Skip to content

Instantly share code, notes, and snippets.

View Fa2y's full-sized avatar
🐞
stomping bugs

Ahmed Yasser Merzouk Benselloua Fa2y

🐞
stomping bugs
View GitHub Profile
@Fa2y
Fa2y / Shellmates_Writeup.md
Created April 13, 2020 13:36
A writeup to web ctf challenge by shellmates, command injection, a privesc.

Writeup Web Shellmates

First glance at the application, it was using the command "ping -c 1 $arg" you can see that from the output of the command "Ping Service" web title, so my first try was command injection using ";id" as semicolen is a command separter, i got "okay boomer" XD, so there was some kind of filter,than I tried the pipe "|" as it acts as a command separter and pipe the stdout of the previous command to the stdin of the next one, we just need it as a command separator, tried "cat /etc/passwd" to see what users are available but got "okay boomer" again so we know it's filtering spaces and semicolons,tried "cat</etc/passwd" and it worked:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
.
.
.
ctf:x:1000:1000::/home/ctf:/bin/bash