Skip to content

README.md

Latest commit

 

History

History
156 lines (103 loc) · 6.38 KB

README.md

File metadata and controls

156 lines (103 loc) · 6.38 KB

Level05 Writeup

Overview

Level05 introduces automated task execution vulnerabilities through cron jobs and script exploitation. This challenge demonstrates how scheduled scripts that process files from world-writable directories can be exploited to execute arbitrary commands with elevated privileges. The level emphasizes understanding cron jobs, script behavior analysis, and exploiting predictable automated processes.

Step 1: Investigating the Mail System

Upon logging into the system, I was greeted with an interesting message:

You have new mail.

This notification suggested that the system's mail functionality contained information relevant to this level. I checked the mail file:

cat /var/mail/level05

The mail contained a cron job configuration:

*/2 * * * * su -c "sh /usr/sbin/openarenaserver" - flag05

This line revealed critical information about an automated process. Let me explain the cron syntax:

  • */2 in the minute field means "every 2 minutes"
  • * * * * for hour, day of month, month, and day of week means "every hour, every day"
  • su -c "sh /usr/sbin/openarenaserver" - flag05 executes the script /usr/sbin/openarenaserver as the flag05 user

This cron job automatically runs a script called openarenaserver every 2 minutes with flag05's privileges. This was the key to exploiting this level - I needed to understand what this script does and how I could leverage it.

Step 2: Locating and Analyzing the Script

Based on the mail information, I knew to look for /usr/sbin/openarenaserver. To confirm its existence and find any related files, I searched the system:

grep -R "openarenaserver" /etc /opt /usr /var 2>/dev/null

The search confirmed the script's location and also revealed the mail entries I had already found. I examined the script's contents:

cat /usr/sbin/openarenaserver

The script contained:

#!/bin/sh
for i in /opt/openarenaserver/* ; do
	(ulimit -t 5; bash -x "$i")
	rm -f "$i"
done

I verified the script's ownership and permissions:

ls -la /usr/sbin/openarenaserver

Output:

-rwxr-x---   1 flag05   flag05         94 Mar  5  2016 /usr/sbin/openarenaserver

The script was owned by flag05, confirming it runs with flag05's privileges. Let me break down what the script does:

  1. for i in /opt/openarenaserver/* ; do - Iterates through all files in the /opt/openarenaserver/ directory
  2. (ulimit -t 5; bash -x "$i") - Executes each file as a bash script with a 5-second CPU time limit
    • ulimit -t 5 restricts CPU time to prevent infinite loops
    • bash -x "$i" executes the file with the -x flag for debugging output
  3. rm -f "$i" - Deletes the file after execution

The script essentially functions as an automated task runner that processes and executes any files placed in /opt/openarenaserver/, then removes them.

Step 3: Understanding the Vulnerability

The combination of the cron job and the script's behavior created a significant vulnerability:

  1. The cron job runs every 2 minutes as flag05
  2. The script executes any files in /opt/openarenaserver/ with flag05's privileges
  3. Files are automatically deleted after execution, covering some traces
  4. If I can place a malicious script in /opt/openarenaserver/, it will be executed with elevated privileges

This is a classic example of an insecure automated task execution system. The script processes files from a directory without validating their contents or origin, and the predictable execution schedule makes exploitation straightforward.

Step 4: Crafting the Exploit

To exploit this vulnerability, I needed to create a script that would execute getflag and save the output to a location where I had read access. The /tmp directory is world-writable and perfect for this purpose.

I created the exploit script:

#!/bin/bash

getflag > /tmp/flag

This simple script does the following:

  1. Executes getflag which will run with flag05's privileges
  2. Redirects the output (the flag) to /tmp/flag
  3. Creates the output file with permissions allowing me to read it

I saved this script to /opt/openarenaserver/ with executable permissions so the script was now in place, waiting for the next cron job execution.

Step 5: Retrieving the Flag

After waiting approximately 2 minutes for the cron job to execute, I retrieved the flag. Since /tmp doesn't allow directory listing by default, I accessed the file directly:

cat /tmp/flag

The flag was successfully retrieved: viuaaale9huek52boumoomioc

The exploit worked because:

  1. The cron job ran as scheduled
  2. The openarenaserver script executed my malicious script with flag05's privileges
  3. getflag ran successfully and wrote the flag to /tmp/flag
  4. My script was automatically deleted by the openarenaserver script
  5. The output file remained accessible for me to read

Conclusion

Level05 demonstrated the security risks associated with automated processes that execute files from predictable locations. This vulnerability pattern is particularly dangerous because it combines several security weaknesses:

  1. Information disclosure - The system mail revealed the cron job configuration, making the attack path obvious
  2. Scheduled execution with elevated privileges - The cron job runs as flag05
  3. Predictable behavior - The script executes every 2 minutes like clockwork
  4. World-writable directory processing - Any user can place files in /opt/openarenaserver/
  5. No input validation - The script executes files without checking their contents or origin
  6. Automatic cleanup - File deletion can help attackers cover their tracks

The "You have new mail" message proved to be the critical starting point, leading directly to discovering the cron job configuration. This type of vulnerability is common in production environments where automated processes need to handle user-submitted jobs or tasks. The key lesson is that any directory processed by an automated system with elevated privileges must have strict access controls, and the processing script should validate and sanitize inputs before execution.

Modern systems should implement proper job queuing mechanisms with authentication, authorization, and input validation rather than relying on simple file-based task execution from shared directories.

Flag: viuaaale9huek52boumoomioc

Next Level: Level06