Eric Hsieh doraeric

Bypass disable-devtool

(Working as of 2025-02-09)

There are websites that use disable-devtool to prevent you from opening or using devtools. They typically prevent you from right clicking or using the keyboard shortcut to open devtools. Even if you successfully do so, they detect it and redirect you elsewhere. You can bypass this by using one of the following ways.

Opening devtools

If the shortcut F12 on Windows or Option + ⌘ + I on Mac do not work. Press the three vertically aligned dots in the top right corner of your Google Chrome or Microsoft Edge window. Under the section "More Tools", you'll see the option to select "Developer Tools" which opens the toolkit in your window.

`mitmproxy`

How-to man-in-the-middle your own application's traffic for debugging. Below is a quick step-by-step guide to putting mitmproxy between your hard-to-debug application's HTTP(s) network traffic and its destinations. Allowing you to spy on all requests, as well as modify and replay them. Theres a nice blog post with more screenshots and some explanation behind mitm-ing available here: https://earthly.dev/blog/mitmproxy/

1. Install dependencies

global-agent - Global node proxy configuration via environment variables (npm) Optional - only necessary for proxying local node scripts/apps that don't have an explicit proxy option. a. $ npm i -g global-agent
mitmproxy - Popular opensource python man-in-the-middle proxy with web interface (homepage)

0ctf babystack with return-to dl-resolve

In this write-up I will discuss how I managed to solve the challenge "babystack" from 0ctf with a technique called return to dl-resolve. I did not know this kind of return-to attack before the contest. In the following sections a detailed explanation of the entire exploit will be presented.

1. Binary analysis

I downloaded the provided binary babystack and quickly fired up binaryninja alongside with gdb to analyze it. I quickly realized a buffer overflow vulnerability is present within sub_804843b. My first approach was to solve this challenge using a return-to-libc attack by leaking the base address of the library and call system in order to get a shell.
This technique is contingent on:

Leaking libc base address
Knowing the version of libc to get the offset of system.

However, the version of libc on the remote server was unknown and the ELF did not provide any function that can be us

README

Create a template service file at /etc/systemd/system/[email protected]. The template parameter will correspond to the name of target host:

[Unit]
Description=Setup a secure tunnel to %I
After=network.target

How to mount a qcow2 disk image

This is a quick guide to mounting a qcow2 disk images on your host server. This is useful to reset passwords, edit files, or recover something without the virtual machine running.

Step 1 - Enable NBD on the Host

modprobe nbd max_part=8

Intro

The plan is to create a pair of executables (ngrok and ngrokd) that are connected with a self-signed SSL cert. Since the client and server executables are paired, you won't be able to use any other ngrok to connect to this ngrokd, and vice versa.

DNS

Add two DNS records: one for the base domain and one for the wildcard domain. For example, if your base domain is domain.com, you'll need a record for that and for *.domain.com.

Different Operating Systems

1. Clone your fork:

git clone [email protected]:YOUR-USERNAME/YOUR-FORKED-REPO.git

2. Add remote from original repository in your forked repository:

cd into/cloned/fork-repo
git remote add upstream git://github.com/ORIGINAL-DEV-USERNAME/REPO-YOU-FORKED-FROM.git
git fetch upstream

	# Setting Up ExpressVPN (OpenVPN) On OSMC

	## References

	- [Brian Hornsby' Kodi OpenVPN plugin](http://brianhornsby.com/blog/how-to-setup-your-vpn-client)
	- [Install and Configure OpenVPN on OSMC/Kodi](https://nerddrivel.com/2016/03/25/install-and-configure-openvpn-on-osmckodi/)
	- [ExpressVPN - High speed, ultra secure, and easy to use. Instant setup.](https://www.expressvpn.com/)
	- [[HOWTO] OSMC/Rasp Pi as OpenVPN client](https://discourse.osmc.tv/t/howto-osmc-rasp-pi-as-openvpn-client/1844/71)

	## Steps

	/* WITH MODS TO ORIG -- iOS Browser Bookmarklets to launch other apps and stuff */
	/* ver 2014-04-14a */
	/* backing up my "Open In" bookmarks */
	// note iOS6 requires some changes to these

	// BEGIN TESTING STUFF -- IN PROFRESS LIKELY NOT WORKING
	// SOME WORK, MOST tests are not WORK --

	// PINNER APP TEST STUFF (as a private one)
	// the page title as the title and your selected text as the description.

	#It's not directly mentioned in the documentation on how to do this, so here you go. This command will tunnel everything including DNS:
	sshuttle --dns -vr [email protected] 0/0 --ssh-cmd 'ssh -i /your/key/path.pem'