File: tumblr_nzr1xa45j71tkxvxvo1_540.jpg (54 KB, 507x676) Image search: [Google]

54 KB, 507x676

Find the vulnerability /g/!

If correct, when CryptoAPI.sha1.hash(x) is called, you should be able to run arbitrary code on the machine you're attacking. Assume that x is a value controlled by the attacker.

     1    var CryptoAPI = (function() {
     2        var encoding = {
     3            a2b: function(a) { },
     4            b2a: function(b) { }
     5        };
     6    
     7        var API = {
     8            sha1: {
     9                name: 'sha1',
    10                identifier: '2b0e03021a',
    11                size: 20,
    12                block: 64,
    13                hash: function(s) {
    14                    var len = (s += '\x80').length,
    15                        blocks = len >> 6,
    16                        chunk = len & 63,
    17                        res = "",
    18                        i = 0,
    19                        j = 0,
    20                        H = [0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0],
    21                        w = [];
    22                        
    23                    while (chunk++ != 56) {
    24                        s += "\x00";
    25                        if (chunk == 64) {
    26                            blocks++;
    27                            chunk = 0;
    28                        }
    29                    }
    30                    
    31                    for (s += "\x00\x00\x00\x00", chunk = 3, len = 8 * (len - 1); chunk >= 0; chunk--) {
    32                        s += encoding.b2a(len >> (8 * chunk) & 255);
    33                    }
    34                        
    35                    for (i = 0; i < s.length; i++) {
    36                        j = (j << 8) + encoding.a2b(s[i]);
    37                        if ((i & 3) == 3) {
    38                            w[(i >> 2) & 15] = j;
    39                            j = 0;
    40                        }
    41                        if ((i & 63) == 63) CryptoAPI.sha1._round(H, w);
    42                    }
    43                    
    44                    for (i = 0; i < H.length; i++)
    45                        for (j = 3; j >= 0; j--)
    46                            res += encoding.b2a(H[i] >> (8 * j) & 255);
    47                    return res;
    48                }, // End "hash"
    49                _round: function(H, w) { }
    50            } // End "sha1"
    51        }; // End "API"
    52    
    53        return API; // End body of anonymous function
    54    })(); // End "CryptoAPI"