Jihwan Kim mdsnins

## linectf2021_bb.md

      
              1 file
            
          
              0 forks
            
          
                0 comments
              
            
              2 stars
            
          
                mdsnins
                / linectf2021_bb.md
            
            
              Last active
              March 27, 2022 06:13
            
              
                [LINE CTF 2021] bb
              
          
    bb

LINECTF 2021 - Web

Writeup by Payload as Super HexaGoN
BASH_ENV envrionment

We can inject some bash command line using environment BASH_ENV.
BASH_ENV=touch /tmp /bin/bash will execute touch.

  
## linectf2021_haribote.md

      
              1 file
            
          
              0 forks
            
          
                0 comments
              
            
              0 stars
            
          
                mdsnins
                / linectf2021_haribote.md
            
            
              Created
              March 26, 2022 23:09
            
              
                [LINE CTF 2021] Haribote-Secure-Note
              
          
    Haribote-Secure-Note

LINECTF 2021 - Web

Writeup by Payload as Super HexaGoN
CSP

This page, CSP was applied. Since nonce- directive is given, we should reuse exisitng valid-nonce script tags.
Two Injection Point


## linectf2021_me7ball.md

      
              1 file
            
          
              0 forks
            
          
                0 comments
              
            
              0 stars
            
          
                mdsnins
                / linectf2021_me7ball.md
            
            
              Created
              March 26, 2022 23:19
            
              
                [LINE CTF 2021] Haribote-Secure-Note
              
          
    Me7-ball

LINECTF 2021 - Web

Writeup by Payload as Super HexaGoN
Free list

When the chunk is deleted or updated with larger size, it frees the chunk and add to empty list with the original size.
Size Confusion


## py-universe-sample-01.py
from universe import *
from universe import config

sess = UserSession(access_token = config.TEST_ACCESS_TOKEN)
vod_mod = VODModule(sess)
fns_mod = FNSModule(sess)

print("\n\nLoad VODs")
# Load all VODs
vod_mod.LoadSeries(9) #IZ*ONE
	from universe import *
	from universe import config

	sess = UserSession(access_token = config.TEST_ACCESS_TOKEN)
	vod_mod = VODModule(sess)
	fns_mod = FNSModule(sess)

	print("\n\nLoad VODs")
	# Load all VODs
	vod_mod.LoadSeries(9) #IZ*ONE