = 0x11; let MARKER1_64 = 0x0000001100000000; function pwn(x) { let bug_arr = [1.1, 1.1, 1.1, 1.1, 1.1]; oob_arr = [2.2, 2.2]; obj_arr = [MARKER1,...
这篇文章是我第一次接触V8的漏洞分析,从环境搭建开始,分析了题目中提供的代码,对涉及到的javascript和v8知识点进行了简单介绍,同时针对存在的OOB漏洞,从最终目的——写入执行shellcode——倒退分析,最终一步步达到目标,并与saelo大神提出的addrof和fakeo...