Skip to content

Commit 005474b

Browse files
author
Sajjad Arshad
committed
adding RealWorld CTF
1 parent f8445b5 commit 005474b

File tree

76 files changed

+797
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

76 files changed

+797
-0
lines changed

‎RealWorldCTF/.DS_Store

6 KB
Binary file not shown.

‎RealWorldCTF/2019/.DS_Store

6 KB
Binary file not shown.

‎RealWorldCTF/2019/Across_the_Great_Wall/libCoroutine.so

212 KB
Binary file not shown.

‎RealWorldCTF/2019/Across_the_Great_Wall/readme.txt

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
## The source code ##
2+
https://github.com/zh-explorer/shadow
3+
https://github.com/zh-explorer/Coroutine
4+
5+
6+
## The flag ##
7+
/home/pwn/flag
8+
9+
10+
## build env && remote system env ##
11+
12+
$ g++ --version
13+
g++ (Ubuntu 7.4.0-1ubuntu1~18.04.1) 7.4.0
14+
15+
$ cmake --version
16+
cmake version 3.10.2
17+
18+
$ /lib/x86_64-linux-gnu/libc.so.6
19+
GNU C Library (Ubuntu GLIBC 2.27-3ubuntu1) stable release version 2.27.
20+
21+
$ cat /etc/issue
22+
Ubuntu 18.04.3 LTS

