Al Azif Al-Azif

## Exploiting Lua 5.1 bytecode.md

      
        
          
            
              
              2 files
            
          
          
            
              
              4 forks
            
          
            
              
                
                11 comments
              
            
          
            
              
              24 stars
            
          
        
        
          
              
          
          
            
                ulidtko
                / Exploiting Lua 5.1 bytecode.md
            
            
              Last active
              June 23, 2025 04:45
                — forked from corsix/Exploiting Lua 5.1 on 32-bit Windows.md
            
          
        
      
        
  
      
    Exploiting Lua 5.1 on x86_64

The following Lua program generates a Lua bytecode program called lua-sandbox-rce.luac, which in turn spawns a shell from within Lua 5.1 sandbox. The remainder of this document attempts to explain how this program works by a whirlwind tour of relevent bits of the Lua 5.1 virtual machine.
function outer()
  local magic -- In bytecode, the stack slot corresponding to this local is changed
  local function middle()
    local co, upval
    local ub1 = {[0] = -- Convert uint8_t to char[1]