nailed it the first time

!!caaaaat

!!caaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaat

@oldmud0 It's slightly different this time :)

But the same password ...

this is violation of tos, look at all the copyright infringe

dont su pls

Err @Rahul2001: Your page is a lie

> The proxy script consists of only one line of code: <?=file_get_contents($_REQUEST['url'])?>

No, it contains six lines of code.

We can see all your PHP code ;)

@cat yeah, that is to suppress errors, not relevant

Also I'm deffo not running an EXE that 7 AV programs think is a worm

@BenN how? What did I miss?

Time for some disassembly!

@BenN what? It is detected as a virus?

virustotal.com/en/file/…

@tereško from what i can tell with an overclocking MB simple overclocking can be done with a non-K , just using the turbo features and having a board that will allow to adjust all that. For example i had a $60 chip that reached 4k in 5 minutes of overclocking. but that chip was also cheap were other things counted, on-die cache and cores.

joseph.pyrotech.club/medacium_src.bat

@BenN

@Psycogeek .. until intel pushes another microcode update

@Rahul2001 It's still a lie!

@cat how did you see that though?

404

joseph.pyrotech.club/mendacium_src.bat

@Rahul2001 Your "vulnerability"

@cat ah, didn't realise it would show itself :p

@tereško yea but i was not referring to that, special full control overclocking. even back in core2 people bought Ks and were going to end up with 20-25% simple 24-7 overclocking not award winning stuff. you just bumped the strap to 25% and tweak the voltage a bit, and it was done.

What did you expect file_get_contents(<anything the user specifies>) was going to do? :-P

Fun fact: it works on /etc/passwd too

lol

And probably on web server logs

Anyway, is there anything beyond this quiz, or do I win?

@Psycogeek ok, I will keep in mind the "downgrade CPU a bit" as an option

(the build is not for me)

@BenN I don't think it will work...

It doesn't give actual passwords, but a list of users

@BenN um... Login and see?

Shit... That vulnerability backfired

@tereško my last K didnt change the price doodle, i think it was $20 change.

I guess that's why they call it a vulnerability ;)

yay

say what

@cat f*ck

I made it wrong...

What, @BenN has won already

Ye

rip webserver

@cat I dont think so

actually, rip all the services on this machine

FUCK

...

something's wrong with my Arch

!!doublefacepalm

it has frozen second time in 10 minutes (full lockup, looks like GPU drive crash)

this challenge is banking on the fact that nobody's going to hack the entire system

You can't really do anything just by reading files

mendacium.exe?

Was that what the virus scanners said was a trojan?

Yep

What if I want to read /dev/hda

What if I want 50 clients to read /dev/hda?

> <b>Parse error</b>: syntax error, unexpected ':', expecting ',' or ';' in <b>/home/rahulcom/public_html/pyrotech.club/rahultishack/chucknorris/serverroot/‌​public_html/proxy.php</b> on line <b>4</b><br />

I think you have to be root for that to work

Hi /home/rahulcom/public_html/pyrotech.club/rahultishack/chucknorris/serverroot

@cat FIXED!

@cat the vulnerability won't backfire any more :D

Good job for trying to fix something that's obviously broken

Who is Joseph anyway

@oldmud0 It's ment to be broken, just not too broken

@cat random fictional dude

@cat try logging into his account?

@Rahul2001 Make me

@cat eh, suit yourself

As MC Hammer would say, it's party time.

@ChatBotJohnCavil :D

Eh, you guys destroyed the challenge :P

What did you expect? We're the Internet

BUT, saved me from future embarrassment :D

Anyways, I'll have to see about that exe now

Is this EXE packed or something? I'm still not going to run it on my main machine, but I'm a little curious

bat-to-exe :P

Oh, that's probably what triggered the virus alert

For god's sake, it is 64 goddamn KB, how can it be a trojan?

Shellcode is usually about a KB

Put a hexeditor on it

heh

I have it open in IDA and it looks obfuscated

Is it UPX'd?

huh...

let me look for alternatives

You could just write a simple .NET thing

It's super easy to decompile, but the quiz isn't terribly difficult either

dd if=/dev/zero of=/dev/sda is only 30 bytes.

So many girls in this hotel...

Hm....

@cat thinking or asking one (or more) out?

