Jinmo

/*
 * Copyright (c) 1996, 1998, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Oracle designates this
 * particular file as subject to the "Classpath" exception as provided
 * by Oracle in the LICENSE file that accompanied this code.
 *

ValdikSS

==========================================================================
              DO NOT WRITE ANY QUESTIONS IN COMMENTS
==========================================================================
 This is not appropriate place for discussions. Keep this list FW-only.
 I do NOT have any firmware files apart from published here or on 4pda. Please do not contact me for firmware files requests.


This is a list of files found on Huawei update server by brute-forcing URL parameters.  
Some firmware files have changelogs. Just change file name to "changelog.xml" in the end of the URL.

icecr4ck

IDA Microcode notes

References

• Ilfak's presentation at Recon 2018
• Microcode in pictures
• Hex-Rays Microcode API vs. Obfuscating Compiler
• Scripts vds10, vds11, vds12 and vds13 from Hex-Rays SDK

Implementation

loknop

Solving "includer's revenge" from hxp ctf 2021 without controlling any files

The challenge

The challenge was to achieve RCE with this file:

<?php ($_GET['action'] ?? 'read' ) === 'read' ? readfile($_GET['file'] ?? 'index.php') : include_once($_GET['file'] ?? 'index.php');

Some additional hardening was applied to the php installation to make sure that previously known solutions wouldn't work (for further information read this writeup from the challenge author).

I didn't solve the challenge during the competition - here is a writeup from someone who did - but since the idea I had differed from the techniques used in the published writeups I read (and I thought it was cool :D), here is my approach.

stypr

import os
import time
import uuid
import requests
requests.packages.urllib3.disable_warnings()

headers = {
    "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0",
    "Accept": "application/json, text/plain, */*",
    "Accept-Language": "en-US,en;q=0.5",