ChrisPritchard

Exploit Title: Silverpeas CRM - Authentication Bypass

Date of found: 12/05/2024

Exploit Author: Chris Pritchard chris@grislygrotto.nz

Version: V1.0

Tested on: 6.3.4

Fixed in: 6.3.5

Vendor Homepage: https://silverpeas.org/

Software Link: https://silverpeas.org/

CVE: CVE-2024-36042

CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36042

ChrisPritchard

using System;
using System.Net;
using System.Net.Sockets;
using System.Text;

class SynPacketSender
{
    static void Main(string[] args)
    {
        string sourceIp = "192.168.68.68"; // Your IP address

ChrisPritchard

Pwntools Cheatsheet

1. Program Interaction
2. Environment and Contexts
3. Logging and Output
4. Encoding, Packing and Utility
5. Assembly and Shellcraft
6. ELFs, Strings and Symbols
7. Return Oriented Programming
8. SROP and Sigreturn Frames

ChrisPritchard

PHP filter bypass - no letters or quotes

For the 2021 hack the box cyberpocalypse ctf, there was a web challenge called pcalc that included this filter:

if (strlen($formula) >= 100 || preg_match_all('/[a-z\'"]+/i', $formula)) {
    return '🤡 dont bite the hand that feeds you human 🤡';
}
try {
    eval('$pcalc = ' . $formula . ';');

ChrisPritchard

using System.Collections.Generic;
using Godot;

public partial class CubeTest : Node3D
{
    private MeshInstance3D meshInstance;

    private static readonly Color[] colour_set = [Colors.Red, Colors.Green, Colors.Blue, Colors.Yellow];

    const int tower_width = 20;

ChrisPritchard

shader_type canvas_item;

uniform float aspect_ratio: hint_range(0.1, 1.9, 0.1) = 1.0;

group_uniforms line_characteristics;

uniform float line_width: hint_range(0.001, 0.1) = 0.01;
uniform int segment_count: hint_range(0, 10, 1) = 5;
uniform float segment_length: hint_range(0.1, 1.0, 0.01) = 0.2;
uniform float tail_lag: hint_range(0.1, 1.0, 0.01) = 0.4;

ChrisPritchard

using Godot;

[Tool]
public partial class NoiseAtlasGenerator : Node
{
    [Export]
    public NoiseTexture3D NoiseGenerator { get; set; }

    [Export(PropertyHint.SaveFile, hintString: "*.png")]
    public string SavePath { get; set; }

ChrisPritchard

[Tool]
public partial class ConfigLoader : Node
{
    public static GameConfig Config { get; private set; }

    private string config_path;
    [Export(PropertyHint.File, hintString: "*.yml")]
    public string ConfigPath
    {
        get => config_path; set

ChrisPritchard

shader_type canvas_item;

uniform vec4 line_colour : source_color = vec4(1.0); // default = white
uniform float line_thickness : hint_range(0, 0.1) = 0.04; // the max distance from a transparent fragment to search for an opaque pixel - effectively the line width as named
uniform float border_visibility : hint_range(0, 1) = 1.0; // control to fade border in and out
uniform float gradient_intensity : hint_range(0, 5) = 3; // controls how quickly the gradient falls off
uniform float gradient_steps : hint_range(1, 20) = 10; // controls the 'fineness' of the gradient

// the directions to search for an opaque pixel - each a point on the unit circle (full distance multiplies this by line_thickness)
// more directions = more accurate detection = better results around curved edges or corners

ChrisPritchard

shader_type spatial;
render_mode blend_mix, depth_draw_always, cull_back, unshaded;

group_uniforms textures;

uniform sampler2D albedo_texture;

group_uniforms hologram;

uniform float opacity : hint_range(0.0, 1.0) = 0.35;