‎RealWorldCTF/2019/Across_the_Great_Wall/shadow_client

359 KB
Binary file not shown.

‎RealWorldCTF/2019/Across_the_Great_Wall/shadow_server

359 KB
Binary file not shown.

‎RealWorldCTF/2019/Appetizer/ch

571 KB
Binary file not shown.

‎RealWorldCTF/2019/Appetizer/challenge.patch

+232
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,232 @@
1+
diff --git a/bin/ChakraCore/CMakeLists.txt b/bin/ChakraCore/CMakeLists.txt
2+
index f4ec551..57d53d9 100644
3+
--- a/bin/ChakraCore/CMakeLists.txt
4+
+++ b/bin/ChakraCore/CMakeLists.txt
5+
@@ -50,6 +50,7 @@ set(lib_target "${lib_target}"
6+
${LINKER_END_GROUP}
7+
pthread
8+
dl
9+
+ "-z noexecstack"
10+
)
11+
12+
if(CC_TARGET_OS_ANDROID OR CC_TARGET_OS_LINUX)
13+
diff --git a/bin/ch/CMakeLists.txt b/bin/ch/CMakeLists.txt
14+
index 7e495f2..ef03dfb 100644
15+
--- a/bin/ch/CMakeLists.txt
16+
+++ b/bin/ch/CMakeLists.txt
17+
@@ -84,6 +84,9 @@ else() # // shared library below
18+
19+
if(CC_TARGET_OS_ANDROID OR CC_TARGET_OS_LINUX)
20+
set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -pie") # osx clang sets this by default
21+
+ set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -z relro")
22+
+ set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -z now")
23+
+ set(CMAKE_EXE_LINKER_FLAGS "${CMAKE_EXE_LINKER_FLAGS} -z noexecstack")
24+
endif()
25+
26+
set(lib_target
27+
diff --git a/bin/ch/WScriptJsrt.cpp b/bin/ch/WScriptJsrt.cpp
28+
index 5b6e2d8..6bfb08d 100644
29+
--- a/bin/ch/WScriptJsrt.cpp
30+
+++ b/bin/ch/WScriptJsrt.cpp
31+
@@ -1081,145 +1081,8 @@ bool WScriptJsrt::Initialize()
32+
{
33+
HRESULT hr = S_OK;
34+
char CH_BINARY_LOCATION[2048];
35+
-#ifdef CHAKRA_STATIC_LIBRARY
36+
- const char* LINK_TYPE = "static";
37+
-#else
38+
- const char* LINK_TYPE = "shared";
39+
-#endif
40+
-#ifdef HAS_ICU
41+
- int icuVersion = PlatformAgnostic::ICUHelpers::GetICUMajorVersion();
42+
-#else
43+
- int icuVersion = -1;
44+
-#endif
45+
-
46+
- JsValueRef wscript;
47+
- IfJsrtErrorFail(ChakraRTInterface::JsCreateObject(&wscript), false);
48+
-
49+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "Echo", EchoCallback));
50+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "Quit", QuitCallback));
51+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "LoadScriptFile", LoadScriptFileCallback));
52+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "LoadScript", LoadScriptCallback));
53+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "LoadModule", LoadModuleCallback));
54+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "SetTimeout", SetTimeoutCallback));
55+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "ClearTimeout", ClearTimeoutCallback));
56+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "Attach", AttachCallback));
57+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "Detach", DetachCallback));
58+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "DumpFunctionPosition", DumpFunctionPositionCallback));
59+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "RequestAsyncBreak", RequestAsyncBreakCallback));
60+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "LoadBinaryFile", LoadBinaryFileCallback));
61+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "LoadTextFile", LoadTextFileCallback));
62+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "Flag", FlagCallback));
63+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "RegisterModuleSource", RegisterModuleSourceCallback));
64+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "GetModuleNamespace", GetModuleNamespace));
65+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "GetProxyProperties", GetProxyPropertiesCallback));
66+
-
67+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "SerializeObject", SerializeObject));
68+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "Deserialize", Deserialize));
69+
-
70+
- // ToDo Remove
71+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "Edit", EmptyCallback));
72+
-
73+
- // Platform
74+
- JsValueRef platformObject;
75+
- IfJsrtErrorFail(ChakraRTInterface::JsCreateObject(&platformObject), false);
76+
- JsPropertyIdRef platformProperty;
77+
- IfJsrtErrorFail(CreatePropertyIdFromString("Platform", &platformProperty), false);
78+
-
79+
- // Set CPU arch
80+
- JsPropertyIdRef archProperty;
81+
- IfJsrtErrorFail(CreatePropertyIdFromString("ARCH", &archProperty), false);
82+
- JsValueRef archValue;
83+
- IfJsrtErrorFail(ChakraRTInterface::JsCreateString(
84+
- CPU_ARCH_TEXT, strlen(CPU_ARCH_TEXT), &archValue), false);
85+
- IfJsrtErrorFail(ChakraRTInterface::JsSetProperty(platformObject, archProperty,
86+
- archValue, true), false);
87+
-
88+
- // Set Build Type
89+
- JsPropertyIdRef buildProperty;
90+
- IfJsrtErrorFail(CreatePropertyIdFromString("BUILD_TYPE", &buildProperty), false);
91+
- JsValueRef buildValue;
92+
-#ifdef _DEBUG
93+
-#define BUILD_TYPE_STRING_CH "Debug" // (O0)
94+
-#elif defined(ENABLE_DEBUG_CONFIG_OPTIONS)
95+
-#define BUILD_TYPE_STRING_CH "Test" // (O3 with debug config options)
96+
-#else
97+
-#define BUILD_TYPE_STRING_CH "Release" // (O3)
98+
-#endif
99+
- IfJsrtErrorFail(ChakraRTInterface::JsCreateString(
100+
- BUILD_TYPE_STRING_CH, strlen(BUILD_TYPE_STRING_CH), &buildValue), false);
101+
- IfJsrtErrorFail(ChakraRTInterface::JsSetProperty(platformObject, buildProperty,
102+
- buildValue, true), false);
103+
-#undef BUILD_TYPE_STRING_CH
104+
-
105+
- // Set Link Type [static / shared]
106+
- JsPropertyIdRef linkProperty;
107+
- IfJsrtErrorFail(CreatePropertyIdFromString("LINK_TYPE", &linkProperty), false);
108+
- JsValueRef linkValue;
109+
- IfJsrtErrorFail(ChakraRTInterface::JsCreateString(
110+
- LINK_TYPE, strlen(LINK_TYPE), &linkValue), false);
111+
- IfJsrtErrorFail(ChakraRTInterface::JsSetProperty(platformObject, linkProperty,
112+
- linkValue, true), false);
113+
-
114+
- // Set Binary Location
115+
- JsValueRef binaryPathValue;
116+
