« first day (3335 days earlier)      last day (1611 days later) » 

2:00 AM
||> 1
 
@BenjaminGruenbaum 1 Logged: ``
 
||> console.log(Array(10000).join('.'))
 
@BenjaminGruenbaum undefined Logged: "...............................................................................................................................................................................................................................................................................................................................................................................................................
 
||> console.log(Array(1e8).join('.'))
 
@BenjaminGruenbaum Error: Isolate was disposed during execution due to memory limit Logged: ``
 
2:01 AM
lol
||> Promise.resolve()
 
@BenjaminGruenbaum {} Logged: ``
 
||> function f() { Promise.resolve().then(f); Promise.resolve().then(f);}
 
@BenjaminGruenbaum undefined Logged: ``
 
||> function f() { Promise.resolve().then(f); Promise.resolve().then(f); } f();
 
@BenjaminGruenbaum Error: Isolate was disposed during execution due to memory limit Logged: ``
 
2:03 AM
||> (0, eval)('this')
 
@BenjaminGruenbaum "TypeError: Converting circular structure to JSON\n --> starting at object with constructor 'global'\n --- property 'global' closes the circle" Logged: ``
 
]||> (0, eval)('process')
@JBis I think there is one loophole in the way this works with indirect eval, I would caution to remove eval here to prevent context escape
 
@BenjaminGruenbaum "ReferenceError: process is not defined" Logged: ``
@BenjaminGruenbaum "TypeError: Cannot read property 'version' of undefined" Logged: ``
@BenjaminGruenbaum "ReferenceError: constructor is not defined" Logged: ``
@BenjaminGruenbaum undefined Logged: ``
@BenjaminGruenbaum "object" Logged: ``
 
Now let's try something else
||> Object.keys(console)
 
@BenjaminGruenbaum ["_items","log","debug","info","error"] Logged: ``
 
2:06 AM
fun
||> console._items = 'topkek';
@JBis lmao, sorry :(
||> console._items = [];
 
@BenjaminGruenbaum [] Logged: ``
 
Hi benji
 
Hey, there are two issues I found real quick, but it's hardly pen-testing. One is in the global context (global this) and the other is in _items.
I spent literally 5 minutes on it, am bored in the airport in Tokyo :D
 
So couple things
 
inb4 something like ||> console._items = { toJSON() { /* can run any code I want here */ } }
 
2:08 AM
I noticed the issue with being able to accesses that in my own testing. Directly access console._items maybe an issue. And the other thing is accessing the done function directly:
||> typeof global.done
 
@JBis "function" Logged: ``
 
You can't just call JSON.stringify on the output because I can override things like the toString on objects that are nested - it is not safe.
 
||>window
 
@nyconing "ReferenceError: window is not defined" Logged: ``
 
@BenjaminGruenbaum I see this however I am not sure how this could be used to attack. Hold on let me send you a link to what I tried:
 
2:10 AM
||> console._items = 'topkek'
This literally broke the bot and ooutput ^
You see, no response. I did it and then unbroke it with:
||> console._items = [];
 
@BenjaminGruenbaum [] Logged: ``
 
With setting it to something with toJSON to run arbitrary things, I would rather avoid it though.
 
its starts here: chat.stackoverflow.com/transcript/message/47970143#47970143 but theres a lot of edits, I still couldn't break it
@BenjaminGruenbaum only for your command
||> console._items = 'topkek'
||> "Adfad"
 
@JBis "Adfad" Logged: ``
 
see what I mean? it only breaks it for your command
||> console._items = { toJSON() { process.exit() } }
 
2:12 AM
@JBis ReferenceError: process is not defined Logged: ``
 
still doesn't work
the only thing that bypasses is ziraks filter script, but it is contained within the isolate
 
||> arguments.callee
 
@BenjaminGruenbaum undefined Logged: ``
 
||>Object.keys(this).substring(0,400)
 
