Tags: vim shell 


Tokyo Westerns CTF (2018) — vimshell

> Can you escape from [jail](http://vimshell.chal.ctf.westerns.tokyo/)?

## Opening the challenge

![Interface upon opening](https://raw.githubusercontent.com/ctf-epfl/writeups/master/twctf18/vimshell/zz_1.png)

When opening the challenge, we can see a shell with what looks like a Git diff file shown in the vim editor. The diff shows that the config has been modified to disable the `:`, `Q` and `g` keys. I wasn't sure about usage of `Q` and `g`, but `:` is the way to start all kinds of commands in vim.

## Trying to quit vim

Since I am not a vim power-user, I did a lot of googling to find ways to go around those limitations. From the hint, and the common joke that people always have a hard time quitting vim, I started by looking for ways to exit the editor without `:wq`. I quickly found `shift+ZZ`, but this only resulted in a "Connection closed" message:

![Trying to quit vim](https://raw.githubusercontent.com/ctf-epfl/writeups/master/twctf18/vimshell/zz_2.png)

## Opening man pages

So it seems that quitting isn't what we're supposed to do. How about executing arbitrary shell commands? I knew that `:!some_command` would execute `some_command` in the shell. But we don't have direct access to command mode (because `:` is disabled).
In the [vim manual](http://vimdoc.sourceforge.net/htmldoc/intro.html), I looked for other ways to reach command mode, but had no luck:

![Vim mode switching features](https://raw.githubusercontent.com/ctf-epfl/writeups/master/twctf18/vimshell/zz_6.png)

It didn't seem to be possible to reach command mode in a way that wasn't disabled. That's when I thought:

> Ha, since we can move around and write in this document, would there be a way to execute a command written under the cursor?

So I searched for this and found [this StackOverflow question](https://stackoverflow.com/q/2736085/3792942) which taught me that we can open the `man` page for the word under the cursor with `shift+K`:

![Opening man pages](https://raw.githubusercontent.com/ctf-epfl/writeups/master/twctf18/vimshell/zz_3.png)

Before even going further, I tried again the `!` binding in this new man view. To my surprise, it worked! Since we had a way to execute shell commands, it was easy to locate the flag by looking around the filesystem with `ls`, and printing it wit `cat`.

![Opening man pages](https://raw.githubusercontent.com/ctf-epfl/writeups/master/twctf18/vimshell/zz_5.png)

We got the flag!

Original writeup (https://github.com/ctf-epfl/writeups/blob/master/twctf18/vimshell/vimshell.md).