- PlatformAgnostic::SystemInfo::GetBinaryLocation(CH_BINARY_LOCATION, sizeof(CH_BINARY_LOCATION));
117+
-
118+
- JsPropertyIdRef binaryPathProperty;
119+
- IfJsrtErrorFail(CreatePropertyIdFromString("BINARY_PATH", &binaryPathProperty), false);
120+
-
121+
- IfJsrtErrorFail(ChakraRTInterface::JsCreateString(
122+
- CH_BINARY_LOCATION,
123+
- strlen(CH_BINARY_LOCATION), &binaryPathValue), false);
124+
- IfJsrtErrorFail(ChakraRTInterface::JsSetProperty(
125+
- platformObject, binaryPathProperty, binaryPathValue, true), false);
126+
-
127+
- // Set destination OS
128+
- JsPropertyIdRef osProperty;
129+
- IfJsrtErrorFail(CreatePropertyIdFromString("OS", &osProperty), false);
130+
- JsValueRef osValue;
131+
- IfJsrtErrorFail(ChakraRTInterface::JsCreateString(
132+
- DEST_PLATFORM_TEXT, strlen(DEST_PLATFORM_TEXT), &osValue), false);
133+
- IfJsrtErrorFail(ChakraRTInterface::JsSetProperty(platformObject, osProperty,
134+
- osValue, true), false);
135+
-
136+
- // set Internationalization library
137+
- JsPropertyIdRef intlLibraryProp;
138+
- IfJsrtErrorFail(CreatePropertyIdFromString("INTL_LIBRARY", &intlLibraryProp), false);
139+
- JsValueRef intlLibraryStr;
140+
- IfJsrtErrorFail(ChakraRTInterface::JsCreateString(INTL_LIBRARY_TEXT, strlen(INTL_LIBRARY_TEXT), &intlLibraryStr), false);
141+
- IfJsrtErrorFail(ChakraRTInterface::JsSetProperty(platformObject, intlLibraryProp, intlLibraryStr, true), false);
142+
- JsPropertyIdRef icuVersionProp;
143+
- IfJsrtErrorFail(CreatePropertyIdFromString("ICU_VERSION", &icuVersionProp), false);
144+
- JsValueRef icuVersionNum;
145+
- IfJsrtErrorFail(ChakraRTInterface::JsIntToNumber(icuVersion, &icuVersionNum), false);
146+
- IfJsrtErrorFail(ChakraRTInterface::JsSetProperty(platformObject, icuVersionProp, icuVersionNum, true), false);
147+
-
148+
- IfJsrtErrorFail(ChakraRTInterface::JsSetProperty(wscript, platformProperty,
149+
- platformObject, true), false);
150+
-
151+
- JsValueRef argsObject;
152+
-
153+
- if (!CreateArgumentsObject(&argsObject))
154+
- {
155+
- return false;
156+
- }
157+
-
158+
- JsPropertyIdRef argsName;
159+
- IfJsrtErrorFail(CreatePropertyIdFromString("Arguments", &argsName), false);
160+
- IfJsrtErrorFail(ChakraRTInterface::JsSetProperty(wscript, argsName, argsObject, true), false);
161+
-
162+
- JsPropertyIdRef wscriptName;
163+
- IfJsrtErrorFail(CreatePropertyIdFromString("WScript", &wscriptName), false);
164+
-
165+
JsValueRef global;
166+
IfJsrtErrorFail(ChakraRTInterface::JsGetGlobalObject(&global), false);
167+
- IfJsrtErrorFail(ChakraRTInterface::JsSetProperty(global, wscriptName, wscript, true), false);
168+
-
169+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(global, "print", EchoCallback));
170+
-
171+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(global, "read", LoadTextFileCallback));
172+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(global, "readbuffer", LoadBinaryFileCallback));
173+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(global, "readline", ReadLineStdinCallback));
174+
175+
JsValueRef console;
176+
IfJsrtErrorFail(ChakraRTInterface::JsCreateObject(&console), false);
177+
@@ -1231,31 +1094,7 @@ bool WScriptJsrt::Initialize()
178+
179+
IfJsrtErrorFail(InitializeModuleCallbacks(), false);
180+
181+
- // When the command-line argument `-Test262` is set,
182+
- // WScript will have the extra support API below and $262 will be
183+
- // added to global scope
184+
- if (HostConfigFlags::flags.Test262)
185+
- {
186+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "Broadcast", BroadcastCallback));
187+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "ReceiveBroadcast", ReceiveBroadcastCallback));
188+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "Report", ReportCallback));
189+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "GetReport", GetReportCallback));
190+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "Leaving", LeavingCallback));
191+
- IfFalseGo(WScriptJsrt::InstallObjectsOnObject(wscript, "Sleep", SleepCallback));
192+
-
193+
- // $262
194+
- const char Test262[] =
195+
- #include "262.js"
196+
- ;
197+
-
198+
- JsValueRef Test262ScriptRef;
199+
- IfJsrtErrorFailLogAndRetFalse(ChakraRTInterface::JsCreateString(Test262, strlen(Test262), &Test262ScriptRef));
200+
-
201+
- JsValueRef fname;
202+
- IfJsrtErrorFailLogAndRetFalse(ChakraRTInterface::JsCreateString("262", strlen("262"), &fname));
203+
- IfJsrtErrorFailLogAndRetFalse(ChakraRTInterface::JsRun(Test262ScriptRef, WScriptJsrt::GetNextSourceContext(), fname, JsParseScriptAttributeNone, nullptr));
204+
- }
205+
-
206+
+
207+
Error:
208+
return hr == S_OK;
209+
}
210+
diff --git a/lib/Runtime/Language/InterpreterStackFrame.cpp b/lib/Runtime/Language/InterpreterStackFrame.cpp
211+
index 9839571..1d6addb 100644
212+
--- a/lib/Runtime/Language/InterpreterStackFrame.cpp
213+
+++ b/lib/Runtime/Language/InterpreterStackFrame.cpp
214+
@@ -2018,12 +2018,12 @@ namespace Js
215+
varSizeInBytes = varAllocCount * sizeof(Var);
216+
allocation = (Var*)tmpAlloc->Alloc(varSizeInBytes);
217+
stackAddr = reinterpret_cast<DWORD_PTR>(&allocation); // use a stack address so the debugger stepping logic works (step-out, for example, compares stack depths to determine when to complete the step)
218+
- if (stackVarAllocCount != 0)
219+
- {
220+
- size_t stackVarSizeInBytes = stackVarAllocCount * sizeof(Var);
221+
- PROBE_STACK_PARTIAL_INITIALIZED_INTERPRETER_FRAME(functionScriptContext, Js::Constants::MinStackInterpreter + stackVarSizeInBytes);
222+
- stackAllocation = (Var*)_alloca(stackVarSizeInBytes);
223+
- }
224+
+ //if (stackVarAllocCount != 0)
225+
+ //{
226+
+ // size_t stackVarSizeInBytes = stackVarAllocCount * sizeof(Var);
227+
+ // PROBE_STACK_PARTIAL_INITIALIZED_INTERPRETER_FRAME(functionScriptContext, Js::Constants::MinStackInterpreter + stackVarSizeInBytes);
228+
+ // stackAllocation = (Var*)_alloca(stackVarSizeInBytes);
229+
+ //}
230+
}
231+
else
232+
{