@nyconing "TypeError: Object.keys(...).substring is not a function" Logged: ``
 
2:14 AM
@JBis I am pretty sure I can make it work
 
In fact, JSON functions protect from passing objects with functions
@BenjaminGruenbaum do it (not I challenge, i just want to see what you do)
 
too much work
 
||>JSON.stringify(Object.keys(this)).substring(0,400)
 
@nyconing "[\"global\",\"done\",\"runCode\"]" Logged: ``
 
also i added this cool functionality that cap didn't have:
 
2:14 AM
||> console._items = { toJSON() { global.runCode(global.runCode.toString()) } }
 
@BenjaminGruenbaum RangeError: Maximum call stack size exceeded Logged: ``
 
||> return "implicit iife is cool"
 
@JBis "implicit iife is cool" Logged: ``
 
||> Object.defineProperty(console, '_items', { get() { return global.done(); } })
 
@BenjaminGruenbaum "ReferenceError: Obhject is not defined" Logged: ``
 
2:15 AM
||>JSON.stringify(Object.keys(global)).substring(0,400)
 
@nyconing "[\"global\",\"done\",\"runCode\"]" Logged: ``
 
I should just read the code lol. Or run the ses stuff to get an escape thingie
 
||>JSON.stringify(Object.keys(done)).substring(0,400)
 
@nyconing "[]" Logged: ``
 
||>JSON.stringify(Object.keys(runCode)).substring(0,400)
 
2:16 AM
@nyconing "[]" Logged: ``
 
@BenjaminGruenbaum interesting
 
Nah, that's not it :]
 
@BenjaminGruenbaum how do you suggest I capture console.log?
 
||> Function.prototype.applyIgnored
 
@BenjaminGruenbaum undefined Logged: ``
 
2:18 AM
Probably can also break the sandbox via ||> Object.defineProperty(Array.prototype, 'fill', { get () { return require('primordials') or something
Anyway, need to get to my gate :D This is still fun maybe I will give it as an exercise to my students
 
haha
for sure, you can even taunt them with the fact it was written by a 16 year old XD
lol feel free to continue testing and thanks!
@BenjaminGruenbaum and have a safe flight!
@BenjaminGruenbaum another potential source of issue is the following:
    const code_to_run = `runCode(\`${code.replace(/\\/g, "\\").replace(/`/g, '\\`')}\`)`;
 
2:43 AM
!~>ironman
!~>ironman
 
3:03 AM
!~>ironman
!~evalcs ironman
@nyconing ..>ironman
@nyconing ..>CodeWorker complete in 921ms
!~evalcs ironman
@nyconing ..>ironman
@nyconing ..>CodeWorker complete in 879ms
!~sdgdfcvb
!~evalcs ironman
@nyconing ..>ironman
@nyconing ..>CodeWorker complete in 882ms
!~>ironman
 
@nyconing how are you sandboxing your eval? Is your bot open source?
 
!~help
@nyconing Hi,
Nyconing bot is born from mother Zirak/SO-ChatBot
No any further information is collected from original Zirak bot is collected.
You can starts by recommended commands:
·google | Search Google. `/google query`
·wiki | Search Wikipedia. `/wiki term`
·eval / > | Runs C# codes.
·msdn | Fetches msdn page. `/msdn what`
... more commands see !~listcommands
no, its not open source, yet
 
Yes but how do you sandbox your eval command?
 
its c#
 
I mean how do you prevent people from exploiting it?
 
