ulidtko

Exploiting Lua 5.1 on x86_64

The following Lua program generates a Lua bytecode program called lua-sandbox-rce.luac, which in turn spawns a shell from within Lua 5.1 sandbox. The remainder of this document attempts to explain how this program works by a whirlwind tour of relevent bits of the Lua 5.1 virtual machine.

function outer()
  local magic -- In bytecode, the stack slot corresponding to this local is changed
  local function middle()
    local co, upval
    local ub1 = {[0] = -- Convert uint8_t to char[1]

ulidtko

#!/usr/bin/env python3
import os, sys
import argparse
import struct
from functools import reduce

"""
QNAP QTS firmware encryptor/decryptor.

Based on https://pastebin.com/KHbX85nG

ulidtko

#!/bin/bash

test -x $(which inotifywait 2>/dev/null) || {
    echo "Install inotifywait(1) -- usually in package called inotify-tools"
    exit 1
}

#-- Uncomment to run with all sleeps disabled, for extra fun!
#sleep () { : noop; }

ulidtko

#!/usr/bin/env python

"""
To get installed plugins list, open Script Console on /script, and run:

    def pluginList = new ArrayList(Jenkins.instance.pluginManager.plugins)
    pluginList.sort { it.getShortName() }.each{
      plugin ->
        println ("${plugin.getShortName()}:${plugin.getVersion()}  --  ${plugin.getDisplayName()}")
    }

ulidtko

#!/usr/bin/env python

"""
License file (de)cryptor for AntennaHouse Formatter https://www.antennahouse.com/formatter-v7
"""

import argparse
import itertools
import struct
import sys

ulidtko

#!/usr/bin/env python3

"""
Quote stdin line containing the Nth character, in absolute offset,
counting each newline as a character too.

Inspired by https://stackoverflow.com/a/79399803/531179

In the name José João in this file, accents are on offsets +210 and on +214.
"""

ulidtko

# Linux udev rule file for Logitech F710 gamepads.
# Written by: Max <ulidtko@gmail.com> in year 2020.
# SPDX-License-Identifier: MIT
#
# ================================================================================
# On the gamepad, put the D ↔ X switch into the right, X position ("XInput Mode")!
# ================================================================================
#
# You can test the gamepad using jstest or jstest-gtk.
# You can test force-feedback (rumble, vibration) using fftest.

ulidtko

import dataclasses
import datetime
import re
import socket
import socketserver
import time


class config:
    SOCKET_TIMEOUT = 10

ulidtko

#!/usr/bin/env python

"""
Use TOTP secret with RFC6238 algorithm for AWS MFA login.

$AWS_PROFILE is expected to be set, naming a section in ~/.aws/credentials

That same section must also contain 2 extra values for this script:

[my-awesome-shiny-aws-account]

ulidtko

module Foo where

test_Foo = undefined