---
# System prepended metadata

title: CTF Range-115
tags: [linux, command injection, CPENT]

---

# CTF Range-115
## Challenge 115
## Challenge 116
## Challenge 117
## Challenge 118
![image](https://hackmd.io/_uploads/HJ1ec4g5lg.png)


* Rustscan
    * ![image](https://hackmd.io/_uploads/BkiEq4ecxx.png)
* Nmap
    * ![image](https://hackmd.io/_uploads/r1Pv5Nlqll.png)

* Found a interest website
    * ![image](https://hackmd.io/_uploads/SJpZsEecgl.png)

* 在3000port的gitee上發現這個網站的source code, 目前這個會接收使用者的輸入並過濾字元, 再利用 `shell_exec`執行base64+使用者輸入的command回顯於網頁上
    * ![image](https://hackmd.io/_uploads/HJee2Bxqxe.png)
    
* 所以當我輸入`/root/.ssh/id_rsa`時系統就執行了base64過的root密鑰, 再解密
    * ![image](https://hackmd.io/_uploads/B1xrIwg5el.png)
    * ![image](https://hackmd.io/_uploads/SJpkKDeqxg.png)



* 這段則是會利用root的密鑰登入
    * ![image](https://hackmd.io/_uploads/ByGYM8e9le.png)

* 在原本root的`.bashrc`有寫特定規則, echo一段字串就會exit, 所以這邊用 `-t` 指定成/bin/sh
    * ![image](https://hackmd.io/_uploads/BysT3Dgcll.png)



## Answer
* Challenge 115:`5oMBD`
* Challenge 116:`3000`
* Challenge 117:`Base64`
* Challenge 118:`c6eef85e`


