Skip to content

Instantly share code, notes, and snippets.

View maple3142's full-sized avatar

maple maple3142

816 followers · 39 following
View GitHub Profile
@shigenobuokamoto
shigenobuokamoto / for2.3.11-network-mirrored.service
Last active September 27, 2024 13:53
network-mirrored.service.2.3.11
[Unit]
Wants=network-pre.target
Before=network-pre.target shutdown.target
[Service]
User=root
ExecStart=/bin/sh -ec '\
[ -x /usr/bin/wslinfo ] && [ "$(/usr/bin/wslinfo --networking-mode)" = "mirrored" ] || exit 0;\
echo 1 > /proc/sys/net/ipv4/conf/all/route_localnet;\
nft add rule ip nat WSLPOSTROUTING "iif \"loopback0\" ip saddr 127.0.0.0/8 ip daddr != 127.0.0.0/8 counter masquerade comment mirrored"\
@anonhostpi
anonhostpi / wslnetmapper.ps1
Last active September 4, 2024 12:19
WSL Network Adapter Mapper
# https://gist.github.com/anonhostpi/fe3c88c8371b0a495ff39942d8aeadac
function global:Get-WSLNetMapping {
# Notify user if Mirroring Mode is not enabled
param(
[Alias("d")]
$Distribution
)
@ashtonmeuser
ashtonmeuser / canvas-dl.js
Last active August 22, 2024 16:24
Misc. bookmarklets from https://news.ycombinator.com/item?id=38014069
//bookmarklet-title: Canvas DL
//bookmarklet-about: When playing skribbl.io and someone has made a nice drawing, this lets you download the current drawing as a PNG.
var w = window.wdq || (window.wdq = document.createElement("a"));
var p = /The word was '([^']*)'/g,
pp = /<span>([^<>]+) is drawing now!/g,
tt = document.body.innerHTML;
var mm, nn, xx;
while (mm = p.exec(tt)) nn = mm;
while (mm = pp.exec(tt)) xx = mm;
@SMUsamaShah
SMUsamaShah / list_of_p2p_file_sharing.md
Last active September 24, 2024 13:51
List of P2P file sharing tools
@leesh3288
leesh3288 / vm2_3.9.19_sandbox_escape_2.md
Last active July 19, 2024 22:44
Sandbox Escape in vm2@3.9.19 via custom inspect function

Sandbox Escape in vm2@3.9.19 via custom inspect function

Summary

In vm2 for versions up to 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code.

Proof of Concept

@leesh3288
leesh3288 / vm2_3.9.19_sandbox_escape_1.md
Last active July 19, 2024 22:43
Sandbox Escape in vm2@3.9.19 via `Promise[@@species]`

Sandbox Escape in vm2@3.9.19 via Promise[@@species]

Summary

In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with @@species accessor property allowing attackers to escape the sandbox and run arbitrary code.

Proof of Concept

@leesh3288
leesh3288 / vm2_3.9.15_sandbox_escape.md
Last active November 29, 2023 10:51
Sandbox Escape in vm2@3.9.15

Sandbox Escape in vm2@3.9.15

Summary

There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass handleException() and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context.

Proof of Concept

@MaxXSoft
MaxXSoft / Dockerfile
Created November 27, 2022 09:40
A fun tool for generating an x86-64 Linux program that runs in reverse order.
FROM ubuntu:20.04
RUN apt update && DEBIAN_FRONTEND="noninteractive" apt install -y \
python3 build-essential
WORKDIR /root
@terjanq
terjanq / README.md
Last active October 4, 2023 10:36
Postviewer challenge writeup from GoogleCTF 2022

Postviewer - writeup

Challenge's overview

The rumor tells that adm1n stores their secret split into multiple documents. Can you catch 'em all? https://postviewer-web.2022.ctfcompetition.com

The challenge consisted of an all client-side simple page, i.e. no backend code was involved. A user can upload any file which will be then locally stored in indexedDB. They can preview their files by either clicking on the title or by visiting file's URL, for example https://postviewer-web.2022.ctfcompetition.com/#file-01d6039e3e157ebcbbf6b2f7cb2dc678f3b9214d. The preview of the file is rendered inside a blob created from data: URL. The rendering occurs by sending file's contents to the iframe via postMessage({ body, mimeType }, '*')

Additionally, there is a /bot endpoint which lets players send URLs to an xss-bot imitating another user. The goal is to steal their documents.

@satoooon8888
satoooon8888 / patch_libc.sh
Last active June 28, 2022 15:08
patch libc with ubuntu glibc debug symbol
#!/bin/bash -ex
LIBC=$(ls * | grep -P '^(libc\.so\.6|libc-.*\.so)$')
LIBC_DBG_DEB="$(~/package/libc-database/identify $LIBC | sed s/libc6_/libc6-dbg_/g).deb"
if [[ ! -e $LIBC_DBG_DEB ]]; then
wget http://archive.ubuntu.com/ubuntu/pool/main/g/glibc/$LIBC_DBG_DEB
fi
DEBUGID=$(file $LIBC | grep -Po '(?<=BuildID\[sha1\]=)[0-9a-f]{40}')