Well I got your /etc/passwd in your flub. But it doesn't look like any of the services on it are enabled.

@oldmud0 You shouldn't be able to get it now, I fixed it

They probably wouldn't be reachable from the internet, and modern Linuces put the actual hashes in /etc/shadow, which is only accessible to root

Tab is still open.

@oldmud0 LOL

See, I know at least a couple of things about non-Windows!

@BenN More than me, anyways...

@Rahul2001 Err if you don't know about /etc/shadow and /etc/passwd you have no business running a honeypot public server (especially one with access to the school network)

@cat I know more than the rest :P

Seriously though, this is just a temporary setup

I need to sandbox it

VM?

Super easy and pretty secure

Yeah yeah, your biggest mistake was posting it in a public chat room full of geeks tbh.

This isn't temporary, you've clearly done a lot of these things

@oldmud0 ??

I had a job interview once where they basically gave you access to one of their internal servers and asked you to do stuff. And be good.

@cat Well, I learn more stuff in an hour from you guys than I do in a year from school

before making php files with a "not-invented-here" attitude, please put it in a docker container or something

Candidates were trusted to not muck about, and tbh, it'd be self-defeating to try break it

Docker is not security.

Right, you need an actual hypervisor if you want to separate the guest from the host

Hyper-V is pretty awesome

well at this point any kind of separation is better than no security

why you suggesting him stuff he ovsiouly can't use

@oldmud0 I don't have a "not-invented-here" attitude, more like a "I-made-this-and-I-want-you-guys-to-crack-it" attitude

use kvm

My solution:

<?php
if($_REQUEST['url'] == "../rpass/tispass.txt")
{
	echo "password: damnit123";
}
?>

LOL

So, no more real proxy.

But now the Facebook example is broken!

well there's this silly attitude going around, especially visible in programming competitions, that you can't use well-established basic algorithms

Though it never really worked to begin with, because it wouldn't fix up references to other resources

@BenN Well, it would have been reported as phishing anyways

and of course, you're forced to use this behemoth of a language called java

That's what happened when I used to run a (proper) proxy

of course, we're preparing students to join the workforce with knowledge of a grossly insecure, bloated, deprecated language, which probably won't ever be directly used if they're not going to do enterprise applications or Android apps

You also might want to check if you're vulnerable to this (via TBG)

!!tell 31228527 headdesk

@cat :P

One of the worst things, that I hate most in the world...

also something outrageous that I don't see in computer science classes is a proper explanation of good design principles

@cat What do you hate?

that code?

The LAMP stack?

"Simulators" for tests/exams/demos that pretend to act like the product being simulated but in reality are just a bunch of "if command = X then print <something that looks like the command output>".

@BenN Do you happen to know c++?

Cisco uses them a lot for their certifications and exams -_-

Oh yeah, I hate packet tracer

Course, if you try do things a different way to the way it was described in the book, it'll just say "Invalid command" or some shit

What does that even use? an interpreter?

Gosh, how much work would it take just writing an emulator?

@cat lol, well they obviously cannot give you real vulnerable system

@Rahul2001 Sure they can, it's an exam ffs.

They can spawn as many VMs or emulators as they want. Heck, I can download and run an emulator myself

And when you open the "web browser," hey look crappy iexploder frame

fair enough...

@oldmud0 lol

IE6! :-x

@cat Hm... I'll work on the proxy tomorrow, it's 2:15 AM right now, not in the mood for input validation...

@Rahul2001 Just enough to produce this answer, and little tidbits I picked up from Raymond Chen

they don't even bother using awesomium or something like that

I know a lot more about the native Windows API than I do about actual C++

@BenN Shit, that's pretty cool

> First up, I'll have you know that I learned C++ and Win32 just for this question.

@BenN Good, you'll be a perfect Windows NT developer. Please follow me, we're going to the computer lab where all the old computers are.

Wow, that's dedication

...the kind only found on StackExchange

You'll do a lot for a +100 bounty when you're scrambling to get 2K rep

;p

@BenN Would you happen to know if I can embed multiple batch commends in C++?

