Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Dojo challenge #46 Ghost whisper solution

yeswehack.com | blog | #rce | #dojo | #writeup | #unicode | #code-injection | #nfkc | #subprocess

Summary

Writeup for YesWeHack Dojo #46 'Ghost Whisper': a Unicode NFKC normalisation quirk turns a character into a quote, bypassing sanitisation and enabling RCE via subprocess.run.
Published
Collected

original ↗

Related coverage

  1. DOJO CHALLENGE #4 Winners! (yeswehack.com)
  2. Dojo challenge #53 Hacker Club solution (yeswehack.com)
  3. Dojo challenge #45 Chainfection solution (yeswehack.com)
  4. Dojo challenge #44 Hardware monitor write-up (yeswehack.com)
  5. Dojo challenge #41 - Ruby treasure winners & writeup (yeswehack.com)
  6. Dojo challenge #40 - Hacker profile winners & writeup (yeswehack.com)

back