Hash Yourself

This Zeek script calculates a levenshtein distance between two strings but doesn't print it :(

See if you can figure out what line 42 evaluates to. But be careful, you might not want to edit the script.

(CAUTION: You only have three attempts!)

redef exit_only_after_terminate = T;

module Baz; export {global f: function();}
module Foo;


global do_it = Exec::run;
module Bar;


module Foo::Bar;
export {

  module Bar;
  export {
    global Bar: string = "Foo";

    global Foo: string = "";
    global s: string = "Bar";
  }

  module Foo::Bar;
  export {
    global Bar: string = "";
    global s: string = "Foo";
    global Foo: string = "Bar";
  }

  module Foo;
  global s: string = "";
  global Bar: string = "Bar";
  global Foo: string = "Foo";

}

function Baz::f() {
  local magic = "rFj3eGxkRR5";
  when (local result = do_it([$cmd=fmt("cat %s", @FILENAME), $uid=magic])) {
    levenshtein_distance(md5_hash(join_string_vec(result$stdout, "\n")), s) - 3;
    terminate();
  }
}

event zeek_init() &priority=10 {
local c: count = 10;
Foo += "::s";
while (-100 > -101) {
  s += string_cat(fmt("%s",double_to_count(floor(haversine_distance(1.0, 1.0, 2.0, c)))));
  c -= 1;
  if (Foo in global_ids()) {
    s = lookup_ID(Foo);
  }
  if (c <= 0) break;
}
Baz::f();
}

So it takes the script path and cats the file contents into a variable for hashing. So that explains why we can't edit it. Any adjustment to the contents would change the hash and that would change the levenshtien distance.

So how to introspect the file during runtime. Interesting, why the call terminate after the computation.

aah trace might be the tool we need.

Whoaa that is a big text file! Lets take a look, remember that terminate call, I bet we could skip to the end of the trace file.

The wrong solution!

Wrong!? Two tries left!, Wait a minute, the answer is right there!?

Ohhhhhh right what the entire line 42 evaluates to!

The solution.

PreviousMan or Machine?NextFriendly Package

Last updated

Was this helpful?