Piratesay writeup (vuln 1)

https://link.yixboost.dev/contact (Yixboost) — Fri, 10 Jul 2026 21:40:31 +0000

Piratesay

When connecting, you enter a kind of bash shell, where you can use basic commands to navigate and read/write files. You also get a random identity every session, but that is only important to the second vulnerability.

commands:

The Official Pirate Codex:
 scout [destination] - Search current or desired destination for items
 sail [destination] - Set sail for a new destination
 bury - bury treasure for others to find at your destination
 loot [item] - Grab the contents of an item at your destination
 identity - manage your pirate identity 
 codex - Display this pirate codex
 dock - Dock your ship and leave Pirate Say

ls -> scout
cd -> sail
help -> codex
exit -> dock
help -> codex
read -> loot
write -> bury

Vulnerability one

If you input a wrong password when looting treasure the password you gave get’s read back to you: ![[Pasted image 20260710230455.png]] This Clean_from_formatstrings function that checks on format strings, but not for ‘o’ (used for octal), so we can use that to leak memory (and the password)

DMA on Dell XPS (PCILeech)

https://link.yixboost.dev/contact (Yixboost) — Tue, 07 Jul 2026 05:51:32 +0000

Getting started

DMA stands for Direct Memory Access.

I am using pcileech with a captain DMA M.2 . This is an fpga device so most of the features should work.

Installing DMA device

The xps i’m using only has one m.2 slot, so I can’t boot into an os as you would normaly. I have to boot into a USB wit ubuntu and install the DMA device in the m.2 slot.

But ubuntu hangs on the loading screen, pressing esc to see the logs I can see: