[Linuxdcpp-team] [Bug 2047732] Re: [PoC] RCE in ScriptPlugin 1.0

2024-01-02 Thread cologic
And updated ScriptPlugin: https://sourceforge.net/p/dcnetwork/code/ci/a5253d7f87c25ea4162a3b7678be74be335926d0/ -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. https://bugs.launchpad.net/bugs/2047732 Title: [PoC] RCE in ScriptPlug

[Linuxdcpp-team] [Bug 2047732] Re: [PoC] RCE in ScriptPlugin 1.0

2024-01-02 Thread cologic
https://bugs.launchpad.net/dcplusplus/+bug/2047732/comments/5 regarding LUA_COMPAT_BITLIB does mean, yes, that nothing from that source file is being compiled: dcnetwork-code/trunk/dc-plugins/ScriptPlugin/projects/make/build- mingw-x64/lua$ objdump -t lbitlib.o lbitlib.o: file format pe-x86-6

[Linuxdcpp-team] [Bug 2047732] Re: [PoC] RCE in ScriptPlugin 1.0

2024-01-02 Thread RoLex
My suggestion then is to add bit32_compat.lua to scripts repository, define global "bit32" table in there and push those missing functions in there > bit32 = {} bit32["lrotate"] = function(x, n) x = x % 2^32 * 2^n local r = x % 2^32 return r + (x - r) / 2^32 end bit32["rrotate"] = function(x, n)

[Linuxdcpp-team] [Bug 2047732] Re: [PoC] RCE in ScriptPlugin 1.0

2024-01-02 Thread RoLex
Module bit32 has been deprecated since first release of Lua 5.3 > https://www.lua.org/manual/5.3/manual.html#8.2 It's even stated in code that you assigned to ScriptPlugin last time > https://sourceforge.net/p/dcnetwork/code/ci/default/tree/trunk/dc- plugins/ScriptPlugin/lua/lbitlib.c#l227 -- Yo

[Linuxdcpp-team] [Bug 2047732] Re: [PoC] RCE in ScriptPlugin 1.0

2024-01-02 Thread RoLex
Whole lbitlib.c is written under this block > #if defined(LUA_COMPAT_BITLIB) -- You received this bug notification because you are a member of Dcplusplus-team, which is subscribed to DC++. https://bugs.launchpad.net/bugs/2047732 Title: [PoC] RCE in ScriptPlugin 1.0 Status in DC++: New Statu