from pwn import * local = 0 pc = './chal' aslr = True context.log_level = "debug" libc = ELF('./libc.so.6') elf = ELF(pc) if local == 1: #p = process(pc,aslr=aslr,env={'LD_PRELOAD': './libc.so.6'}) p = process(pc,aslr=aslr) else: remote_addr = ['wfw1.2023...
这篇文章是我第一次接触V8的漏洞分析,从环境搭建开始,分析了题目中提供的代码,对涉及到的javascript和v8知识点进行了简单介绍,同时针对存在的OOB漏洞,从最终目的——写入执行shellcode——倒退分析,最终一步步达到目标,并与saelo大神提出的addrof和fakeobj概念进行了对照介绍。
pwn-kconcat pwn-storygen pwn-ubf pwn-watthewasm pwn-write-flag-where pwn-write-flag-where2 pwn-write-flag-where3 rev-auxin rev-flangton rev-jxl rev-oldschool rev-png2 rev-turtle rev-zermatt sandbox-fastbox sandbox-gvisor sandbox-lightbox sandbox-v8box web-biohazard web-noteninja web-post...
2018 open source pwn-mojo from finals 2018 Jul 1, 2019 2019 Fixed typo : seperate-> separate (google#53) Jun 8, 2022 2020 Adding Hackceler8 2020 resources Jun 18, 2021 2021 Fix broken link (google#54) Jun 8, 2022 2022 Adding YouTube challenge from H4CK1NG G00GLE Dec 6, 2022 2023...
https://github.com/google/google-ctf/tree/master/2018/finals/pwn-just-in-time/ 环境搭建 我有点懒,就用xcode调了。 V8 version 7.2.0 (candidate) gn gen out/gn --ide="xcode" patch -p1 < ./addition-reducer.patch cd out/gn open all.xcworkspace/ 编译 特性 max safe integer range of doub...
https://github.com/google/google-ctf/tree/master/2018/finals/pwn-just-in-time/ 环境搭建 我有点懒,就用xcode调了。 V8 version 7.2.0 (candidate) gn gen out/gn --ide="xcode" patch -p1 < ./addition-reducer.patch cd out/gn open all.xcworkspace/ 编译 特性 max safe integer range of doub...
from pwn import * elf_path = "./chal" ip = "gradebook.2023.ctfcompetition.com" port = "1337" content = 0 context(os='linux',arch='amd64') if content == 1: os.system('tmux set mouse on') context.terminal = ['tmux','splitw','-h'] # p = process(elf_path) p_fake = pr...
5 参考 https://github.com/ray-cp/browser_pwn/tree/master/v8_pwn/google-ctf2018-final-just-in-time https://doar-e.github.io/blog/2019/01/28/introduction-to-turbofan/#preparing-turbolizer https://xz.aliyun.com/t/3348#toc-1 https://www.jianshu.com/p/db78899fcd5f ...
可以看到,每次连接,我们可以选择和一个服务端通信,也可以选择和一个客户端通信。服务端和客户端共享一个password,flag在服务端。当然,我们可以把服务端的数据转发给客户端,把客户端数据转发给服务端,而且能任意修改这些数据再转发,相当于一个中间人。 Client ...
通过这个 payload,我们就可以将如下 HTML 加到 DOM: 绕过CSP 由于主页面的 CSP 只能加载同源脚本,很显然,我们此时唯一能利用的页面是/sandobox?html=。然而它会在 js 代码前添加 html 标签,导致代码不合法。我想,能不能通过更改javascript 的字符集来绕过了?如果我们把/sandbox?html=的输出设置为 UTF-16BE,那么...