VNE
200 points
AUTHOR: JUNIAS BONOU
Description
We've got a binary that can list directories as root, try it out !!
Additional details will be available after launching your challenge instance.
Note: This challenge launches an instance on demand.
First the script expects us to have an environment variable set for SECRET_DIR.
There are two potential directories that have the same flag (I checked):
/challenge
/root
I originally picked /root
.
Running the program it gives returns:
Listing the content of /root as root:
flag.txt
Now the fun part, hint 2 tells us to "Find a way to add more instructions to the ls".
First I tried using alias --> nada,
I tried using function ls() --> nada.
And on and on, until I tried the following.
I made a script called ls
using cat >> ls
and typed the code:
#!/bin/bash
/bin/ls
/bin/cat /root/flag.txt
Then I made it executable with chmod +x ls
.
Finally to trick the shell into running this version of ls
instead of the builtin way we add the path to the current directory as the first directory that the shell will look for its commands with:
export PATH=/home/ctf-player/:$PATH
NOW, when running the script, it runs in the background the ls
command and it looks at the PATH and sees a file called ls
inside the first directory /home/ctf-player
and executes its code with root privileges and we get the flag:
picoCTF{your flag}
Top comments (0)