3:17 AM
so far it was safe and no further security vulnerability found, it may can be abused with memory or stack overflow, and it will recover after 5 seconds
 
interesting
i will take look when you make open source
 
it was sandboxed in restricted appdomain
 
i don't know enough c# to test
 
!~>ironman
@nyconing ..>an
@nyconing ..>CodeWorker complete in 901ms
!~>ironman
@nyconing Could not process input. Error: msg.get is not a function
!~>brokeironman
@nyconing Could not process input. Error: msg.get is not a function
!~>ironman
@nyconing ..>CodeWorker complete in 1390ms
@nyconing ..>ironman
!~>int.MaxValue
@nyconing ..>2147483647
..>CodeWorker complete in 776ms
!~>long.MaxValue
/~>CodeWorker complete in 782ms
/~>9223372036854775807
!~>Thread.Sleep(2000)
/~>{void}
/~>CodeWorker complete in 3005ms
!~>
/~>{ null or empty}
/~>CodeWorker complete in 870ms
!~>
/~>{ null or empty}
/~>CodeWorker complete in 810ms
!~>int.MinValue
/~>-2147483648
/~>CodeWorker complete in 734ms
!~>Thread.Sleep(4950)
!=>{void}
!=>CodeWorker complete in 5835ms
!~>5/0
!=>Division by constant zero
!>>CodeWorker complete in 667ms
!~>A
!~+A
!=>; expected
!>>CodeWorker complete in 995ms
!~>info
!=> Runtime
- Elevated: True
- Memory: 1348780
Compiler
- Type: Roslyn
- Provider: Microsoft.CodeDom.Providers.DotNetCompilerPlatform.CSharpCodeProvider
- Version: 3.300.119.46102
- Parameters: /langversion:8.0 /lib:"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\.NETFramework\v4.8"
References
- Libs: run 'listLibs[page]' (450chars per page)
- .NET version: 4.8.3761.0
!>>CodeWorker complete in 23ms
!~>int.MaxValue
!>>CodeWorker complete in 778ms
!=>2147483647
!~>classtemplate
!=> !~>{
static object Main(){ return Foo(); }
static object Foo(){ return "Hello World! :)"; }
}
!>>CodeWorker complete in 9ms
!~>help
!=> Eval-er Guide
Requests:
·!~> Normal Eval
·!~+ Timed Eval

Responses:
·!=> Eval-ed result
·<!> Compilation Error
·!>> Timed result
!>>CodeWorker complete in 13ms
!~>
!!->
!=>Invalid expression term '->'
!>>CodeWorker complete in 472ms
!~>A
!!->A
!=>The name 'A' does not exist in the current context
!>>CodeWorker complete in 717ms
!~>help
!=> Eval-er Guide
Requests:
·!~> Normal Eval
·!~+ Timed Eval

Responses:
·!=> Eval-ed result
·!>> Timed result
·<!> Compilation error
·!!-> Exception thrown
!>>CodeWorker complete in 11ms
 
4:48 AM
!~>ironman
!=>ironman
!~>5/0
<!>Adapter: CodeWorker cannot be contacted. CodeWorker may not running
!=>Division by constant zero
!~>info
!=> Runtime
- Elevated: True
- Memory: 336424
Compiler
- Type: Roslyn
- Provider: Microsoft.CodeDom.Providers.DotNetCompilerPlatform.CSharpCodeProvider
- Version: 3.300.119.46102
- Parameters: /langversion:8.0 /lib:"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\.NETFramework\v4.8"
References
- Libs: run 'listLibs[page]' (450chars per page)
- .NET version: 4.8.3761.0
!~+info
@nyconing Maybe you meant: info
!~>ironman
!=>ironman
!~>5/0
!=>!@#$%^&*()<cerror>:Division by constant zero
!~>info
!=> Runtime
- Elevated: True
- Memory: 410400
Compiler
- Type: Roslyn
- Provider: Microsoft.CodeDom.Providers.DotNetCompilerPlatform.CSharpCodeProvider
- Version: 3.300.119.46102
- Parameters: /langversion:8.0 /lib:"C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\.NETFramework\v4.8"
References
- Libs: run 'listLibs[page]' (450chars per page)
- .NET version: 4.8.3761.0
!~>classtemplate
!=> !~>{
static object Main(){ return Foo(); }
static object Foo(){ return "Hello World! :)"; }
}
!~>{
static object Main(){ return Foo(); }
static object Foo(){ return "Hello World! :)"; }
}
!=>Hello World! :)
 