You could always just launch a cmd /c process

Or dump out a batch file from an embedded resource and run it

@BenN Some bounty hunters on this site do barely more than copy and paste a knowledgebase article for 500 point bounties -_-

Incidentally, I have a hat IRL that says "bounty hunter"

@BenN No sensible AV detects it :/

Well, if anybody is using one of those 7, they'll be suspicious :/

What AV? Sorry I don't have an AV so couldn't scan it for you

waits for storm

@oldmud0 I don't use one either ;p

Log in to facebook, first post I see from someone:

> Thinking about everyone in Munich. Please stay safe indoors and no unneccesary risks!

Well, I use Windows Defender

Oh no, what happened in Munich?

Great. I already know some more shit's gone down without even checking the news.

bbc.com/news/world-europe-36870874 :(

Shooting, kills 9

Man, f this world

Every time I log in to Facebook...

... that said, these shootings get way too much media attention

I hear that crime is actually going down, but media coverage is ramping up

I hear all the killings are done by the guy who sells coffins...

but, people died

> Police say children may be among the victims.

@CanadianLuke hey...

crime is becoming more acute, I would agree with that

Y'know, more people get shot and killed by the police in the US every week, than have been killed by terrorists in the ten years to 2014?

@cat [citation needed]

It's all a huge hooha and exaggeration

@oldmud0 start.umd.edu/pubs/…

@Rahul2001 What?

um... hi?

@oldmud0 bbc.co.uk/news/magazine-36826297

It was supposed to be a greeting.

Oh sorry! I thought I offended you lol. How's it going

;)

ons.gov.uk/peoplepopulationandcommunity/healthandsocialcare/…

> In 2013 there were 8,416 alcohol-related deaths registered in the UK

More deaths due to alcohol per year in the UK, than all terrorism related deaths across Western Europe since 1970.

Don't tell people that! Or else we'll have another prohibition!

They want to take our civil liberties away to "protect us from extremists" huh.

Fuck that shit.

must be GTA. sue rockstar

You must be looking for Fox News

@cat problem is news is "new"s the same old stuff that has been killing people in mass quantity for 2000 years isnt new.

> A total of 32,658 people were killed by terrorists around the world in 2014 - an 80 per cent increase on the previous year, according to the Global Terrorism Index.

Meanwhile:

> There were an estimated 198 million cases of malaria worldwide (range 124–283 million) in 2013, and an estimated 584 000 deaths

news has been sensationalist stuff since 80s

> UNFPA estimated that 289,000 women died of pregnancy or childbirth related causes in 2013.

> Every day, approximately 830 women die from preventable causes related to pregnancy and childbirth.

Meanwhile, 9 people getting shot makes international news.

On a more unrelated note, According to a survey, only 1/3 Women will date a Trump supporter

Hah

can we stop making meaningless stats

> From 2005-2014, there were an average of 3,536 fatal unintentional drownings (non-boating related) annually in the United States — about ten deaths per day.

@oldmud0 tylervigen.com/spurious-correlations

Yup, hundred times more people drowning in their own pools, than being killed by terrorists

By letting terrorists get so much coverage in the media despite their practically non-existent contribution to unnecessary deaths, you're letting them win and giving them exactly what they want. Terror.

+10

so, should we adopt china's ways and become ethnic happyland?

hm... 3:40 AM

goodnight guys...

Bye!

@oldmud0 We don't have to live on either extreme

@oldmud0 As opposed to orwellian big brother land?

@cat uh, who said that china wasn't orwellian big brother land

Oh wait, that's right, we're already there

We just don't have the ethnic happyland benefits to go with it

we have no idea how many people are getting arrested daily in china, much less how many people are being executed, tortured

after all, ignorance is bliss

it all goes so well... until you hit a wall

then you fight the system

@cat Waaaat? It's not an isolated server? It's on the school network?!

@cat But.... But how are we gonna get THEM BIG NEEEEWWWSSSS

@ThatBrazilianGuy Actually, it looks like it's on GridHoster

But maybe that's only a proxy

@Rahul2001 No, I am not. It's a song.

they can still do the news, they just report more of it. 115 people died today while driving thier cars, 48 died while walking being hit by a car, 58 people died of the flu , 118 people died of old age, and 2 people were killed by terrorists, and a homeless man was shot by a cop. Texas this week. (note all numbers were made up but dont have to be)

@BenN lol

now one has to ask if that would be better news than reporting that the kardashians made a new youtube video

Okay, I have to make a decision tomorrow

Am I going to upgrade to win10

Or all the stupid pokemon news stories

I hate windows 10, the UI is brutally inconsistent

@ThatBrazilianGuy My assumption is it is, if it's being used to bypass the school proxy/filter

But it's the only way I can get support

@Psycogeek That's 10 from the errorists

Errorists win.

