boy1337 bb33bb

	<html>
	<head>
	<title>0ctf sbx</title>
	</head>
	<body>
	<h1>HK</h1>
	<pre id='log'></pre>
	</body>
	<script src='./mojo_bindings.js'></script>
	<script src='./mojo_js/third_party/blink/public/mojom/tstorage/tstorage.mojom.js'></script>

	<html>
	<head>
	<title>RedPwn sbx-1</title>
	</head>
	<body>
	<h1>:thonk:</h1>
	<pre id='log'></pre>
	</body>
	<script src='./mojo_bindings.js'></script>
	<script src='./third_party/blink/public/mojom/desert.mojom.js'></script>

	<!DOCTYPE html>
	<html>
	<head>
	<title>Pwn2Win \| MessageKeeper</title>
	</head>
	<body>
	<script>
	let alphabet = "0123456789abcdef";

	const sleep = (ms) => {

	#include <stdio.h>
	#include <stdint.h>
	#include <stdlib.h>
	#include <mach/mach.h>
	#include <CommonCrypto/CommonCrypto.h>
	#include <ctype.h>

	void hexdump(void *ptr, int buflen) {
	unsigned char buf = (unsigned char)ptr;
	int i, j;

	function sleep( sleepDuration ){
	var now = new Date().getTime();
	while(new Date().getTime() < now + sleepDuration){ /* do nothing */ }
	}
	function gc() {
	for (let i = 0; i < 0x10; i++) {
	new ArrayBuffer(0x1000000);
	}
	}
	let data_view = new DataView(new ArrayBuffer(8));

	import requests
	import time
	import sys
	from base64 import b64encode
	from requests_ntlm2 import HttpNtlmAuth
	from urllib3.exceptions import InsecureRequestWarning
	from urllib import quote_plus

	requests.packages.urllib3.disable_warnings(category=InsecureRequestWarning)

	// Bugs by NSO Group / Ian Beer.
	// Exploit by Siguza & tihmstar.
	// Thanks also to Max Bazaliy.

	#include <stdint.h> // uint32_t, uint64_t
	#include <stdio.h> // fprintf, stderr
	#include <string.h> // memcpy, memset, strncmp
	#include <unistd.h> // getpid
	#include <mach/mach.h>
	#include <stdlib.h>