diff options
| author | Louis Burda <quent.burda@gmail.com> | 2024-04-19 00:55:07 +0200 |
|---|---|---|
| committer | Louis Burda <quent.burda@gmail.com> | 2024-04-19 00:55:07 +0200 |
| commit | ebb26ae709570a84004c27f34e9307c33ac6b000 (patch) | |
| tree | ba83f56ec65986cab387c97b771cd0a26e566c60 /solve/notes | |
| parent | 84e77e74c8d69b33a25938a46700b67a3e835c88 (diff) | |
| download | cscg24-photoeditor-ebb26ae709570a84004c27f34e9307c33ac6b000.tar.gz cscg24-photoeditor-ebb26ae709570a84004c27f34e9307c33ac6b000.zip | |
Diffstat (limited to 'solve/notes')
| -rw-r--r-- | solve/notes | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/solve/notes b/solve/notes new file mode 100644 index 0000000..dd7661c --- /dev/null +++ b/solve/notes @@ -0,0 +1,14 @@ +Literally RCE as a service with training wheels. + +Get to dynamically dispatch a C# function from JSON descripiton. + +Even the type string is returned to you in the service exception output. + +Once you have code execution its a matter of making the flag accessible +through another endpoint, since the program expects an Image return type, +but GetUser returns a String, so an exception is thrown, preventing +you from getting the output directly in the HTTP response. + +We move the flag to wwwroot/js/flag.js. Need the extension, since +otherwise the strict web router will not allow us to download it. + |