« first day (529 days earlier)      last day (3151 days later) » 

3:16 PM
Wow
Such a simple command
Derped
!!/alive
!!/alive
 
@Sha @ber @inɒzɘmɒЯ.A.M Whoops, I fixed >>ping but while doing that I accidentally make it un-support Unicode stuff.
 
loL
>>ping inɒzɘmɒЯ.A.M
 
@ShadowWizard Command contains invalid characters.
 
3:31 PM
throwing unicode on @Pro
 
Catches Unicode
 
throwing the whole universe on @Sha
 
lol
@Sha is squashed
 
I have an idea!
throws antimatter @Sha
 
@ProgramFOX pffft there are billions of parallel universes
 
3:33 PM
@ProgramFOX OMG
 
switching to a parallel universe
 
I wonder, is antimatter cross universe?
 
Damned throttling for half a minute
in I dunno what this is, dun delete, 19 secs ago, by United States Of America
@UnitedStatesOfAmerica Punches United States Of America
Lol
 
@ShadowWizard I... don't know.
Our own universe has so many mysteries already, and you want to know stuff about other ones? Tssk. :P
 
3:39 PM
Bot started
Command!
!!/alive
 
!!/eval 1+1
 
@UnitedStatesOfAmerica Punches United States Of America
Not yet
Throttling...
This is a new bot. Written in python3
 
"new" as in "translated to Py3", or "rewritten from scratch"?
 
Bot started
Rewritten from scratch
 
3:41 PM
My favourite part:
You can provide arguments in the bot settings file or provide it as an argument
Password is a special case
It also checks in the environment and if not found, it asks for password on run
import re

__regex__ = re.compile("(.+) *= *(.+)", re.UNICODE)


def load_properties(fname):
    content = {}
    try:
        with open(fname, "r") as f:
            f.close()
    except FileNotFoundError:
        open(fname, "w+").close()
    with open(fname, "r+") as f:
        lines = f.readlines()
        for line_id in range(len(lines)):
            line = lines[line_id].rstrip('\n')
            parts = __regex__.split(line)
            if len(parts) == 4:
                content[parts[1].rstrip()] = parts[2]
def find_value(value_name, file_settings):
    value_name = value_name.replace(" ", "")
    found_in_file = value_name in file_settings
    found_in_args = '-' + value_name in sys.argv
    if found_in_args:
        pos = sys.argv.index('-' + value_name) + 1
        try:
            value = sys.argv[pos]
        except IndexError:
            print("Not enough arguments for " + value_name + "!")
            value = ""
    elif found_in_file:
        value = file_settings[value_name]
    else:
        value = ""
So this is what I can do:
    settings = OptionsReader.load_properties("bot_settings.ini")

    stack_openid_email = find_value("stack_openID_username", settings)
Is chat websockets down?
@Pro!
Just moved over eval
 
websockets? shouldn't be dead
 
!!/eval 1 + 1
And crashed
Wait first
 
4:05 PM
@ProgramFOX security loosened a bit:
in I dunno what this is, dun delete, 21 secs ago, by United States Of America
@UnitedStatesOfAmerica Python result for eval('math.log(10)'): 2.302585092994046
 
ok!
 
Now Math has been opened up
Moving bot back here
Oh and no need to set language if its python
!!/eval math.log(100)
@UnitedStatesOfAmerica Python result for eval('math.log(100)'): 4.605170185988092
!!/eval py math.log(100)
@UnitedStatesOfAmerica Python result for eval('math.log(100)'): 4.605170185988092
 
!!/eval math
 
@ProgramFOX Python result for eval('math'): <module 'math' (built-in)>
!!/eval string.ascii_lowercase
@UnitedStatesOfAmerica Python result for eval('string.ascii_lowercase'): abcdefghijklmnopqrstuvwxyz
string and math
If you want anything else just ping me
 
cool
 
4:07 PM
regex?
 
No, because ReDoS
 
Could I restrict eval to 100 chars unless you're privileged?
 
what's the point?
 
!!/eval re.compile('!!/(\\w+) ?(.+)?').split("!!/kill @ShadowWizard")
Hmm
Crashed
 
regex is a very. bad. idea.
The regular expression denial of service (ReDoS) is an algorithmic complexity attack that produces a denial-of-service by providing a regular expression that takes a very long time to evaluate. The attack exploits the fact that most regular expression implementations have exponential time worst case complexity: the time taken can grow exponentially in relation to input size. An attacker can thus cause a program to spend an effectively infinite amount of time processing by providing such a regular expression, either slowing down or becoming unresponsive. == Description == Regular expression matching...
 
4:10 PM
Removing
After I fix the bug
Not regex related, but parsing the command args
Its picking up the back
!!/eval re.compile('!!/(\\w+) ?(.+)?').split("!!/kill @ShadowWizard")
Nevermind
!!/eval math.sqrt(100)
@UnitedStatesOfAmerica Python result for eval('math.sqrt(100)'): 10.0
 
!!/eval math.sin = lambda x: 1
!!/eval "alive?"
 
borked? :P
 
y it no answer then?
 
