Aleksey Cherepanov
@jmp_AC
Followers
32
Following
2
Media
0
Statuses
21
I ❤️ FOSS, @Openwall, @john_users, CTFs. Opinions are my own. RTs don't imply agreement with points of view.
Joined October 2017
It was inspired by cool tasks about bash in CTFs:.minbashmaxfun in 34C3 CTF: only $()#!{}<',\.shjail in 33C3 CTF: lowercase letters, spaces, >.echoechoechoecho in Insomni'hack teaser 2019: uneasy limitations.
galhacktictrendsetters.wordpress.com
The goal of this challenge is to successfully run (in a shell on a provided server) a setuid binary flag which asks you to repeat a number, and then (if you repeat it successfully) outputs the flag…
0
0
1
'id' in posix shell using only 15 different chars (mostly punctuation and digit 2):.__=$(:&&(${=})2>&$(($$==$$)))$(:)&&__=${__##*:???}&&__=${__%??}&&${__#???????????}${__%???????????}.
1
0
1
'uname -a' with some garbage on stderr:. (";uname$"I"F"S"-a;")2>&1|sh.
1
0
0
Tricky `uname -a` in posix shell:. IFS=,;A=uname,-a;$A. A=I;B=F;C=S;D=$(($A$B$C=1));${@:-uname1-a}. ${$:+uname$((I``F``S=1))-a}. Tested on bash/dash/busybox. For shell injection without spaces with WAF blocking $IFS. #RedTeam #pentest #bugbounty.
1
0
0
Finding in @fluxfingers' CTF: node.js' http client translates hostname "localhost.xn--" (internationalized domain name / IDN) into "localhost.". So the hostname may bypass some filter/WAF to get better SSRF.
0
0
1
Interesting interaction of scoping rules and exec in Python 3.8.2:.a = 2.def f(): exec('a = 1; print([ x for x in [ a ] ])').def g(): exec('a = 1; print([ a for x in [ a ] ])').f() # prints [1].g() # prints [2].
0
0
0
OCaml code 'let r = (let x = 1 and y = 2 in x + y);;' may be represented in Python very well abusing decorators:.@ apply.def r():. x = 1. y = 2. return x + y.
0
0
0
RT @jmp_AC: @phdays Thanks! Congratulations to all participants of #PHDays Best Reverser 2019! My writeup (in Russian). tl;dr: modify emu t….
gist.github.com
Write-up for Best Reverser contest at PHDays 9 (2019) - README.md
0
1
0
Some binaries have __libc_csu_init embedded. On x86-64, it has 2 gadgets (G1 & G2) to invoke slots with ROP:.G1:.mov rdx,r13.mov rsi,r14.mov edi,r15d.call QWORD PTR [r12+rbx*8].add rbx,0x1.cmp rbx,rbp.jne G1.add rsp,0x8.G2:.pop rbx.pop rbp.pop r12.pop r13.pop r14.pop r15.ret.
0
0
0
RT @jmp_AC: @ZeroNights #HackQuest Day 6 Writeup (in Russian) tl;dr: fit read(0,buf,N) into one number for simplicity .
gist.github.com
Write-up for Day 6 of ZeroNights HackQuest 2017. GitHub Gist: instantly share code, notes, and snippets.
0
5
0
RT @ZeroNights: Day 6 is finished. The winners are: 1. @jmp_AC 2. smalukav 3. @__paulch.The last task is already started (prepared by @scho….
0
4
0