> Breaking news: Reddit declares war on errorism, grammar Nazis

@ThatBrazilianGuy no, my own server

@BenN nope, I use gridhoster

@oldmud0 Yeah, headline news when errorists kill three sentences in a day

(tan 60/cot 30)(24*2-36/3)*2-2^3 = @%% it, Wolphram Alpha will tell me

easy...

@oldmud0 who needs support when you have superuser?

@ThatBrazilianGuy 64, actually

There's no submit button.

no, as in extended support going to expire soon

/me opens element inspector

Now there is!

Tan60/cot30 is zero. Basic stuff, but wolfram doesn't know that :D

@ThatBrazilianGuy press enter?

Why are you still awake

Can't sleep... :/

Well, it's time to bid windows 7 goodbye.

sniffles

oh you'll be back

@Rahul2001 Uhhh.... Tan60/cot30 = 1

Yeah, sorry, my bad

windows 7 was the second greatest windows version ever

@oldmud0 the greatest!

no... the greatest was XP

I beg to differ

Yes, you bed to differ. Go to bed.

Bed to giffer

Yeah, I really should sleep :P

Goodnight

Okay I need to make a decision

Windows 10, arch, or debian?

DOS!

@ThatBrazilianGuy Already installed, sorry

Windows 9

couldn't find it on softpedia

MS BOB

Ms. Bob?

microsoft bob

I know lol

!!caat

Windows 3.0 optimized for PC-XT

Windows Server 2012 R2 Core

ME BETA

Raspbian

what can go wrong!

menuetos.net

I still have that piece of crap on my bookmarks

People making oses

In assembly

At least make a python operating system

Piece of crap? It has image and video players, network stack, USB 2.0

assembly would take ages

It can room Quake

AND IT FITS ON A FLOPPY

ON. A. FLOPPY.

so it has no bloat

Lightweight!

ye but no chromium

crap.... chrome os

SteamOS!

Your new OS for your work PC shall be SteamOS

dos is made in asm and has the source code released by microsoft

and nt4 has leaked the project files . headers locales globals etc

it's 2016

but its open source

it's like our computer kid forgot how to add

Coming Soon: @JourneymanGeek's Birthday - this monday! Happy Birthday JMG! :D

Holy cow, 3450 W for Symbolics 3600

What does the hollow star mean

Like a sticky?

@oldmud0 Yep!

@oldmud0 It's a "pinned" message

Now I wanna try menuetOS again

The last time I tried it was back in 2008, I couldn't get the network stack to work

What's the difference between adhesive and pins? @_@

SE, virtually reducing environmental footprint since 2007?

Adhesive makes you dirty and pins make you bleed

Weird! If I pin my own message, it gets a star. Then I unpin it, the star remains... But whose star is it?

well nobody owns outer space

I imagine it's Community♦'s

Hang on, there was an MSE thing about this a while back

so its nobody and everybodys star

@mrenigma Tell that to NASA Trump

@BenN It's not really that important....

oh god trump is a douchebag

Damn, my shift ends at 5pm and it's 8pm and I'm still at the office. On a friday night.

im not in the usa but still

I might be getting old ._____.

It was mentioned near the end of that

@BenN You have the most obscure references

Do you read all the posts on a RSS feed or something? :P

I've accumulated a lot of time reading MSE; it's good to know SE history and why things are How They Are

!!doooooooog

ok, kernel recompiled

.. now I have to hope that gpu's driver will stop triggering kernel panic

@cat that looked like bread

oh, I replied to a bot.... I'm an idiot

Woof.

@ThatBrazilianGuy Hey who unpinned this

Also it's someone else's birthday tomorrow

Also, penis.

Wow, that's... been a while

holy moly

@ThatBrazilianGuy Yep - and C++ programs compiled for Windows or Linux and usually bigger than that entire OS

they have a graphical MPEG-2 video player and MP3 player in 98 KB

woof