4:21 PM
Not running
 
oh
Want to run it? I want to security-proof it.
 
!!/alive
@UnitedStatesOfAmerica Mmmm
There
 
!!/eval math.sin = lambda x: 1
 
aha!
 
4:22 PM
!!/eval py math.sin = lambda x: 1
@UnitedStatesOfAmerica eval('math.sin = lambda x: 1') is invalid!
 
avoid posting None to chat, and convert everything else to a string.
lol, what did you do now?
 
Trying to do no lang detection
 
no I meant, to make it invalid
 
!!/eval math.sin = lambda x: 1
 
4:24 PM
Might be assigning isn't allowed
 
oh, lol
!!/eval 1+1
 
Let me fix the bug first
 
ok!
 
!!/eval math.sin = lambda x: 1
@UnitedStatesOfAmerica Python eval('math.sin = lambda x: 1') is invalid!
K
 
!!/eval math.sin(1)
 
4:28 PM
@ProgramFOX Python result for eval('math.sin(1)'): 0.8414709848078965
 
ok, no override, good
 
Eel
Mixing 2 IDE's isn't a good idea
In the same directory
 
!!/eval math.__class__.__delattr__(math, "sin")
 
@ProgramFOX Python result for eval('math.__class__.__delattr__(math, "sin")'): None
 
!!/eval math.sin(1)
 
4:30 PM
@ProgramFOX Python eval('math.sin(1)') is invalid!
 
MWAHAHA!
 
Lol
:(
Sobs
@Pro is abusing things
 
I'm trying to see if I can find a way to circumvent the eval restrictions to be able to tell you if anything is vulnerable, but I didn't find anything yet at the moment.
!!/eval math.__class__.__getattribute__(os, 'name')
 
@ProgramFOX Python eval('math.__class__.__getattribute__(os, \'__name__\')') is invalid!
 
good
 
4:33 PM
Blocked accessing of __class__
 
ok!
 
!!/eval math.__class__
@UnitedStatesOfAmerica Python result for eval('math.__class__'): <class 'module'>
???
!!/eval math.__class__.__delattr__(math, "sin")
@UnitedStatesOfAmerica Python result for eval('math.__class__.__delattr__(math, "sin")'): None
NOOO
 
ehm
 
Why is it still there?
 
because you didn't block it well? :P
 
4:38 PM
allowed_for_eval = {
    "math": math,
    "string": string,
    "math.__class__": None,
    "string.__class__": None
}

eval(eval_regex[2],
                                       {
                                           "__builtins__": None},
                                       allowed_for_eval)
Dunno
 
!!/eval del math.sin
 
@ProgramFOX Python eval('del math.sin') is invalid!
 
!!/eval del math.cos
 
@ProgramFOX Python eval('del math.cos') is invalid!
 
heh
 
4:39 PM
I don't think I can block that right
But let me try...
How to get field names in a module?
 
math.__dir__()
where 'math' can be any module
!!/eval math.__dir__()
 
@ProgramFOX Python result for eval('math.__dir__()'): ['copysign', 'hypot', 'expm1', 'acos', 'atan', '__spec__', 'gamma', 'asin', 'fsum', 'atanh', 'log2', 'pow', 'isinf', 'cos', 'fmod', 'tanh', 'degrees', 'log1p', 'lgamma', 'cosh', 'isfinite', 'isnan', 'ldexp', 'ceil', 'acosh', 'fabs', 'e', 'log', 'erf', 'atan2', '__doc__', '__name__', 'frexp', 'erfc', 'sinh', 'asinh', 'trunc', 'sqrt', 'log10', 'radians', 'pi', 'modf', 'tan', 'exp', 'factorial', '__package__', 'floor', '__loader__']
Thanks
 
also:
!!/eval math.__delattr__('tan')
 
@ProgramFOX Python result for eval('math.__delattr__('tan')'): None
 
!!/eval math.tan(1)
 
4:41 PM
@ProgramFOX Python eval('math.tan(1)') is invalid!
 
Block delattr, too.
let's try a few more fun things
!!/eval math.__setattr__('cos', lambda x: eval('__import__("os")'))
 
@ProgramFOX Python result for eval('math.__setattr__('cos', lambda x: eval('__import__("os")'))'): None
 
!!/eval math.cos(1)
Uhh... did I crash it? @Uni
 
!!/eval math.__class__.__delattr__(math, "sin")
 
!!/eval 1
 
4:43 PM
@UnitedStatesOfAmerica Python eval('math.__class__.__delattr__(math, "sin")') is invalid!
Yey
@ProgramFOX Python result for eval('1'): 1
 
!!/eval math.__setattr__('cos', lambda x: eval('__import__("os")'))
 
@ProgramFOX Python eval('math.__setattr__(\'cos\', lambda x: eval(\'__import__("os")\'))') is invalid!
!!/eval math.log(100)
@UnitedStatesOfAmerica Python eval('math.log(100)') is invalid!
Well
:(
 
Uhh... you just blocked math.
 
