Sergio Paganoni wizche

wizche / exploit.js

Created March 22, 2021 13:45 — forked from eboda/exploit.js

Exploit for Chakrazy challenge from PlaidCTF 2017 - ChakraCore exploit

	////////////////////////////////////////////////////////////////////////////
	//
	// The vulnerability was that the following line of code could change the type of the
	// underlying Array from JavascriptNativeIntArray to JavascriptArray:
	//
	// spreadableCheckedAndTrue = JavascriptOperators::IsConcatSpreadable(aItem) != FALSE;
	//
	// As can be seen in the provided .diff, the check for whether the type of the pDestArray has changed
	// was removed. If the aItem then is not a JavascriptArray, the following code path is taken:
	// else

wizche / asov_checkshit_singlefile.txt

Created December 15, 2019 08:16 — forked from andreafioraldi/asov_cheatshit_singlefile.txt