Root Me : plateforme d'apprentissage dédiée au Hacking et à la Sécurité de l'Information

Deep learning - Malicious model

blackndoor — 2024-07-26T18:33:13Z

NEVER load a downloaded model without first carrying out a few checks.
The following site seems to perform these before loading, but perhaps sub-processes can be run ?

- App - Script

Python - Eval Is Evil

Mr7F — 2023-12-28T09:58:27Z

Escape from the cage designed by a very picky developer to get a shell !
In his graciousness, he did provide you with the sandbox's source code :

#!/usr/bin/env python3
def say_hello():
print("Hello")
def check_code(code):
if "__" in str(code.co_names):
raise Exception("Try again")
for const in code.co_consts:
if hasattr(const, "co_names"):
check_code(const)
BUILTINS = {
"str": str,
"int": int,
"bool": bool,
"bytes": bytes,
"type": type,
"Exception": Exception,
"isinstance": isinstance,
"print": print,
"say_hello": say_hello,
"__import__": lambda *a, **kw: print("Can not import !"),
}
def sandbox(code):
code = compile(code.strip(), "", "exec")
check_code(code)
eval(code, {"__builtins__": BUILTINS}, {})
code = ""
while True:
line = input(">>> ")
code += " \n" + line
while line:
line = input("")
code += " \n" + line
try:
sandbox(code)
except Exception as e:
print(e)
code = ""

Télécharger

Paramètres de connexion au challenge

Hôte	challenge02.root-me.org
Protocole	SSH
Port	2222
Accès SSH	ssh -p 2222 -ch@challenge02.root-me.org WebSSH
Nom d'utilisateur	-ch
Mot de passe	-ch

- App - Script

R : Code Execution

Fey — 2023-09-25T10:48:03Z

Your Statistical Analysis Reviews in R are approaching. Your teacher has made an R interpreter available on the ENT of the university so that you can practice. You don't have time to revise, you decide to steal the exam papers.

- App - Script

AppArmor - Jail Medium

nivram — 2023-09-25T10:47:07Z

Attention : this challenge is available via the CTF-ATD "AppArmorJail2" machine. There is no /passwd file, so it is not possible to validate the machine on the CTF-ATD.

The administrator isn't happy : you've managed to bypass his previous AppArmor policy. So he's improved it so that you can no longer read his precious secrets.

He's so sure of himself that he's left the configuration to you in order to taunt you. Show him it was a bad idea !

#include
profile docker_chall_medium flags=(attach_disconnected,mediate_deleted) {
#include
network,
capability,
file,
umount,
signal (send,receive),
deny mount,
deny /sys/[^f]*/** wklx,
deny /sys/f[^s]*/** wklx,
deny /sys/fs/[^c]*/** wklx,
deny /sys/fs/c[^g]*/** wklx,
deny /sys/fs/cg[^r]*/** wklx,
deny /sys/firmware/** rwklx,
deny /sys/kernel/security/** rwklx,
deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
# deny write to files not in /proc//** or /proc/sys/**
deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w,
deny @{PROC}/sys/[^k]** w, # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel)
deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w, # deny everything except shm* in /proc/sys/kernel/
deny @{PROC}/sysrq-trigger rwklx,
deny @{PROC}/kcore rwklx,
/usr/local/bin/sh px -> shprof2,
deny /home/admin/** w,
deny /home/admin/flag_here/flag.txt r,
}
profile shprof2 flags=(attach_disconnected,mediate_deleted) {
#include
#include
network,
capability,
mount,
deny mount cgroup, # prevent container escape
umount,
file,
signal (send,receive),
deny /sys/[^f]*/** wklx,
deny /sys/f[^s]*/** wklx,
deny /sys/fs/[^c]*/** wklx,
deny /sys/fs/c[^g]*/** wklx,
deny /sys/fs/cg[^r]*/** wklx,
deny /sys/firmware/** rwklx,
deny /sys/kernel/security/** rwklx,
deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
# deny write to files not in /proc//** or /proc/sys/**
deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w,
deny @{PROC}/sys/[^k]** w, # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel)
deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w, # deny everything except shm* in /proc/sys/kernel/
deny @{PROC}/sysrq-trigger rwklx,
deny @{PROC}/kcore rwklx,
/lib/x86_64-linux-gnu/ld-*.so mr,
deny /home/admin/** w,
deny /home/admin/flag_here/flag.txt r,
}

Télécharger

Start the "AppArmorJail2" CTF-ATD
Connect via SSH to machine port 22222 (admin:admin)
The challenge validation password is in the file /home/admin/flag_here/flag.txt

Do not hesitate to change the password of the admin user so that you are the only one on the machine to carry out your operations.

Démarrer le CTF all the day

- App - Script

AppArmor - Jail Introduction

nivram — 2023-05-10T13:01:03Z

Attention : this challenge is available via the CTF-ATD "AppArmorJail1" machine. There is no /passwd file, so it is not possible to validate the machine on the CTF-ATD.

When connecting to the administrator's server, a restricted shell via an AppArmor policy prevents you from reading the flag even though you are the owner...

