21 lines
801 B
Markdown
21 lines
801 B
Markdown
# Sploit 1
|
|
|
|
Flagstore 1. Unbeatable levels (their prizes)
|
|
|
|
Vulnerability: No bounds check in the MoveOutOfWay function (checked on the client side). The levels are beatable by going out of bounds.
|
|
|
|
Fix: Add bounds check in the MoveOutOfWay function:
|
|
```Go
|
|
if p.X < 0 || p.Y < 0 || p.X >= sess.Tiles.size || p.Y >= sess.Tiles.size {
|
|
return false
|
|
}
|
|
```
|
|
|
|
# Sploit 2
|
|
|
|
Flagstore 2. Private levels (their prizes)
|
|
|
|
Vulnerability: Backdoor in the Level.CreateFrom function (hidden in the template with a bunch of tabs which get it out of the screen). It creates a user with name and password both equal to `sha256(level_name)[:32]`, which can then be used to access the level and the flag.
|
|
|
|
Fix: remove the backdoor code from `create_from.tmpl` and regenerate OR remove it directly from `create_from.go`.
|