Project Sekai - ✅-misc-vimjail15

Project Sekai

🔒 UIUCTF 2023 / ✅-misc-vimjail15

vimjail1.5 - 250 points

Category: Misc Description: Fixed unintended solve in vimjail1 Connect with socat file:$(tty),raw,echo=0 tcp:vimjail1-5.chal.uiuc.tf:1337. You may need to install socat. Author: richard Files:

Tags: medium

Sutx pinned a message to this channel. 06/30/2023 9:05 PM

@unpickled admin bot wants to collaborate

https://vim.rtorr.com/

i dont get why Ctrl C doesnt work

22:53

ctrl+x does something (autocomplete) (edited)

22:54

not sure how it helps though

@jayden wants to collaborate

omg its a vim user

@Rench wants to collaborate

23:10

@kanon wants to collaborate

current angle im viewing is

23:32

somehow getting a word typed

23:32

then hitting k on it will open man, and we can trivially shell from there

are the attachments any useful?

23:33

when you diff vimjail1 and 1.5

23:35

wait

the only diff is blocking my bug from earlier, which is in inoremap <c-\> nope

23:35

earlier it was inoremap <c-\><c-o> nope

why vmjail 1 has more restrictions than 1.5

23:35

yeah there was 2 banned

23:35

now just 1?

inoremap <c-\><c-o> actually means you cannot hit those in those combo

23:36

not they are both banned

oh

23:36

ic

23:36

so only that vimrc matters?

i think so

23:36

not too sure

@Violin wants to collaborate

not sure why ctrl - n worked in the other chall, trying to see that

whats 1 payload?

ctrl \, ctrl n

23:37

or

23:37

ctrl \, ctrl o (edited)

unpickled admin bot

ctrl \, ctrl n

i do this nothing happened

uh

the "insert" line disappeared

23:38

then what to do

ye

23:38

that means you can do :tabe flag.txt

23:38

i.e you escaped insert mode and went into normal

oh so we are default in insert mode?

23:38

ic

ye

23:39

if we can escape insert into normal, ik for a fact i can solve both challs :tabe flag.txt and :q for (1,2) (edited)

have you tried chatgpt?

sahuang

have you tried chatgpt?

nop

23:39

uh should i just send the vimrc?

in chal1 it has inoremap <c-\><c-n> nope but why ctrl \, ctrl n works?

good question, i got no clue!

23:41

i had to do ctrl \, ctrl shift n (or something arb that doesnt do anything), ctrl n

ah yeah doesnt work

chatgpt said: <Ctrl-C> <Ctrl-[> <ESC> all exit insert

23:42

and that <Ctrl-V> disables mappings

23:44

none of those worked on 1

23:44

does <F1> work in insert mode?

Image attachment

23:45

doesnt for me :< (edited)

Image attachment

23:48

uh does this help at all?

i tried all of those options

23:48

so like

23:48

^X^], ^X^D (edited)

idk I'm just trying random shit until something new pops up

23:48

oh ok lol

i got read only on all but ^X^E and ^X^Y (i think Y)

23:49

not sure what it does tho (edited)

Rench

idk I'm just trying random shit until something new pops up

hey thats my approach too!

Violin

used /ctf submit

✅ Well done, challenge solved!

how?

done xdf

how do yo udo it?

=eval(readfile(glob("/flag.t*t"))[0])
E121: Undefined variable: ctr1_r_1s_h4ndy_277d0fde079f49d2
Press ENTER or type command to continueis off
E15: Invalid expression: "uiuctf{ctr1_r_1s_h4ndy_277d0fde079f49d2}"

how did you type =eval(readfile(glob("/flag.t*t"))[0])?

00:15

shows E21 for me

oh ctrl r

00:15

so after it type =

ooh

00:16

interesting

oooo

00:19

@Violin does tab auto complete work with ctrl r

00:19

btw

Exported 82 message(s)