5:25 AM
!~+{
static object Main(){ return Foo(); }
static object Foo(){ return "Hello World! :)"; }
}
!=>Hello World! :)
!>>CodeWorker complete in 829ms
 
 
3 hours later…
8:44 AM
!~>"ironman"
!=>ironman
!~>"ironman"\nironman"
<!>; expected
!~>"ironman\nironman"
!=>ironman
ironman
<!>
!=>
!+> A
<!>A
!~>ironman
!=>{null or empty}
!~>"ironman\nironman"
!=>ironman
ironman
!~>ironman
!=>ironman
!~>"iron\nman"
!=>iron
man
!~>"iron\nman"
!=> iron
man
!~>ironman
!=>ironman
!~>5/0
<!>Division by constant zero
!~+Environment.CurrentDirectory
-!!>Request for the permission of type 'System.Security.Permissions.FileIOPermission, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.
!>>CodeWorker complete in 789ms
!~>ironman/0
<!>The name 'ironman' does not exist in the current context
!~>help
!=> Eval-er Guide
Requests:
·!~> Normal Eval
·!~+ Timed Eval

Responses:
·!=> Eval-ed result
·!>> Timed result
·<!> Compilation error
·-!!> Exception thrown
!~>classtemplate
!=> !~>{
static object Main(){ return Foo(); }
static object Foo(){ return "Hello World! :)"; }
}
!~>classtemplate-json
!=> !~>{
static object Main(){ return Foo(); }
static object Foo(){
return JsonConvert.SerializeObject(new Vm{ Name="IronMan", Time=DateTime.Now });
}
class Vm{ public string Name; public DateTime Time; }
}
!~>{
static object Main(){ return Foo(); }
static object Foo(){
return JsonConvert.SerializeObject(new Vm{ Name="IronMan", Time=DateTime.Now });
}
class Vm{ public string Name; public DateTime Time; }
}
!=>{"Name":"IronMan","Time":"2019-12-03T17:00:02.5540064+08:00"}
!~>{
static object Main(){ return Generate(); }
static string Generate(){
var r = new Random();
var c = new List<char>();
while (c.Count<500){c.Add((char)r.Next(20000,90000));}
return new string(c.ToArray());
}
}
!=>Http listener: Error: The process cannot access the file 'C:\Users\Nyconing\AppData\Local\Temp\Newtonsoft.Json.dll' because it is being used by another process.
!~>{
static object Main(){ return Generate(); }
static string Generate(){
var r = new Random();
var c = new List<char>();
while (c.Count<500){c.Add((char)r.Next(20000,90000));}
return new string(c.ToArray());
}
}
