From 31ec6f12df4df32146b0105bbf8a1741adc3dbc7 Mon Sep 17 00:00:00 2001 From: "Jan Vales (Someone)" Date: Fri, 17 Jan 2020 22:22:58 +0000 Subject: [PATCH] Update my writeup. --- writeups/writeups/someone/seccon19.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/writeups/writeups/someone/seccon19.md b/writeups/writeups/someone/seccon19.md index 47fccfc..ee366c1 100644 --- a/writeups/writeups/someone/seccon19.md +++ b/writeups/writeups/someone/seccon19.md @@ -80,7 +80,7 @@ SECCON{You_are_the_Globbin'_Slayer} ``` -## (Failed) Attempts +## The road to enlightenment - aka (failed) attempts ### 3:52 PM - Every file is also a directory. ``` it seems to always show a "directory listing" if you add / at the end and the directory doesnt contain a dot @@ -155,10 +155,11 @@ It turns out: its a multi-staged challenge: We somehow still need to inject dots ### 6:24 PM - PWND! ^.^ -Turns out: One does not need dots, if we can use Dir.glob. -+ To be able to use ``{}`` in glob, we need to used a ``[`` somewhere. +Turns out: ++ Dots are in fact unusable, but one does not need dots, if we can use Dir.glob. ++ To be able to use ``{}`` in glob, we need to use a ``[`` somewhere. + null-bytes do not help here. -+ The trick to get rid of the ``[`` is to put it inside of the ``{}`` match -> ``{something, [}`` and ``something = the absolute path of the flag``, and thats why we do not need any dots in the path. ++ The trick to get rid of the ``[`` is to put it inside of the ``{}`` match -> ``{something, [}`` and ``something = the absolute path of the flag``. The flag: ``` -- 2.43.0