diff --git a/README.md b/README.md index e69de29..d577ef3 100644 --- a/README.md +++ b/README.md @@ -0,0 +1,5 @@ +# What is this? +This thing is an example to exploit an issue in Wynntils +# How does it work? +With the new Wynntils encoding, Wynntils DOES NOT validate crafted names for special characters like newlines. This can be exploited. +Credit to zatzou for finding this. Shits crazy, nerf poco \ No newline at end of file diff --git a/src/main.rs b/src/main.rs index 4753baa..a75a017 100644 --- a/src/main.rs +++ b/src/main.rs @@ -22,7 +22,7 @@ fn main() { .encode(ver, &mut out) .unwrap(); - NameData(String::from("\n".repeat(220))) + NameData(String::from("\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\nWynntils doesnt do proper validation LMAOO ~endernon\nSee git.frfrnocap.men/endernon/wynntils-crafted-exploit")) .encode(ver, &mut out) .unwrap();