I hereby claim:
- I am wizche on github.
- I am wizche (https://keybase.io/wizche) on keybase.
- I have a public key ASC_r5yjNcxzYw33m1cJhRG04T-ANNkk0eU-m5epKyrFSAo
To claim this, I am signing this object:
| from scapy.all import * | |
| from scapy.layers.inet import IP, UDP | |
| from enum import Enum | |
| import logging | |
| logging.getLogger("scapy").setLevel(logging.DEBUG) | |
| BACNET_PORT = 47808 | |
| def bindLayers(): | |
| bind_layers(UDP, BVLC, sport=BACNET_PORT) |
| # Insomni'Hack CTF - Republic of Pancakes | |
| ## Intro | |
| Some informations about our target binary: | |
| ```sh | |
| $ file rop | |
| rop: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=a323ee2288744966a2dd2f942b4327541e767505, stripped | |
| ``` |
| import pefile | |
| import os | |
| search_path = "C:\Windows\System32" | |
| files = 0 | |
| totals = {} | |
| for file in os.listdir(search_path): | |
| if file.endswith(('.exe', '.dll')): | |
| pe = pefile.PE(os.path.join(search_path, file)) |
| //////////////////////////////////////////////////////////////////////////// | |
| // | |
| // The vulnerability was that the following line of code could change the type of the | |
| // underlying Array from JavascriptNativeIntArray to JavascriptArray: | |
| // | |
| // spreadableCheckedAndTrue = JavascriptOperators::IsConcatSpreadable(aItem) != FALSE; | |
| // | |
| // As can be seen in the provided .diff, the check for whether the type of the pDestArray has changed | |
| // was removed. If the aItem then is not a JavascriptArray, the following code path is taken: | |
| // else |
| ___ ____ ______ __ | |
| / | / __ \/ ___/ | / / | |
| / /| |/ / / /\__ \| | / / | |
| / ___ / /_/ /___/ /| |/ / | |
| /_/__||||||_//____/ |___/__ _____ __ _ __ | |
| / ____/ /_ ___ _____/ /_/ ___// /_ (_) /_ | |
| / / / __ \/ _ \/ ___/ __/\__ \/ __ \/ / __/ | |
| / /___/ / / / __/ /__/ /_ ___/ / / / / / /_ | |
| \____/_/ /_/\___/\___/\__//____/_/ /_/_/\__/ |
I hereby claim:
To claim this, I am signing this object:
| import java.util.Iterator; | |
| public abstract class BinaryTree<T> { | |
| public abstract int compareTo (T val1, T val2); | |
| //public abstract Nodo removeNode(Nodo r, T n); | |
| public class Node { | |
| private T val; |
| #include "Debug.h" | |
| #ifdef DEBUG_ENABLED | |
| const char *DEBUG_LEVEL_STRINGS[] = { "ERR", "WARN", "INFO", "TRACE" }; | |
| void DebugInternal(DEBUG_LEVEL_NS::DEBUG_LEVEL level, LPCSTR className, LPCSTR text) | |
| { | |
| if (level > DEFAULT_DEBUG_LEVEL) | |
| return; |
| <wicket:panel> | |
| <span wicket:id="first"></span> | |
| <a wicket:id="link"><span wicket:id="linkLabel"></span></a> | |
| <span wicket:id="second"></span> | |
| </wicket:panel> |