App - Script

Exploit environment weaknesses, configuration mistakes and common vulnerability patterns in shell scripting and system hardening.

For each of these challenges, you will be provided with connection credentials such as SSH access or a network socket. Depending on the challenge you will need to elevate your privileges or escape the sandbox by exploiting the provided environment.

Prerequisites:
- Some knowledge of the UNIX shell and of common UNIX privilege escalation techniques
- Advanced understanding of scripting languages such as Python, Perl, PHP in order to escape jails

Challenges associated with this section 16 Challenges

Results Challenge's Name Validations Number of points  Explanation for the scores Difficulty  Difficulty Author Note  Notation Solution
pas_valide Bash - System 1 15% 19266 5 Lu33Y 10
pas_valide sudo - weak configuration 11% 13037 5 notfound 4
pas_valide Bash - System 2 10% 12004 10 Lu33Y 10
pas_valide Perl - Command injection 5% 6073 15 Tosh 8
pas_valide Bash - cron 5% 6076 20 g0uZ 7
pas_valide Python - input() 7% 7937 20 g0uZ 11
pas_valide Python - pickle 2% 2551 25 koma 6
pas_valide SSH Agent Hijacking 1% 638 30 mayfly 4
pas_valide Python - PyJail 1 3% 3333 35 sambecks 3
pas_valide Bash/Awk - netstat parsing 1% 199 40 sbrk 3
pas_valide PHP - Jail 1% 147 40 LordRoke 6
pas_valide Python - PyJail 2 2% 1770 40 zM 9
pas_valide Python - Jail - Exec 1% 735 50 Arod 2
pas_valide Javascript - Jail 1% 183 55 waxous 2
pas_valide Python - Jail - Garbage collector 1% 218 55 n0d 2
pas_valide Restricted shells 1% 1117 70 Yorin 3

Challenge Results Challenge Results

Pseudo Challenge Lang date
Aether   SSH Agent Hijacking fr 24 April 2019 at 04:29
Aether   Bash - cron fr 24 April 2019 at 03:37
Aether   Perl - Command injection fr 24 April 2019 at 02:53
NewHell   Bash - System 1 fr 24 April 2019 at 01:56
clempar   Python - Jail - Exec fr 24 April 2019 at 01:50
Aether   Bash - System 2 fr 24 April 2019 at 01:08
Alex   Python - Jail - Exec en 24 April 2019 at 00:42
snowbe   Bash - System 2 fr 24 April 2019 at 00:29
Phalor   Bash - System 1 fr 24 April 2019 at 00:28
snowbe   Perl - Command injection fr 23 April 2019 at 23:11