Guild icon
Project Sekai
🔒 UIUCTF 2023 / ✅-misc-vimjail25
Sutx pinned a message to this channel. 06/30/2023 9:05 PM
Avatar
@jayden wants to collaborate 🤝
Avatar
@Violin wants to collaborate 🤝
Avatar
gives viminfo
Avatar
@unpickled admin bot wants to collaborate 🤝
Avatar
seems only q and numbers and capital letters arent banned
Avatar
@kanon wants to collaborate 🤝
Avatar
unpickled admin bot 07/01/2023 12:20 AM
@sahuang does tab autocomplete work with ctrl r
00:20
(i cant ctrl r for some fucking reason)
Avatar
and ()
00:20
idk
00:21
oh
Avatar
unpickled admin bot 07/01/2023 12:21 AM
like q<tab>
Avatar
not banned
Avatar
@Rench wants to collaborate 🤝
Avatar
i can get =eval(
Avatar
Avatar
sahuang
seems only q and numbers and capital letters arent banned
yes
00:22
ctrl q
Avatar
Avatar
unpickled admin bot
(i cant ctrl r for some fucking reason)
unpickled admin bot 07/01/2023 12:22 AM
nvm im an idiot
Avatar
but you cant type flag.txt
Avatar
Avatar
sahuang
i can get =eval(
unpickled admin bot 07/01/2023 12:22 AM
wait how?
Avatar
oh you can
Avatar
can you try same payload?
00:22
eval(readfile(glob("/flag.t*t"))[0])
Avatar
Avatar
unpickled admin bot
wait how?
unpickled admin bot 07/01/2023 12:22 AM
tab auto?
Avatar
Avatar
Violin
eval(readfile(glob("/flag.t*t"))[0])
you need to use tab to auto complete
Avatar
Avatar
Violin
eval(readfile(glob("/flag.t*t"))[0])
unpickled admin bot 07/01/2023 12:23 AM
no letters they get sub with _
Avatar
and get this payload
00:23
@Violin why cant .txt?
00:23
also . is banned
Avatar
unpickled admin bot 07/01/2023 12:23 AM
can you type *
Avatar
banned too
Avatar
unpickled admin bot 07/01/2023 12:23 AM
how about ? (edited)
Avatar
cnoremap ! _ cnoremap @ _ cnoremap # _ cnoremap $ _ cnoremap % _ cnoremap ^ _ cnoremap & _ cnoremap * _ cnoremap - _ cnoremap + _ cnoremap = _ cnoremap ` _ cnoremap ~ _ cnoremap { _ cnoremap } _ cnoremap [ _ cnoremap ] _ cnoremap \| _ cnoremap \ _ cnoremap ; _ cnoremap < _ cnoremap > _ cnoremap , _ cnoremap . _ cnoremap / _ cnoremap ? _
Avatar
unpickled admin bot 07/01/2023 12:23 AM
? doesnt seem banned
00:23
o
00:24
nvm
00:24
can get this
Avatar
unpickled admin bot 07/01/2023 12:24 AM
(we just need to exit)
00:24
btw
00:24
not even shell
00:24
just exit
Avatar
idk what command exits
00:25
.
00:25
"" not banned
Avatar
ummm wait, why i got
Avatar
Avatar
Violin
ummm wait, why i got
unpickled admin bot 07/01/2023 12:26 AM
tab auto complete
Avatar
yeah but last part cant be done
00:27
the .t*t and [0]
Avatar
unpickled admin bot 07/01/2023 12:28 AM
ok wait i think i can construct flag.txt
Avatar
unpickled admin bot 07/01/2023 12:28 AM
lemme try rq lol
00:30
ok got flag
00:30
not sure what to do from here for .
00:30
but you can get arb letters trivially
Avatar
what the command
Avatar
unpickled admin bot 07/01/2023 12:30 AM
just tab until you have a function name with the letter you want
Avatar
ctrl r?
Avatar
unpickled admin bot 07/01/2023 12:30 AM
then delete all the letters other than that
00:30
thats the way
00:30
but cant do .
Avatar
unpickled admin bot 07/01/2023 12:30 AM
ye
00:30
😭
Avatar
actually flag* will do
Avatar
unpickled admin bot 07/01/2023 12:31 AM
we dont have *
Avatar
or just fl*
00:31
yeah ik
Avatar
unpickled admin bot 07/01/2023 12:31 AM
we have ? tho!
Avatar
need to get one
00:31
no ?
sahuang pinned a message to this channel. 07/01/2023 12:31 AM
Avatar
unpickled admin bot 07/01/2023 12:32 AM
no ?
00:32
ye
00:32
:<
Avatar
ctrl l auto complete too?
Avatar
idk, just use tab
Avatar
unpickled admin bot 07/01/2023 12:36 AM
we can use nr2char
00:36
to get a .
Avatar
unpickled admin bot 07/01/2023 12:37 AM
and like
00:37
also any character
Avatar
no + tho
Avatar
unpickled admin bot 07/01/2023 12:37 AM
ye
00:43
got an idea (edited)
00:43
maybe we can use a printf?
00:43
to format string in the flag.txt?
Avatar
solved
Avatar
Avatar
Violin
used /ctf submit
✅ Well done, challenge solved!
00:45
=eval(readfile(glob("/flag.t*t"))[0]) E488: Trailing characters: _kn0w_h0w_7o_ex1t_v1m_7661892ec70e3550 Press ENTER or type command to continue E15: Invalid expression: "uiuctf{1_kn0w_h0w_7o_ex1t_v1m_7661892ec70e3550}" Press ENTER or type command to continue
Avatar
no i mean how you enter . and *
Avatar
we can use ctrl q
00:46
and type 🙂
Avatar
Avatar
Violin
yes
this
Avatar
unpickled admin bot 07/01/2023 12:47 AM
o
00:47
lol
Avatar
unpickled admin bot 07/01/2023 12:48 AM
i will stick to nano, nano much nicer
00:48
lmao
Exported 105 message(s)