François Capon FrancoisCapon

CVE-2022-39224 POC in a Docker Container

I don't found an example of POC for this CVE of ruby-arr-pm 0.0.11, so I build one using a Docker container.

Usage

$ docker build -t cve-2022-39224:poc . && docker run -it cve-2022-39224:poc

Properly Update Cookies Value With Python Requests

⚠️ Using http_session.cookies['name'] or http_session.cookies.set('name', 'value') will duplicate the cookie.

🎲 By chance, Requests takes the last created, but it's possible to do it properly by using the domain

📄 class requests.cookies.RequestsCookieJar(policy=None)

import requests

Capture flags in files with `strings`

#!/bin/bash

# Parameters example
# Disclaimer: any resemblance to actual exercices or CTF is purely coincidental ;-)
files_pattern='pcap_??.pcap'
flags_pattern='.{8}-.{4}-.{4}-.{4}-.{12}'

CVE-2016-2098 exploit with Requests using Python Interpreter

CVE

CVE-2016-2098

Ruby

JWT_Tool: eXploits key confusion and Tamper

Web Security Academy >> JWT attacks >> Algorithm confusion attacks
JWT_Tool: JWT_Tool: eXploits key confusion (RS -> HS) and interactively Tampers with the payload.

jwt_tool-Xk-T.sh 
$1: the jwt_tool command (ex: "python3 jwt_tool/jwt_tool.py")
$2: the RS JWT
$3: the public key file

Group Policy Preferences XML: CyberChef Recipe to Decrypt Passwords

https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gppref/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be

index.html#recipe=Fork('\\n','\\n',false)From_Base64('A-Za-z0-9%2B/%3D',true)AES_Decrypt({'option':'Hex','string':'4e9906e8fcb66cc9faf49310620ffee8f496e806cc057990209b09a433b66c1b'},{'option':'Hex','string':'00000000000000000000000000000000'},'CBC','Raw','Raw',{'option':'Hex','string':''},{'option':'Hex','string':''})Decode_text('UTF-16LE (1200)')

Url Safe Wrapper of the GNU Base64 Util

The gnu base64 util has no option to handle the URL and Filename Safe Alphabet version (RFC 4648 / section 5) and basenc (was introduce in coreutils v8.31) is not installed on all hosts.

So just for training, I writed this wrapper in bash!

Wrapping Principle

This script is a wrapper that:

in encoding process:

	#!/usr/bin/env python3

	# Standard Library
	import zipfile, xml.etree.ElementTree, shutil, os, sys, pathlib

	# Classes and Associations
	# [Docx] (1)---(1) [DocxFonts] (1)---(1..n) [DocxFont] (1)---(0..n) [DocxOdttfFont]

	class Docx():

	<!DOCTYPE html>
	<html>
	<head>
	<title>UIkit Toggleable Filters - François Capon</title>
	<meta name="viewport" content="width=device-width, initial-scale=1">

	<!-- UIkit CSS -->
	<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/uikit/3.1.7/css/uikit.min.css">

	<!-- UIkit JS -->

	<!DOCTYPE html>
	<html>

	<head>
	<link href="mini-default.css" rel="stylesheet">
	<script src="chart.bundle.min.js"></script>
	</head>

	<body>
	<h1>Chart.js for CTF Dashboard</h1>