App - Script

Exploit environment weaknesses, configuration mistakes and vulnerability patterns in scripts and systems.

For each of these challenges, you will be provided with connection credentials such as SSH access or a network socket. Depending on the challenge you will need to elevate your privileges or escape the sandbox by exploiting the provided environment.

Prerequisites:
– Some knowledge of the UNIX shell and of common UNIX privilege escalation techniques
– Advanced understanding of scripting languages such as Python, Perl, PHP in order to escape jails

 25 Challenges

Results Name ↓↑ Validations Number of points  Explanation for the scores Difficulty  Difficulty Author Note  Notation Solution Date
pas_valide Bash - Restricted shells 1% 2141 70 Yorin 8 14 January 2017
pas_valide Bash - System 1 15% 34728 5 Lu33Y 10 8 February 2012
pas_valide Bash - System 2 9% 20747 10 Lu33Y 10 8 February 2012
pas_valide Bash - cron 4% 9724 20 g0uZ 8 6 May 2013
pas_valide Bash - quoted expression injection 1% 509 25 sbrk 4 26 October 2020
pas_valide Bash - race condition 1% 303 25 sbrk 8 5 May 2020
pas_valide Bash - unquoted expression injection 2% 2781 15 sbrk 5 26 October 2020
pas_valide Javascript - Jail 1% 353 55 waxous 2 7 December 2016
pas_valide LaTeX - Command execution 1% 718 20 Podalirius 2 17 March 2021
pas_valide LaTeX - Input 1% 1172 10 Podalirius 2 17 March 2021
pas_valide PHP - Jail 1% 566 40 LordRoke 10 1 March 2019
pas_valide Perl - Command injection 5% 10463 15 Tosh 9 11 August 2015
pas_valide Powershell - Basic jail 1% 493 25 hat.time 8 19 June 2020
pas_valide Powershell - Command Injection 2% 2598 10 hat.time 6 19 June 2020
pas_valide Powershell - SecureString 1% 1458 15 hat.time 2 19 June 2020
pas_valide Python - Jail - Exec 1% 1254 50 Arod 3 23 February 2015
pas_valide Python - Jail - Garbage collector 1% 415 55 n0d 4 12 August 2017
pas_valide Python - PyJail 1 3% 5458 35 sambecks 5 3 January 2015
pas_valide Python - PyJail 2 2% 3145 40 zM_ 10 17 February 2015
pas_valide Python - format string 1% 474 35 lovasoa 1 26 March 2021
pas_valide Python - input() 6% 13674 20 g0uZ 11 27 May 2014
pas_valide Python - pickle 2% 4234 25 koma 10 7 September 2012
pas_valide SSH - Agent Hijacking 1% 1666 30 mayfly 5 7 October 2018
pas_valide Shared Objects hijacking 1% 471 30 das 2 5 March 2020
pas_valide sudo - weak configuration 10% 22906 5 notfound404 4 6 February 2012

Challenge Results Challenge Results

Pseudo Challenge Lang Date
Thg   Bash - System 1 26 January 2022 at 21:12
jacob   Perl - Command injection 26 January 2022 at 21:01
whayx   Bash - System 2 26 January 2022 at 21:00
TallGuy   sudo - faiblesse de configuration 26 January 2022 at 20:37
Fratso   Bash - unquoted expression injection 26 January 2022 at 20:35
ngrt_   Bash - System 1 26 January 2022 at 20:35
jacob   Bash - System 2 26 January 2022 at 20:16
whayx   sudo - faiblesse de configuration 26 January 2022 at 20:15
Mohamed KIMOUCHE   Python - format string 26 January 2022 at 19:53
whayx   Bash - System 1 26 January 2022 at 19:47