Find a way to read the flag at any cost and override the AppArmor policy in place which is configured as follows :

#include 
 
 profile docker_chall01 flags=(attach_disconnected,mediate_deleted) {
 #include 
 network,
 capability,
 file,
 umount,
 signal (send,receive),
 deny mount,
 
 deny /sys/[^f]*/** wklx,
 deny /sys/f[^s]*/** wklx,
 deny /sys/fs/[^c]*/** wklx,
 deny /sys/fs/c[^g]*/** wklx,
 deny /sys/fs/cg[^r]*/** wklx,
 deny /sys/firmware/** rwklx,
 deny /sys/kernel/security/** rwklx,
 
 deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
 # deny write to files not in /proc//** or /proc/sys/**
 deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w,
 deny @{PROC}/sys/[^k]** w, # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel)
 deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w, # deny everything except shm* in /proc/sys/kernel/
 deny @{PROC}/sysrq-trigger rwklx,
 deny @{PROC}/kcore rwklx,
 
 /home/app-script-ch27/bash px -> bashprof1,
 
 }
 profile bashprof1 flags=(attach_disconnected,mediate_deleted) {
 #include 
 #include 
 
 network,
 capability,
 deny mount,
 umount,
 signal (send,receive),
 
 deny /sys/[^f]*/** wklx,
 deny /sys/f[^s]*/** wklx,
 deny /sys/fs/[^c]*/** wklx,
 deny /sys/fs/c[^g]*/** wklx,
 deny /sys/fs/cg[^r]*/** wklx,
 deny /sys/firmware/** rwklx,
 deny /sys/kernel/security/** rwklx,
 
 deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
 # deny write to files not in /proc//** or /proc/sys/**
 deny @{PROC}/{[^1-9],[^1-9][^0-9],[^1-9s][^0-9y][^0-9s],[^1-9][^0-9][^0-9][^0-9]*}/** w,
 deny @{PROC}/sys/[^k]** w, # deny /proc/sys except /proc/sys/k* (effectively /proc/sys/kernel)
 deny @{PROC}/sys/kernel/{?,??,[^s][^h][^m]**} w, # deny everything except shm* in /proc/sys/kernel/
 deny @{PROC}/sysrq-trigger rwklx,
 deny @{PROC}/kcore rwklx,
 
 / r,
 /** mrwlk,
 /bin/** ix,
 /usr/bin/** ix,
 /lib/x86_64-linux-gnu/ld-*.so mrUx,
 deny /home/app-script-ch27/flag.txt r,
 }

Start the CTF-ATD "AppArmorJail1"
Connect via SSH to the machine on port 22222 (app-script-ch27:app-script-ch27)
The challenge validation password is in the /home/app-script-ch27/flag.txt file

Do not hesitate to change the user app-script-ch27's password to be sure that you're alone on the box to carry out your manipulations

Démarrer le CTF all the day

- App - Script

Docker - Talk through me

Nishacid — 2022-02-24T19:25:52Z

Now that you have demonstrated to the system administrator that his containers were not secure, he therefore asks you to log in to test the security of his new container while he deploys a second one.

– Start the CTF-ATD "Talk through me"
– Log on to the machine docker using SSH on port 2222 (root / JL&g#4zNkQ&ztF8b)
– Challenge validation password is in the file .passwd
– CTF-ATD validation password is in the file /passwd

Démarrer le CTF all the day

- App - Script

Docker - Sys-Admin's Docker

Nishacid — 2022-02-24T19:25:43Z

You have proven to this administrator that he cannot find out how to secure a container, he is mad with rage and puts in place additional security measures.

– Start the CTF-ATD "Sys-Admin's Docker"
– Log on to the machine docker using SSH on port 2222 (root / &h ?rHjb6z#h8&gYx)
– Challenge validation password is in the file .passwd
– CTF-ATD validation password is in the file /passwd

Démarrer le CTF all the day

- App - Script

Docker - I am groot

Nishacid — 2022-02-24T19:25:34Z

One of the sysadmins deploys a docker machine as root and with privileges, he tells you it's not important because as long as it's in the container it's secure :)

– Start the CTF-ATD "I am groot"
– Log on to the machine docker using SSH on port 2222 (root / arq87TNDCf9NfksD)
– Challenge validation password is in the file .passwd
– CTF-ATD validation password is in the file /passwd

Démarrer le CTF all the day

- App - Script

Python - format string

lovasoa — 2021-03-26T06:33:07Z

Identify and exploit the vulnerability in the following script to extract validation's password :

Paramètres de connexion au challenge

Hôte	challenge02.root-me.org
Protocole	SSH
Port	2222
Accès SSH	ssh -p 2222 -ch@challenge02.root-me.org WebSSH
Nom d'utilisateur	-ch
Mot de passe	-ch

- App - Script

LaTeX - Command execution

Podalirius , Mhd_Root — 2021-03-17T09:07:57Z

Execute commands to find the flag !

Paramètres de connexion au challenge

Hôte	challenge02.root-me.org
Protocole	SSH
Port	2222
Accès SSH	ssh -p 2222 -ch@challenge02.root-me.org WebSSH
Nom d'utilisateur	-ch
Mot de passe	-ch

- App - Script