!=> 爛倩дګ퐊퇏Ƀ伨꾻庨ꢮ툇缛行燓૥공ả翅븩Ы奛叒▇�碴⵼淢瞬䔈叜䠩釸꟣㇮뫮꧀︖侸㧎饱㓅㉁ᦉ◿ଗﯘ쿷颮ꬶ咃噝ﺂ嶰䂴媫Ꜻ㑗䃕蘯礰둡䲳抒⦀㢆冖쌂츁⧭ὺ纜噻勖ỵ뉅赕쉛�쌰्鴅ࣱ≞�꺤ꓼ榁墈慡঵蝼雲ⱦᆌ⑖㈠৑嬔᛿㳅碵蔃츅曅䵮觖咄첚ਜ਼ᖏત巬﷎퍚溯摈여扽詢늟ヴస푷ᴞਃ刟I좎ㄢ똼凝ො牯럥褋স狮뀇폯�뚖厵�颖粷豑χ᯸鈄堦��Ꝑ�夞ꤶ醊靇ꉛ窳㱟㣈굳ᡖ鸯�榕䔳먟㦐伟㧪㹀ꔆꏂ軖뾌⎇숗⑖㍡붥앀获⪮㼚轼꺡ꢁ㬶富Ꝝ﴾�⎡姷ˈ烜ḣ꿸렄圦b秊偪芸웬桿ㆍ퍏㿔뗬圝馫佞ꄶ梘๠訊ϗ妞�戉ⰾݘ◴䮀쫅씥滟齚呒톉荙뒞⑭⡤ં⠠鑁횃똆箇僿釒Ғ킊㽾号䙡桬ꑺ㡤咭㎴抰ꢡ뱔�﵊몇느꾹摱��䖌�㭇⓬囌ஒﻖ愸锍始穷뢉䭶笮ꪄ뾀偈픡췢鱎魄樛冖崻简槒叀꼩岊땨貴�⾸霻苽캫閉㦡鐍̎㓠蘸萰쏓렕᥼睿坴엉郪粅䱀ࠛ恸剏刜듡祛吪萭氌兀ೡﮡ�癥᭪咕虹숼啖匈铊⫭뙭禲ҵ솓凣똿ꗔ犝︡낸䌇炥쩼醌틠棒ﴃﻓ桋脐ᚁᰄ赀伺⿆僾赯⸾褌֖㲾ছ㠬곷勝蜇ﵻ㷨핋㸲峟餈命仫䰓ꐥჂ荽싀䡀艳僈ꋶ뜁ꏯ敔痌讑ᆁ욚䐤�䅛弘⁺ꉭ߂턜임蔁웦颂㻣響䑷帮稛퐽쎋쑆Ẋ闎斒汪圚煜륳㕔聪坘幸뵸壘꒝㒜汒䂟᪎아흤꼧㮠沞쒜쩻郥箂凬籴췾ₘ怜䞥薇
!~classtemplate
!~>classtemplate
!=> !~>{
static object Main(){ return Foo(); }
static object Foo(){ return "Hello World! :)"; }
}
!~>classtemplate
!=> !~>{
static object Main(){ return Foo(); }
static object Foo(){ return "Hello World! :)"; }
}
!~>null
!=>Http listener: Error: Object reference not set to an instance of an object.
!~>(string)(null)
!=>Http listener: Error: Object reference not set to an instance of an object.
!~>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
!=>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
!~>{}
!=>Ahoooy your class was empty hooooy
!~>{private void A(){}}
!=>Ahoooy your class was empty hooooy
!~>JsonConvert.SerializeObject("asd")
!=>"asd"
!~>JsonConvert.SerializeObject(456)
!=>456
!~>classtemplate
!=> !~>{
static object Main(){ return Foo(); }
static object Foo(){ return "Hello World! :)"; }
}
!~>{
static object Main(){ return Foo(); }
static object Foo(){ return "Hello World! :)"; }
}
!=>"Hello World! :)"
!~>ironman
!=>"ironman"
!~>"iron\nman"
!=>"iron\nman"
!~>classtemplate-json
!=> !~>{
static object Main(){ return Foo(); }
static object Foo(){
return JsonConvert.SerializeObject(new Vm{ Name="IronMan", Time=DateTime.Now });
}
class Vm{ public string Name; public DateTime Time; }
}
 
9:40 AM
!~>classtemplate-json
!=> !~>{
 static object Main(){ return Foo(); }
 static object Foo(){
  return JsonConvert.SerializeObject(new Vm{ Name="IronMan", Time=DateTime.Now });
 }
 class Vm{ public string Name; public DateTime Time; }
}
!~>{
 static object Main(){ return Foo(); }
 static object Foo(){
  return JsonConvert.SerializeObject(new Vm{ Name="IronMan", Time=DateTime.Now });
 }
 class Vm{ public string Name; public DateTime Time; }
}
!=>"{\"Name\":\"IronMan\",\"Time\":\"2019-12-03T17:40:48.0605193+08:00\"}"
!~>5/0
<!>Division by constant zero
!~>Thread.Sleep(6000)
-!!>SandBox:Unable to complete invocation by given 5 seconds
 