‎RealWorldCTF/2019/Appetizer/libChakraCore.so

18.4 MB
Binary file not shown.

‎RealWorldCTF/2019/Appetizer/readme.txt

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
The chakracore is built upon commit: 630f662f62ea80a09816771b9b33a89755abfc8f
2+
build command: ./build.sh -no-icu -j

‎RealWorldCTF/2019/Dezhou_Instrumentz/.DS_Store

6 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/.DS_Store

6 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/[email protected]

8.85 KB
Loading

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Assets.car

55.4 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Base.lproj/LaunchScreen.storyboardc/01J-lp-oVM-view-Ze5-6b-2t3.nib

1.11 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Base.lproj/LaunchScreen.storyboardc/Info.plist

258 Bytes
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Base.lproj/LaunchScreen.storyboardc/UIViewController-01J-lp-oVM.nib

832 Bytes
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Base.lproj/Main.storyboardc/BYZ-38-t0r-view-8bC-Xf-vdC.nib

4.24 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Base.lproj/Main.storyboardc/Info.plist

258 Bytes
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Base.lproj/Main.storyboardc/UIViewController-BYZ-38-t0r.nib

975 Bytes
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Calc

200 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftCore.dylib

22.2 MB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftCoreFoundation.dylib

327 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftCoreGraphics.dylib

838 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftCoreImage.dylib

327 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftDarwin.dylib

488 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftDispatch.dylib

1.31 MB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftFoundation.dylib

11 MB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftMetal.dylib

386 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftObjectiveC.dylib

391 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftQuartzCore.dylib

330 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftSwiftOnoneSupport.dylib

1.54 MB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftUIKit.dylib

640 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Frameworks/libswiftos.dylib

388 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/Info.plist

1.34 KB
Binary file not shown.

‎RealWorldCTF/2019/Dezhou_Instrumentz/Debug-iphoneos/Calc.app/PkgInfo

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
APPL????

0 commit comments

Comments
 (0)