RegistrierenSidebar verstecken
Nickname: 
Passwort: 
Sitzung auf IP beschränken 
Fragen  |  score: 4  |  4.31 6.31 6.69 |  Von 495 Mitgliedern gelöst  |  78808 views  |  seit 12. Apr 2012 17:13:32

Py-Tong (Exploit, Python, Warchall)

Py-Tong
Ein Nachwuchs-Hacker fordert Dich heraus ein simples Python Script zu exploiten.
Um die Lücke Live auszunutzen musst du einen Shell Account auf der Warchall Box anlegen und Dein Glück dort versuchen.
Um zu sehen worum es geht kannst du hier den Quelltext ansehen.

Notiz: Es ist nicht notwendig eine Race Condition zu provozieren, dies sollte aber dennoch funktionieren.
Notiz: Zum Ausbeuten der Lücke musst du das "pytong" Programm ausführen, nicht das pytong.py Script. Dieses Programm ist ein Wrapper welches unter SETREGID läuft und dir dann die Lösung ausspuckt.

Happy Challenging!
GeSHi`ed python Quelltext für pytong.py
1
2
3
4
56
7
8
9
1011
12
13
14
1516
17
18
19
2021
22
23
24
2526
27
28
29
3031
32
33
34
3536
37
38
39
4041
42
43
44
4546
47
48
49
5051
52
53
54
5556
57
58
59
60
#!/usr/bin/python
import sys
import os
import os.path
 SOLUTION = "/home/level/12/solution.txt"
 
 
# Your main objective is to return True
def main(filepath):        # We want to prevent some noobish solutions
        if any(ipattern in filepath for ipattern in ('proc', 'uptime', 'tmp', 'random', 'full', 'zero', 'null')):
                raise ValueError('nononono: hacking is not allowed')
 
        # You have to give me an valid file!        if not os.path.exists(filepath):
                raise ValueError('sorry file "%s" does not exists' % filepath)
 
        # We are opening the file here and store the content in 'jjk'
        print('opening %s' % filepath)        with open(filepath) as gizmore:
                jjk = gizmore.read()
        print('closed')
 
        # The file was closed, does it still exists?        if not os.path.exists(filepath):
                # The file does not exists anymore, you have found a solution
                print('You are l33t')
                return True
        else:                # Ok, we will reopen the file and store its content in 'kwisatz'
                with open(filepath) as spaceone:
                        kwisatz = spaceone.read()
 
                # Does the content differs from old content?                if jjk != kwisatz:
                        # content differs so return True
                        print('You are a winner')
                        return True
         raise ValueError('fail...')
 
 
if __name__ == "__main__":
        if len(sys.argv) < 2:                print('wrong argcount')
                sys.exit(1)
 
        try:
                # Objective: return True here!                success = main(sys.argv[1])
        except (ValueError, OSError, IOError) as exc:
                print('%s' % (exc,))
                sys.exit(3)
        else:                #os.setuid(os.geteuid())
                os.setgid(os.getegid())
                with open(SOLUTION) as fd:
                        print(fd.read())
 
Ihre Lösung für Py-Tong
Antwort
© 2012, 2013, 2014, 2015, 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023 und 2024 by space