Tags: beginner sandbox
Rating:
(can't find in other writeups solution for second flag that i present here)
Your Choice!
Having found the information you were looking for, while detailed,
it presents you with an interesting dilemma. There is a network of
"computers" not completely dissimilar to your computrator-machine
on your ship. You find yourself in possession of the credentials of
an individual on the planet named "SarahH." Great, with these you
can get right into the secret world of an earthling without them
knowing you're there. You access "SarahH home network," to find two
computers: "work" and "home." Not knowing what either of these are,
you have to make a decision.
No decisions, no compromises - we will hack both. Or else why we are
sitting with laptop at home in such a great summer weekend?
Work Computer (ORME) (**sandbox**)
With the confidence of conviction and decision making skills that
made you a contender for Xenon's Universal takeover council, now
disbanded, you forge ahead to the work computer. This machine
announces itself to you, surprisingly with a detailed description
of all its hardware and peripherals. Your first thought is "Why
does the display stand need to announce its price? And exactly how
much does 999 dollars convert to in Xenonivian Bucklets?" You
always were one for the trivialities of things. Also presented is
an image of a fascinating round and bumpy creature, labeled
"Cauliflower for cWo" - are "Cauliflowers" earthlings? Your 40
hearts skip a beat - these are not the strange unrelatable bipeds
you imagined earthings to be.. this looks like your neighbors back
home. Such curdley lobes. Will it be at the party? SarahH, who
appears to be a programmer with several clients, has left open a
terminal. Oops. Sorry clients! Aliens will be poking around
attempting to access your networks.. looking for Cauliflower. That
is, *if* they can learn to navigate such things.
Some network address is given, let's try to connect to it.
$ nc readme.ctfcompetition.com 1337
> whoami
whoami: unknown uid 1338
> ls -l
total 8
---------- 1 1338 1338 33 Jun 25 19:21 ORME.flag
-r-------- 1 1338 1338 28 Jun 25 19:21 README.flag
> cat README.flag
error: No such file or directory
Well, we have a shell, we have two files that must be read, but we
have no `cat` (and `grep` etc.). We plan to read both, of course.
Let's have a look what we have then.
> ls -l /bin /sbin /usr/bin /usr/sbin
/bin:
total 800
lrwxrwxrwx 1 65534 65534 12 May 9 20:49 arch -> /bin/busybox
-rwxr-xr-x 1 65534 65534 796240 Jan 24 07:45 busybox
lrwxrwxrwx 1 65534 65534 12 May 9 20:49 chgrp -> /bin/busybox
lrwxrwxrwx 1 65534 65534 12 May 9 20:49 chown -> /bin/busybox
lrwxrwxrwx 1 65534 65534 12 May 9 20:49 conspy -> /bin/busybox
..............
/sbin:
total 228
lrwxrwxrwx 1 65534 65534 12 May 9 20:49 acpid -> /bin/busybox
lrwxrwxrwx 1 65534 65534 12 May 9 20:49 adjtimex -> /bin/busybox
..............
/usr/bin:
total 1984
lrwxrwxrwx 1 65534 65534 12 May 9 20:49 [ -> /bin/busybox
lrwxrwxrwx 1 65534 65534 12 May 9 20:49 [[ -> /bin/busybox
..............
-rwxr-xr-x 1 65534 65534 25216 Mar 19 09:56 iconv
..............
-rwxr-xr-x 1 65534 65534 83744 Nov 15 2018 scanelf
..............
/usr/sbin:
total 16
lrwxrwxrwx 1 65534 65534 12 May 9 20:49 addgroup -> /bin/busybox
lrwxrwxrwx 1 65534 65534 12 May 9 20:49 adduser -> /bin/busybox
..............
>
Wow, a lot of stuff! First of all, this is Busybox system. It means
that most of utilities are embedded in `busybox` executable and almost
all other are just symlinks to it. Busybox first checks `argv[0]` value
and executes appropriate piece of code. But also certain utility can be
invoked by executing `busybox` directly and giving it proper arguments.
Try it:
> busybox cat README.flag
busybox can not be called for alien reasons.
Aha, this is modified version of busybox. After all, it would be too
easy.
But still there are tons of stuff. And a lot of possible solutions.
If we have little or no expirience with unix-like environments, then we
can just go through the list command-by-command and read each man-page
on the web. Quickly we can find, for example, that `iconv` utility can
be used to read any file and print it to the terminal possibly but not
necessary with codepage conversion. Give it a try:
> iconv README.flag
CTF{4ll_D474_5h4ll_B3_Fr33}
> iconv ORME.flag
iconv: ORME.flag: Permission denied
First flag is ours:
**CTF{4ll_D474_5h4ll_B3_Fr33}**
For the second one we need to find a way to change it's permission
flags. Fortunately we are the owner of this file and are capable to
change it's permissions. Unfortunately, `chmod` utility is abscent.
It is obvious, that `chmod` symlink is removed, but code of it is still
contained in `busybox`. And maybe in some other places. Check it:
> scanelf -s chmod -R /
TYPE SYM FILE
ET_DYN chmod /lib/libcrypto.so.1.1
ET_DYN chmod /lib/ld-musl-x86_64.so.1
ET_DYN chmod /usr/bin/upx
ET_DYN chmod /bin/busybox
Yep, it is there. And `upx` utility looks very suspicious and certainly
can be used to solve issue. But let's do some googling first, it is
their contest after all!
Googling "*change permissions without chmod*" immediately leads us to
the StackOverflow page with description of trick with loader
`/lib/ld-linux.so`. Just use it to run `busybox` and `chmod` in it:
> ls /lib
apk
firmware
ld-musl-x86_64.so.1
libc.musl-x86_64.so.1
libcrypto.so.1.1
libssl.so.1.1
libz.so.1
libz.so.1.2.11
mdev
> /lib/ld-musl-x86_64.so.1 /bin/busybox chmod +r ORME.flag
> ls -l
total 8
-r--r--r-- 1 1338 1338 33 Jun 25 19:51 ORME.flag
-r-------- 1 1338 1338 28 Jun 25 19:51 README.flag
> iconv ORME.flag
CTF{Th3r3_1s_4lw4y5_4N07h3r_W4y}
**CTF{Th3r3_1s_4lw4y5_4N07h3r_W4y}**
