一个POOL是指预分配的一些存储空间，这些存储空间会分布在多个target上，具体分配到每一个target的容量大小叫做pool分区（pool shard）。POOL的大小是在创建时期制定好的，它可以通过调整每个pool shard的大小来扩缩容，也可以添加更多的target到pool中进行扩容（添加更多的storage node）。 POOL在DAOS中提供了对的存储虚拟化，同时也是存储隔离和资源分配的单元。
一个pool可以包含有多个具有事务特性的对象存储，叫做容器（container）。每个容器都是一个私有的对象地址空间（private object address space），相对于存储在同一个pool中的其他容器相互隔离，同时可以做事务性的任务。容器是DAOS中快照和数据管理的单元。DAOS对象（DAOS objects）存储在容器中，可以被分布在当前pool的任意的target上，这样就提高了性能和恢复能力。DAOS对象可以通过多种API方式访问，可以抽象表示结构化，半结构化和非结构化的数据。
继续阅读execute sql queies in SQLite in IMDB database.
I’m using Ubuntu20.04 VM for this homework. The VM is installed on VMware Workstation Pro 15. There’re several steps to prepare:
install SQLite, sudo apt-get install sqlite3 libsqlite3-dev
Download dataset, wget https://15445.courses.cs.cmu.edu/fall2019/files/imdb-cmudb2019.db.gz
verify dataset, md5 imdb-cmudb2019.db.gz
Unzip and execute it, gunzip imdb-cmudb2019.db.gz and sqlite3 imdb-cmudb2019.db
Sudo Heap-based Buffer Overflow (CVE-2021-3156)
Common Vulnerabilities & Exposures, so-called CVE, is a dictionary of system vulnerabilities that has been disclosed to the public. Normally, it consists of CVE-ID, a description, and a list of references. Specifically speaking, the CVE-ID specifies the identity of a particular CVE, the description field explains the detail of this CVE, and the references list all reports from each department that found this CVE. In this presentation, we are going to explore the latest CVE, CVE-2021-3156. It reported that the command “sudoedit -s” and any command that ends with a single backslash character will mistakenly promote the user’s permission as well as the root.
继续阅读import tensorflow as tfgpus = tf.config.experimental.list_physical_devices('GPU')for gpu in gpus: tf.config.experimental.set_memory_growth(gpu, True)set TF_FORCE_GPU_ALLOW_GROWTH to true.
import tensorflow as tftf.config.gpu.set_per_process_memory_growth(True)Source:
Starting from assignment 2, I’ll use a Kali Linux VM to do the homework.
Following the steps:
Daddy told me about cool MD5 hash collision today.
I wanna do something like that too!ssh col@pwnable.kr -p2222 (pw:guest)
Login pwnable’s server through port 2222:
from the title of the challenge, I could know that the exploit is most likely on the client side, which is the web page of the challenge.
After open the web page provided in the description, it’s a simple login form asking for a credential. Since it’s a web page, I open dev tool in Chrome to look at the source.
And then, I discoverd the following JS code. The js is to valid the string input from the form. and valid the string by spliting the string. So just append the string together would be the flag I need(at the order of the splitting).
function verify() {
checkpass = document.getElementById("pass").value;
split = 4;
if (checkpass.substring(0, split) == 'pico') {
if (checkpass.substring(split*6, split*7) == '723c') {
if (checkpass.substring(split, split*2) == 'CTF{') {
if (checkpass.substring(split*4, split*5) == 'ts_p') {
if (checkpass.substring(split*3, split*4) == 'lien') {
if (checkpass.substring(split*5, split*6) == 'lz_7') {
if (checkpass.substring(split*2, split*3) == 'no_c') {
if (checkpass.substring(split*7, split*8) == 'e}') {
alert("Password Verified")
}
}
}
}
}
}
}
}
else {
alert("Incorrect password");
}
}
the flag is picoCTF{no_clients_plz_7723ce}(the reassemble of the flag could be done by a simple program, but it’s just very short string, I just glued it together by hand).