This is the robbers' challenge. To post a cop, go here.
In this challenge, cops will invent a (likely simple) programming language, and write an interpreter, transpiler, or compiler that allows you to run it. Robbers will write a program in this language that manages to inject arbitrary code into the interpreter, transpiler, or compiler.
Cops should design a language. This language should be "pure"; its programs can take input and/or produce output, but cannot affect files, make network requests, behave non-deterministically (based on something like randomness or the system time), or otherwise impact or be impacted by the outside world (within reason).
Cops must then implement this language, with one of:
- An interpreter: This will take the code and input as arguments/input, and produce the programs's output as output.
- A transpiler: This will take the code and input, and produce code in some other language which does the same task. When run using that language's interpreter/compiler with input, the correct output is produced.
- A compiler: Similar to a transpiler, but with machine code instead of another language.
There must be an intended "crack", or way to inject arbitrary code.
Robbers should find a way to do one of the following:
- Write a program that, when interpreted, transpiled, or compiled, can run arbitrary code as the interpreter/transpiler/compiler (e.g., if written in Python, you could run arbitrary Python, manipulate files, and so on)
- Write a program that, when transpiled or compiled, injects arbitrary code into the resulting program/machine code (e.g., if your transpiler converts the language to Node.js, you could inject arbitrary JS into the transpiler output)
Robbers should include code which can be given to the cop, which allows injecting arbitrary code. For example:
Cracks Print1Langeval("...") # arbitrary Python, with 1s replaced with \x31
This exploits the fact that
.in regexes does not match newlines.
This exploit should allow injecting any code, in some language or situation that allows performing arbitrary computations and interacting with the computer's files, running shell commands, system calls, or anything like that. Simply printing a nondeterministic value does not count, as it does not give you unrestricted access to the environment the code or transpilation/compilation output is being run or transpiled/compiled in.
For an interpreter, this is likely going to be running code in the language the interpreter is written in. For a transpiler or compiler, the vulnerability can occur at either compile time or run time, and for the latter, the vulnerability would most likely consist of being able to inject arbitrary code or machine code into the compiled code.
All the boring stuff. Nothing malicious, no crypto stuff.
Winner for cops is the user with the most safe cops, winner for robbers is the user who cracks the most cops.