Bertrand Mansion golgote

Exploiting Lua 5.1 on 32-bit Windows

The following Lua program generates a Lua bytecode program called ignore-unsigned-sga.fnt, which in turn loads a DLL from within an extremely locked down Lua 5.1 sandbox in a program called RelicCOH2.exe. The remainder of this document attempts to explain how this program works by a whirlwind tour of relevent bits of the Lua 5.1 virtual machine.

if string.dump(function()end):sub(1, 12) ~= "\27Lua\81\0\1\4\4\4\8\0" then
  error("This generator requires a 32-bit version of Lua 5.1")
end

local function outer()
  local magic -- In bytecode, the stack slot corresponding to this local is changed

	-- For use with https://github.com/fperrad/lua-MessagePack
	-- Usage:
	-- local mp = require "MessagePack"
	-- local MP = mp_magic(mp)
	-- mp.pack{ this_is_a_string = MP{binary = "this_is_a_binary"} }

	local mp_magic = function(mp)
	if mp.mpmagic then return mp.mpmagic end
	local mp_mt = {}
	local new = function(t) return setmetatable(t, mp_mt) end

	Host *
	ControlPersist yes
	ControlMaster auto
	ControlPath /tmp/ssh-%r@%h:%p
	ServerAliveInterval 60

	<!-- Facebook Custom Audience Pixel Code - Placed on Every Page of Site -->
	<script>
	!function(f,b,e,v,n,t,s){if(f.fbq)return;n=f.fbq=function(){n.callMethod?
	n.callMethod.apply(n,arguments):n.queue.push(arguments)};if(!f._fbq)f._fbq=n;
	n.push=n;n.loaded=!0;n.version='2.0';n.queue=[];t=b.createElement(e);t.async=!0;
	t.src=v;s=b.getElementsByTagName(e)[0];s.parentNode.insertBefore(t,s)}(window,
	document,'script','//connect.facebook.net/en_US/fbevents.js');
	fbq('init', '{{facebook pixel}}');
	fbq('track', 'PageView');
	</script>

	/*
	* derivative work of Matheus de Oliveira's json_manipulator.sql
	* https://gist.github.com/matheusoliveira/9488951
	*
	* adapted to support postgresql 9.4 jsonb type
	* no warranties or guarantees of any kind are implied or offered
	*
	* license is as Matheus conferred it on 4/9/2015:
	* matheusoliveira commented on Apr 9
	* @hannes-landeholm, I'd like to take credit if you share them

	static int handleNilIndexing (lua_State* luaState)
	{
	return 0; // zero return values is equivalent to returning nil
	}

	lua_State* setupLua()
	{
	// Create the new lua state
	lua_State* luaState = luaL_newstate();

	/global ko, Chart /

	(function(ko, Chart) {

	ko.bindingHandlers.chartType = {
	init: function(element, valueAccessor, allBindings, viewModel, bindingContext) {
	if (!allBindings.has('chartData')) {
	throw Error('chartType must be used in conjunction with chartData and (optionally) chartOptions');
	}
	},

	(function (factory) {
	'use strict';
	if (typeof define === 'function' && define.amd) {
	define(['knockout','jquery','selectize'], factory);
	} else {
	var selConstructor = (typeof selectize != "undefined")?selectize:$('<select>').selectize().data('selectize').constructor;
	factory(ko,$,selConstructor);
	}
	})(function (ko,$,selectize) {

	WITH RECURSIVE tables_tree (table_oid, path) AS (
	SELECT I.inhparent AS table_oid, '{}'::oid[] AS path
	FROM pg_inherits I
	LEFT JOIN pg_inherits I2 ON I.inhparent = I2.inhrelid
	WHERE I2.inhparent IS NULL

	UNION

	SELECT I.inhrelid, TT.path \|\| I.inhparent
	FROM pg_inherits I

	var inject_binding = function (allBindings, key, value) {
	//https://github.com/knockout/knockout/pull/932#issuecomment-26547528
	return {
	has: function (bindingKey) {
	return (bindingKey == key) \|\| allBindings.has(bindingKey);
	},
	get: function (bindingKey) {
	var binding = allBindings.get(bindingKey);
	if (bindingKey == key) {
	binding = binding ? [].concat(binding, value) : value;