[CTF Write Up] ASIS CTF Final 2023 - isWebP.js : Exploiting QuickJS by Webp Vulnerability

1. Overview 2. CVE-2023-4863 3. Patch Analysis 3-1. libwebp.patch 3-2. quickjs.patch 3-2-1. Disable System Module 3-2-2. Add isWebP Function 4. Exploiting QuickJS 4-1. VP8LHuffmanTablesAllocate Analysis 4-2. Make OOB Read / Write Primitive by Heap Spraying 4-3. Hijack RIP 5. Finish Full Write Up https://velog.io/@0range1337/CTF-ASIS-CTF-Final-2023-isWebP.js-Exploiting-QuickJS-by-Webp-Vulnerabili..

2024.01.06