1

I'm at my CTF final stage and there I have this:

vim flag
iCourse{v3ry_g00d_fl4g}[ESC]13hs1[ESC]am_[ESC]9l2xli_[ESC]2li3[ESC]vypaks[ESC]:s/ry/15
:wq 

I'm not really familiar with Vim so I can't figure out how to run this script. I'm guessing it must be doing something bigger than replacing "ry" with "15", because I tried that manually and flag is incorrect. Thanks in advance!

Mak
  • 91
  • 9
  • You have to type everything exactly like that, except that `[ESC]` means pressing the escape key. FWIW, this produces the line `Course{v3m_15_g00d_4_g33ks}` – L3viathan Nov 25 '20 at 18:17
  • @L3viathan it's incorrect :( And I'm curious how did you get that? – Mak Nov 25 '20 at 18:49
  • @L3viathan Course{v1m_15_g00d_4_g33ks} is correct, but I just assumed that as it makes more sense :) Not to bother but do you mind telling me what exactly I had to to in order to get that? I'm trying to type "iCourse{v3ry_g00d_fl4g}13hs1am_9l2xli_2li3vypaks" and then execute :s/ry/15 but it has the same effect as I've described above. ;( – Mak Nov 25 '20 at 19:06
  • After starting vim, I type `iCourse{v3ry_g00d_fl4g}`, then press escape to switch back to normal mode, then type `13hs1`, press escape again, and so on. Oh, and I know why it was `v3m` for me: because I have remapped `s` for `vim-surround` :) – L3viathan Nov 25 '20 at 19:38
  • @L3viathan, thanks alot! :) – Mak Nov 25 '20 at 20:40

1 Answers1

2

Yes it is possible. When launched with the -s command line flag, vim will fetch commands from an input file:

From the man page:

-s {scriptin}
      The  script  file {scriptin} is read. The characters in the
      file are interpreted as if you had typed them. The same can
      be done with the command ":source! {scriptin}". If the end
      of the file is reached before the editor exits, further
      characters are read from the keyboard.

So all you need to do is use a tool like sed to convert every occurrence of [ESC] into an escape character, store the result in a temporary file, and then feed it to vim:

s='iCourse{v3ry_g00d_fl4g}[ESC]13hs1[ESC]am_[ESC]9l2xli_[ESC]2li3[ESC]vypaks[ESC]:s/ry/15'
cmdfile=`mktemp`
echo -e `sed 's/\[ESC\]/\\\x1B/g' <<<"$s"` >$cmdfile
vim -s $cmdfile
r3mainer
  • 23,981
  • 3
  • 51
  • 88