wliment

Exploiting Lua 5.1 on 32-bit Windows

The following Lua program generates a Lua bytecode program called ignore-unsigned-sga.fnt, which in turn loads a DLL from within an extremely locked down Lua 5.1 sandbox in a program called RelicCOH2.exe. The remainder of this document attempts to explain how this program works by a whirlwind tour of relevent bits of the Lua 5.1 virtual machine.

if string.dump(function()end):sub(1, 12) ~= "\27Lua\81\0\1\4\4\4\8\0" then
  error("This generator requires a 32-bit version of Lua 5.1")
end

local function outer()
  local magic -- In bytecode, the stack slot corresponding to this local is changed

wliment

import java.awt.Color;
import java.awt.Font;
import java.awt.Graphics;
import java.awt.image.BufferedImage;
import java.util.Random;

import javax.imageio.ImageIO;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

wliment

{"lastModified":1511344904034,"labels":[{"name":"hack","id":1511344894735,"repos":[4793392]},{"id":1511344904033,"name":"sql","repos":[4793392]}]}

wliment

jQuery.isBlank = function (obj) {
    if (!obj || $.trim(obj) === "") return true;
    if (obj.length && obj.length > 0) return false;

    for (var prop in obj) if (obj[prop]) return false;
    return true;
};

wliment

#!/usr/bin/python

# Quick and dirty demonstration of CVE-2014-0160 by Jared Stafford ([email protected])
# The author disclaims copyright to this source code.

import sys
import struct
import socket
import time
import select

wliment

StackTraceElement[] stackTraceElements = Thread.currentThread().getStackTrace() According to the Javadocs:  The last element of the array represents the bottom of the stack, which is the least recent method invocation in the sequence.  A StackTraceElement has getClassName(), getFileName(), getLineNumber() and getMethodName().  You will have to experiment to determine which index you want (probably stackTraceElements[1] or [2]).

wliment

find .  -type f -name '*.java' -exec bash -c "enca -L zh_CN {}|grep UTF-8 > /dev/null && enconv -L zh_CN -x GB2312 {}" \;

wliment

CREATE OR REPLACE TYPE zh_concat_im
AUTHID CURRENT_USER AS OBJECT
(
  CURR_STR clob,
  STATIC FUNCTION ODCIAGGREGATEINITIALIZE(SCTX IN OUT zh_concat_im) RETURN NUMBER,
  MEMBER FUNCTION ODCIAGGREGATEITERATE(SELF IN OUT zh_concat_im,
  P1 IN VARCHAR2) RETURN NUMBER,
  MEMBER FUNCTION ODCIAGGREGATETERMINATE(SELF IN zh_concat_im,
  RETURNVALUE OUT clob,
  FLAGS IN NUMBER)

wliment

var fs = require('fs')
    , http = require('http')
    , socketio = require('socket.io')
    , request = require('request')
var server = http.createServer(function(req, res) {
    res.writeHead(200, { 'Content-type': 'text/html'});
    res.end(fs.readFileSync(__dirname + '/index.html'));
}).listen(8080, function() {
    console.log('Listening at: http://localhost:8080');
});

wliment

object.hasOwnProperty