tap2pwn

R3CTF 2026 pwn0win The year is 2020.

Every shitty Onetap v3 config is packed with a million bloated, pasted JSes and resold for hundreds of dollars.

Behind every pasted placebo "resolver", rainbow watermark, and $200 config was a scripting engine nobody bothered to threat-model.

Could you have been the one to turn the paste economy against itself, putting an end to the grift?

Let’s find out…

You can view an example of RCE here

Requirements for RCE demo:

Please send your exploit as one .js file Game must continue to function normally after RCE demonstration(popcalc) No bruteforcing. Only 3 attempts allowed per team

NOTE: ALL PARTS OF THE ATTACHMENTS WERE DOWNLOADED FROM SHADY SOURCES. RUN AT YOUR OWN RISK.

Google Drive Baidu Pan

Password: tap2pwn

https://drive.google.com/file/d/1e1ukvXzEnuth81GIMdN-PhyAUSVdi3t5/view?usp=sharing https://drive.google.com/file/d/16_wDv8ehgogdtuFB8M02t7MlyO4YgH_9/view?usp=sharing