December 31, 2014 at 11:13Fucky new year!
Sorry for the mat in the title, this is a hint of entertainment, the beginning of which was given by the language "Brainfac" - to write in any language a code that performs something reasonable, without using letters and numbers. We have already seen JSFuck , PHPFuck , now I want to introduce Bashfuck to you :
To start, you need a “bash” of the fourth version. The script does nothing maliciouslyboldly run from under the "root" , it simply displays the inscription "Happy new year". The source must be copied to a file and run.
Now a little about the principle of work.
"Bash", fortunately, is rich in various scribbles, but the names of variables, under the conditions of our restrictions, can consist only of a different number of underscores, they are clearly visible in the code - in them I collect the necessary sequence of letters. Where do the letters come from?
Oh, here I had to smash my head!
To start getting letters in industrial quantities, I first need to get the base64 command name in some variable - passing any nonsense to her at the entrance, you can get the whole alphabet at the output.
I took the first three letters from the name of the shell (“ bash ”, since the path to it is given at the input in the variable “$ _”), and the fourth from the name of a special file that is used if some program cannot receive data to standard input . The file name always starts with “ / dev / fd ”, from here the missing “ e ” is taken .
The numbers are easier to get.
Firstly, “bash” (like many shells) allows you to measure the length of a variable through the construction of “$ {# name}” (for example, getting a unit is simple - it's just the length of the value of the variable of the return code of the previous command, since I have this value always zero, its length is always one).
Secondly, the construction of $ ((...)) allows you to do calculations by combining the lengths of different variables with operations, I get the missing numbers. There are many operations, which gives quite a lot of freedom, from exotics I had to apply once the operation of changing the calculus system - the lattice.
After I received the “ base64 ” command , substituting the data I have at her input (sometimes through a chain of calls), I can extract the remaining letters from the returned garbage. I bite them using the operation of deleting characters or selecting a substring - these operations in the “shells” are also made “squiggles”.
Toward the end, new operations with variables in the fourth “bash” come in handy - you can now change the case of the letter, without it it would have been much harder.
So in the end the command “cat <<< 'Happy new year' ”, which I run. Why not “ echo ” or “ printf ”? They are simply longer - each extra letter is a hassle with variables and operations.
Happy new year!
__=${_##*/};____=<(:);___=${__#???};_____=$((${#___}<<${#___}))
__=${__::-${#___}}${____:$_____:${#___}}
__=$__$((${#__}|$_____))$((${#__}));___=$___${__:${#___}:${#___}};____=$($__<<<$_____|$__)
_____=${____:$((${#__}-${#___})):${#?}};___=$___$_____$_____;____=$($__<<<$____|$__|$__)
___=$___${____:$((${#?}+${#__})):${#?}};___=$___' '${____:$((${#___}+${#___})):${#?}}
___=$___${__:$((${#____}/${#___}-${#?})):${#?}};___=$___${____:$((${#____}#$_____-${#___})):${#?}}
___=$___\ ${____:$((${#__}+${#?})):${#?}}${__:$((${#__}>>${#?})):${#?}}${__:${#_____}:${#?}}
___=$___${____:$((${#___}-${#?}-${#?})):${#?}};___=${___,,}
____=${____:$((${#___}+${#__}-${#?})):$((${#?}+${#?}))}
____=${____::${#?}}${__:${#_____}:${#?}}${____:${#?}};${____,,}<<<${___^}To start, you need a “bash” of the fourth version. The script does nothing maliciously
Now a little about the principle of work.
"Bash", fortunately, is rich in various scribbles, but the names of variables, under the conditions of our restrictions, can consist only of a different number of underscores, they are clearly visible in the code - in them I collect the necessary sequence of letters. Where do the letters come from?
Oh, here I had to smash my head!
To start getting letters in industrial quantities, I first need to get the base64 command name in some variable - passing any nonsense to her at the entrance, you can get the whole alphabet at the output.
I took the first three letters from the name of the shell (“ bash ”, since the path to it is given at the input in the variable “$ _”), and the fourth from the name of a special file that is used if some program cannot receive data to standard input . The file name always starts with “ / dev / fd ”, from here the missing “ e ” is taken .
The numbers are easier to get.
Firstly, “bash” (like many shells) allows you to measure the length of a variable through the construction of “$ {# name}” (for example, getting a unit is simple - it's just the length of the value of the variable of the return code of the previous command, since I have this value always zero, its length is always one).
Secondly, the construction of $ ((...)) allows you to do calculations by combining the lengths of different variables with operations, I get the missing numbers. There are many operations, which gives quite a lot of freedom, from exotics I had to apply once the operation of changing the calculus system - the lattice.
After I received the “ base64 ” command , substituting the data I have at her input (sometimes through a chain of calls), I can extract the remaining letters from the returned garbage. I bite them using the operation of deleting characters or selecting a substring - these operations in the “shells” are also made “squiggles”.
Toward the end, new operations with variables in the fourth “bash” come in handy - you can now change the case of the letter, without it it would have been much harder.
So in the end the command “cat <<< 'Happy new year' ”, which I run. Why not “ echo ” or “ printf ”? They are simply longer - each extra letter is a hassle with variables and operations.
Happy new year!
