Describe the bug A clear and concise deion of what the bug

Remote code execution vulnerability upon pressing quick function key (spamblck.ppa) about peace-and-protection HOT 4 CLOSED

peace-and-protection commented on September 26, 2024

Remote code execution vulnerability upon pressing quick function key (spamblck.ppa)

from peace-and-protection.

Comments (4)

commented on September 26, 2024

$2- on line 336 and line 337 in file spamblck.ppa and .ptm needs to be changed to $unsafe($2-); as well as version bump to denote the change.

from peace-and-protection.

anotherCoward commented on September 26, 2024

This has to be fixed in aliases.mrc on line 447. Anything that makes use of the F-key queue could be used for this.

from peace-and-protection.

commented on September 26, 2024

Thanks for your feedback! It has been awhile since I looked at it, but I believe that there are functions (like F8 - punish) that rely on pipes..I'll have to dig up an example...

from peace-and-protection.

commented on September 26, 2024

I looked this up and tested this with the repeatedly-try-to-join-channel-if-can't-join functionality as found here. It passes a $chr(124) to the _Q.fkey alias and if I were to use $unsafe in that alias it won't work.

Peace-and-Protection/script/rawdisp.mrc

Lines 1101 to 1109 in 0a9f46a

 ; $chan.cantjoin(chan) 

 ; Halts if channel is already being retried 

 ; Otherwise plays cant-join sound and returns fkey to use to retry that channel 

 alias -l chan.cantjoin { 

 if ($istok($hget(pnp. $+ $cid,-repjoin),$1,44)) halt 

 _Q.fkey 1 $calc($ctime + 200) _cidexists $cid $chr(124) scid $cid $chr(124) repjoin $1 

 _ssplay NoJoin 

 return $result 

 }

Reference: Wrap $3- in $unsafe stops pipes from being interpreted. So it can't be fixed here. Note: One has to be careful when creating internal functionality to use this alias. I'm going ahead and making the change to L336 and L337 in spamblock.ppa/ptm

Peace-and-Protection/script/aliases.mrc

Lines 440 to 458 in 0a9f46a

 _Q.fkey { 

 if ($_cfgi(reserve.fkey) isnum 0-1) var %set = $iif($ifmatch,135,246) 

 else var %set = $iif($1,214365,123456) 

 var %index = 1 

 :loop 

 if (($isalias($gettok(f7-f10-sf7-sf10-cf7-cf10,$mid(%set,%index,1),45)).alias == $3-) || ($hget(pnp,key.exp. $+ $mid(%set,%index,1)) == $null) || ($hget(pnp,key.exp. $+ $mid(%set,%index,1)) < $ctime)) { 

 hadd pnp key.exp. $+ $mid(%set,%index,1) $2 

 alias $gettok(f7-f10-sf7-sf10-cf7-cf10,$mid(%set,%index,1),45) $3- 

 return $gettok(F7-F10-ShiftF7-ShiftF10-CtrlF7-CtrlF10,$mid(%set,%index,1),45) 

 } 

 if (%index < $len(%set)) { 

 inc %index 

 goto loop 

 } 

 hdel -w pnp key.exp.* 

 hadd pnp key.exp. $+ $left(%set,1) $2 

 alias $gettok(f7-f10,$left(%set,1),45) $3- 

 return $gettok(F7-F10,$left(%set,1),45) 

 }

Peace-and-Protection/addons/spamblck.ppa

Lines 336 to 337 in 0a9f46a

 if ($1 == i) _Q.fkey 1 $calc($ctime + 120) dispa Blocked: $nick invited you to $2- 

 else _Q.fkey 1 $calc($ctime + 120) dispa Blocked: $iif($1 == c,$chr(40) $+ $chan $+ $chr(41)) $iif($1 isin cq,< $+ $nick $+ >) $iif($1 == n,- $+ $nick $+ $iif($chan,: $+ $chan) $+ -) $iif($1 == f,$nick :) $2-

from peace-and-protection.

Remote code execution vulnerability upon pressing quick function key (spamblck.ppa) about peace-and-protection HOT 4 CLOSED

Comments (4)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	; $chan.cantjoin(chan)
	; Halts if channel is already being retried
	; Otherwise plays cant-join sound and returns fkey to use to retry that channel
	alias -l chan.cantjoin {
	if ($istok($hget(pnp. $+ $cid,-repjoin),$1,44)) halt
	_Q.fkey 1 $calc($ctime + 200) _cidexists $cid $chr(124) scid $cid $chr(124) repjoin $1
	_ssplay NoJoin
	return $result
	}

	_Q.fkey {
	if ($_cfgi(reserve.fkey) isnum 0-1) var %set = $iif($ifmatch,135,246)
	else var %set = $iif($1,214365,123456)
	var %index = 1
	:loop
	if (($isalias($gettok(f7-f10-sf7-sf10-cf7-cf10,$mid(%set,%index,1),45)).alias == $3-) \|\| ($hget(pnp,key.exp. $+ $mid(%set,%index,1)) == $null) \|\| ($hget(pnp,key.exp. $+ $mid(%set,%index,1)) < $ctime)) {
	hadd pnp key.exp. $+ $mid(%set,%index,1) $2
	alias $gettok(f7-f10-sf7-sf10-cf7-cf10,$mid(%set,%index,1),45) $3-
	return $gettok(F7-F10-ShiftF7-ShiftF10-CtrlF7-CtrlF10,$mid(%set,%index,1),45)
	}
	if (%index < $len(%set)) {
	inc %index
	goto loop
	}
	hdel -w pnp key.exp.*
	hadd pnp key.exp. $+ $left(%set,1) $2
	alias $gettok(f7-f10,$left(%set,1),45) $3-
	return $gettok(F7-F10,$left(%set,1),45)
	}

	if ($1 == i) _Q.fkey 1 $calc($ctime + 120) dispa Blocked: $nick invited you to $2-
	else _Q.fkey 1 $calc($ctime + 120) dispa Blocked: $iif($1 == c,$chr(40) $+ $chan $+ $chr(41)) $iif($1 isin cq,< $+ $nick $+ >) $iif($1 == n,- $+ $nick $+ $iif($chan,: $+ $chan) $+ -) $iif($1 == f,$nick :) $2-