10:02 AM
!~>ironman
!=>"ironman"
!~+ironman
!=>"ironman"
!>>CodeWorker complete in 870ms
!~=ironman
!=>ironman
!~="iron\nman"
!=> iron
man
!~>"iron\nman"
!=>"iron\nman"
!~>help
!=>  Eval-er Guide
Requests:
·!~> Eval returns object
·!~= Eval returns string
·!~+ Eval Timed

Responses:
·!=> Result, an object
·!=> Result, a string
·!>> Result, Timed (ms)
·<!> Compilation error
·-!!> Exception thrown
!~>man
!=>"man"
!~=man
!==man
!~=classtemplate-json
!== !~>{
 static object Main(){ return Foo(); }
 static object Foo(){
  return JsonConvert.SerializeObject(new Vm{ Name="IronMan", Time=DateTime.Now });
 }
 class Vm{ public string Name; public DateTime Time; }
}
!~={
 static object Main(){ return Foo(); }
 static object Foo(){
  return JsonConvert.SerializeObject(new Vm{ Name="IronMan", Time=DateTime.Now });
 }
 class Vm{ public string Name; public DateTime Time; }
}
!=={"Name":"IronMan","Time":"2019-12-03T18:14:29.139567+08:00"}
 
10:48 AM
stop
 
HAMMERTIME!
 
HAMMERTIME!
 
STOP
stahp
 
HAMMAHTIME!
 
HAMMAHTIME!
 
10:48 AM
stop
 
HAMMERTIME!
 
HAMMERTIME!
 
.
stop
stahp
 
HAMMAHTIME!
 
HAMMAHTIME!
 
10:49 AM
stop
 
HAMMERTIME!
 
HAMMERTIME!
 
stop
 
HAMMERTIME!
 
HAMMERTIME!
 
10:50 AM
.
stop
 
11:17 AM
@Wietbot evalnode startup
 
@Wietlol ReferenceError: startup is not defined
@Wietlol ReferenceError: startup is not defined
 
@Wietbot are you seeing double?
 
I don't know this command, did you mean any of the following? join, leave
I don't know this command, did you mean any of the following? join, leave
 
yes, you are
@Wietbot leave 1
@Wietbot test
@Wietbot test
 
I don't know this command, did you mean any of the following? join, leave
I don't know this command, did you mean any of the following? join, leave
I don't know this command, did you mean any of the following? join, leave
 
11:22 AM
@Wietbot are you seeing stuff 3 times now?
 
I don't know this command, did you mean any of the following? join, leave
I don't know this command, did you mean any of the following? join, leave
 
why are you doing this to me?
what did I do to you, other than trying to break you and make other people break and abuse you?
 
lol
maybe he gets more reads
and get a error 500 while post a multiple msg at same time
 
11:43 AM
@Wietlol if its anything like my bot
You'll have to implement something to stop it triggering when it sends a message
 
what do you mean?
it is fully asynchronous
it sends stuff to a queue to be processed
 
then continues to read messages
 
so it'll be interpreting ITS message as a command
which could explain the double message
 
oh, it doesnt listen to its own messages, which it should after all, but I havent changed that yet
 
11:45 AM
IIRC that was a problem for me
i see
@Wietbot are you dumb
oh shit no
tell a lie
 
I don't know this command, did you mean any of the following? join, leave
I don't know this command, did you mean any of the following? join, leave
I don't know this command, did you mean any of the following? join, leave
 
mine was firing the send message twice
O_O
 
I think my websocket listener is broken
I would need an event listener that keeps track of the events
and only sends events through when it is a new event id
I thought this would only happen once in a week or so
so I didnt spend any time on it yet
but now, I assume through joining and leaving several times, it keeps adding more and more events
in the logging, I can see the duplicate events piling up
 
That sounds about right
if you are not removing the sockets when leaving
 
I reconnect when joining tho
closing the old connection
join should reset that error
 

« first day (3335 days earlier)      last day (1611 days later) »