Steffen Gransow graste

{
  "type": "FeatureCollection",
  "features": [
    {
      "type": "Feature",
      "properties": {},
      "geometry": {
        "coordinates": [
 [

--ignore-platform-req=php+

https://twitter.com/seldaek/status/1577349406382342144

With the plus sign it allows using php 8.2 where 8.1 is required by a pkg, but not using php 8.0 if 8.1 is required.

composer

Solving "includer's revenge" from hxp ctf 2021 without controlling any files

The challenge

The challenge was to achieve RCE with this file:

<?php ($_GET['action'] ?? 'read' ) === 'read' ? readfile($_GET['file'] ?? 'index.php') : include_once($_GET['file'] ?? 'index.php');

Some additional hardening was applied to the php installation to make sure that previously known solutions wouldn't work (for further information read this writeup from the challenge author).

I didn't solve the challenge during the competition - here is a writeup from someone who did - but since the idea I had differed from the techniques used in the published writeups I read (and I thought it was cool :D), here is my approach.

OpenPGP SSH access with Yubikey and GnuPG

Yubikey, Smart Cards, OpenSC and GnuPG are pain in the ass to get working. Those snippets here sould help alleviate pain.

Yubikey Config under Ubuntu

To reset and disable not used modes on Yubikey you need the ykman program

You can install it using those commands

	# Define ULID_DECODE and ULID_ENCODE which convert a ulid string to a binary and vice versa.

	delimiter //
	DROP FUNCTION IF EXISTS ULID_DECODE//
	CREATE FUNCTION ULID_DECODE (s CHAR(26)) RETURNS BINARY(16) DETERMINISTIC
	BEGIN
	DECLARE s_base32 CHAR(26);
	SET s_base32 = REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(REPLACE(UPPER(s), 'J', 'I'), 'K', 'J'), 'M', 'K'), 'N', 'L'), 'P', 'M'), 'Q', 'N'), 'R', 'O'), 'S', 'P'), 'T', 'Q'), 'V', 'R'), 'W', 'S'), 'X', 'T'), 'Y', 'U'), 'Z', 'V');
	RETURN UNHEX(CONCAT(LPAD(CONV(SUBSTRING(s_base32, 1, 2), 32, 16), 2, '0'), LPAD(CONV(SUBSTRING(s_base32, 3, 12), 32, 16), 15, '0'), LPAD(CONV(SUBSTRING(s_base32, 15, 12), 32, 16), 15, '0')));
	END//

	<?php

	namespace App\EventListener;

	use Symfony\Component\EventDispatcher\EventSubscriberInterface;
	use Symfony\Component\HttpFoundation\Request;
	use Symfony\Component\HttpKernel\Event\RequestEvent;
	use Symfony\Component\HttpKernel\KernelEvents;
	use Symfony\Component\Validator\Validator\ValidatorInterface;
	use Symfony\Component\Validator\Constraints;

	<?php
	class ReconnectingPDO
	{
	protected $dsn, $username, $password, $pdo, $driver_options;

	public function __construct($dsn, $username = "", $password = "", $driver_options = array())
	{
	$this->dsn = $dsn;
	$this->username = $username;
	$this->password = $password;

	<?php
	// https://twitter.com/derickr/status/1423682080085626885?s=19
	$c = new Collator( 'en' );
	$c->setStrength( Collator::PRIMARY );

	if ( $c->compare( 'Séan', 'Sean' ) == 0 )
	{
	echo "The same\n";
	}

	# from https://www.commandlinefu.com/commands/view/26576/backup-all-starred-repositories-from-github
	GITUSER=$(whoami); curl "https://api.github.com/users/${GITUSER}/starred?per_page=1000" \| grep -o 'git@[^"]*' \| xargs -L1 git clone