CTFshow RCE Extreme Challenge Solutions
Direct use echo with backticks. First ls, then tac to read the flag.
Challenge 2
The filter is quite restrictive. One effective method is the character increment bypass. A small script can enumerate which characters are allowed:
for ($c = 32; $c < 127; $c++) {
if (!preg_match("/[a-zA-Z0-9@#%^&*:{}\-<\?>\"|`~\\\\]/&q ...
Posted on Wed, 15 Jul 2026 16:55:59 +0000 by Ellypsys
Deep Dive into Apache Commons Collections Deserialization Chains: CC5 and CC7 Mechanics
Target Environment
The demonstration relies on the following library versions and runtime configurations:
Library: Apache Commons Collections 3.2.1
Runtime: OpenJDK 1.8 (Update 65)
Both vulnerabilities involve modifications within the LazyMap.get() method. The following sections detail the execution flow and implementation for the CC5 and CC7 ...
Posted on Fri, 10 Jul 2026 17:12:22 +0000 by richei