!!/eval math
@UnitedStatesOfAmerica Python eval('math') is invalid!
!!/eval math
@UnitedStatesOfAmerica Python eval('math') is invalid!
!!/eval math
@UnitedStatesOfAmerica Python eval('math') is invalid!
 
@UnitedStatesOfAmerica Now, when you found a way to block class/delattr, get better get worried about setattr:
6 mins ago, by ProgramFOX
!!/eval math.__setattr__('cos', lambda x: eval('__import__("os")'))
 
4:49 PM
!!/eval math.log(100)
@UnitedStatesOfAmerica Python eval('math.log(100)') is invalid!
 
^ That piece of code imports os. It contains your environment variable. So, it's very dangerous.
 
So how can I block __class__ and all those private values?
 
I have no idea
eval is and stays a security risk
especially with the setattr around
 
So...
Remove it?
!!/kill @ProgramFOX
@UnitedStatesOfAmerica United States Of America was accidentally decapitated in an old factory
Ohno
 
5:07 PM
@UnitedStatesOfAmerica Hahahaha!
 
:(
!!/kill @inɒzɘmɒЯ.A.M
@UnitedStatesOfAmerica inɒzɘmɒЯ.A.M sleeps with the fishes
 
I don't. I'm a gas.
 
!!/kill @inɒzɘmɒЯ.A.M
@UnitedStatesOfAmerica Voldermort(aka Shadow Wizard) used Avada Kedavra used on inɒzɘmɒЯ.A.M
Lol
 
@UnitedStatesOfAmerica Between Voldemort and the parenthesis there should be a space.
 
5:15 PM
@UnitedStatesOfAmerica Removing eval is your only option to keep the bot 100% safe.
 
And it's OK not ok or Ok or any variation thereof.
 
>>ping {{getcurrentusers pingformat}}
 
@berserk Command contains invalid characters.
 
TAKE THAT DEN! (ノಠ益ಠ)ノ彡┻━┻.
 
5:21 PM
yes yes, I'm working on that at this very moment
 
noo0o0o0O0OO
 
@berserk TAKE THAT @BER (ノಠ益ಠ)ノ彡┻━┻.
 
ლ(ಠ益ಠლ)
(ノಠ益ಠ)ノ
\(ಠ益ಠ)/
 
(•_•)=ε/̵͇̿̿/'̿'̿ ̿
 
D:
 
5:24 PM
(•_•)=ε/̵͇̿̿/'̿'̿ ̿ @ber . . . Shoots
!!/kill @Berserk
(•_•)=ε/̵͇̿̿/'̿'̿ ̿ Unibot
Shoots
 
@Uni Can you put my face there? ^
 
>>stop
 
@ProgramFOX Bot terminated.
Bot started.
 
>>cat {{ping inɒzɘmɒЯ.A.M}}, hey look, my owner fixed this thing!
 
@ProgramFOX Command contains invalid characters., hey look, my owner fixed this thing!
 
5:31 PM
eh
lol forgot to update submodules
>>stop
 
@ProgramFOX Bot terminated.
Bot started.
 
>>cat {{ping inɒzɘmɒЯ.A.M}}, hey look, my owner fixed this thing!
 
@ProgramFOX @inɒzɘmɒЯ.A.M, hey look, my owner fixed this thing!
 
@ProgramFOX genius!
 
>>cat {{ping Pro}}, can we please use it to ping-attack someone?
 
5:33 PM
@inɒzɘmɒЯ.A.M @Pro, can we please use it to ping-attack someone?
 
@inɒzɘmɒЯ.A.M No, if there are complaints you'll get a bot ban.
 
I know.
 
I know.
 
I know.
 
I know.
 
5:39 PM
I know!
 
\(ಠ益ಠ)=ε/̵͇̿̿/'̿'̿ ̿
 
Don't break the chain!
 
u don't say... ლ(ಠ益ಠლ)
 
@Sha is it possible to request from CM's that we move the privileges threshold a bit?
 
6:43 PM
@inɒzɘmɒЯ.A.M in theory yes, I believe it is technically possible, but you will have to give really good reason for this.
 
@ShadowWizard ELL is a big mess of tags.
in ELL's Cabin on The Stack Exchange Network Chat, 1 hour ago, by inɒzɘmɒЯ.A.M
Jeez, this will take forever. Let's first take down Al pacino:
Read a bit of the frustration @Sha.
 
7:25 PM
@inɒzɘmɒЯ.A.M well, maybe worth trying but don't build your hopes too high, I don't think such thing was ever done.
@FOX9000 recruited
 
@ShadowWizard slammer
 
@FOX9000 drummer
 
@ShadowWizard private
 

« first day (529 days earlier)      last day (3151 days later) »