aglab2

Vulnerable emulator is Project 64 1.6.x/1.7. 2 vulnerabilities can be used to gain arbitrary code execution from emulation container from N64 ROM.

1. Container escape and arbitrary writes from N64 ROM outside of designated N64 RAM

Vulnerable function Compile_R4300i_SB and its friends Compile_R4300i_S* https://github.com/zeromus/pj64/blob/master/RecompilerOps.cpp#L1955C6-L2024

If non const Opcode.base is used to avoid condition at 1961-1971 which does checks properly, we can load from volatile address addr (compiled to MIPS asm inside ROM):

mechaneyes

AI Image Generators

Midjourney

https://www.midjourney.com/home?callbackUrl=/explore

Midlibrary

https://midlibrary.io/midlibrary/inside

Andrei Kovalev's Midlibrary is a carefully curated collection of hand-picked Midjourney Styles and a Midjourney Guide

Siss3l

Sealed Note

• Category: Web
• Alone: (0 solve)

Description

We have access to a web challenge allowing us to create, read and send notes to a Puppeteer bot:

win3zz

Download Dependencies

user@hostname:~$ mkdir velocity-engine
user@hostname:~/velocity-engine$ wget https://dlcdn.apache.org/velocity/engine/2.3/velocity-engine-core-2.3.jar
user@hostname:~/velocity-engine$ wget https://dlcdn.apache.org/velocity/engine/2.3/velocity-engine-scripting-2.3.jar
user@hostname:~/velocity-engine$ wget https://dlcdn.apache.org/velocity/engine/2.3/spring-velocity-support-2.3.jar
user@hostname:~/velocity-engine$ wget https://repo1.maven.org/maven2/org/slf4j/slf4j-api/2.0.9/slf4j-api-2.0.9.jar
user@hostname:~/velocity-engine$ wget https://repo1.maven.org/maven2/org/apache/commons/commons-lang3/3.13.0/commons-lang3-3.13.0.jar
user@hostname:~/velocity-engine$ cd ..
user@hostname:~$

win3zz

user@hostname:~/exploit$ cat > test.c

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main() {
    if (setuid(0) != 0) {

rebane2001

Hack.lu CTF 2023 - Safest Eval (Python jail escape)

Challenge by: realansgar
Writeup by: rebane2001

Overview

The challenge consists of a simple Flask webapp that lets you eval arbitrary Python code in a jail in order to evaluate your solution to a leetcode-style programming challenge. The flag can be retrieved by running the /readflag setuid program. The source code was provided.

ljnmedium

chatdoc = ChatDoc(model_name= OPENAI_MODEL)
chatdoc.connect_openai_api()

questions = QUESTIONS_COMMITTE_AUDIT
retriever.retreive_with_query( query, top_k=1, namespace='Eiffage')
contexts = loader_document.retreive_contents_from_ids(ids)
respone = chatdoc.prompt_with_context(query, contexts= list(contexts.values()), verbose=True)
print(query,'\n', respone, '\n')

simonw

I got GPT-4 Code Interpreter to write most of this for me, transcript here

I had to modify it a tiny bit to get it to run, the parameters for the queries were missing.

Results on my M2 MacBook Pro:

---------------
Mode | Scenario | Update QPS | Select QPS
---------------

Siss3l

Intigriti July Challenge

• Category: Web
• Impact: Medium
• Solves: 35

Description

arkark

Google CTF 2023 - web/Biohazard

• 14 solves / 333 pts
• CTFtime: https://ctftime.org/event/1929
• Official repository: https://github.com/google/google-ctf/tree/master/2023/web-biohazard ¹

Summary writeup

Footnotes

1. I predict that this URL will be broken because the directory structure will change when the final round source code is released, as in previous years 😅 ↩