From 3da5fd982ffa9e031402209a126f0773508f3878 Mon Sep 17 00:00:00 2001
From: ARZ <60057481+AbdullahRizwan101@users.noreply.github.com>
Date: Sat, 4 Dec 2021 19:26:11 +0500
Subject: [PATCH] Create pathfinder.md
---
echoCTF/pathfinder.md | 83 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 83 insertions(+)
create mode 100644 echoCTF/pathfinder.md
diff --git a/echoCTF/pathfinder.md b/echoCTF/pathfinder.md
new file mode 100644
index 0000000..2ce7e9f
--- /dev/null
+++ b/echoCTF/pathfinder.md
@@ -0,0 +1,83 @@
+# echoCTF - pathfinder
+This is an OS category challenge in which we are provided an IP address and a port to conenct using `nc`
+
+We can get the first flag by connecting with netcat and printing the evnironmental variables with `env`
+
+
+
+## Privilege Escalation (curiosity)
+On runnning `sudo -l` we can see that opportunity user can run `ls` binary as `curiosity`
+
+
+
+
+
+Using this flag we can switch to curiosity user
+
+## Privilege Escalation (insight)
+
+Running `sudo -l` to see what we can run as other user , it seems that there's a custom binary named `insight`
+
+
+
+On running this binary , it will print this message
+
+
+
+Let's transfer this binary on to our host machine so that we can analyze what's going on in this binary
+
+
+
+I used `ghidra` to analyze the binary , looking at the `main` function it's just setting the uid,gid and eid to 1005 (pathfinder user's id) and just printing a string
+
+
+
+But we can see here that a shared library is being used , shared library is loaded by the program when it starts
+
+
+
+By following this article https://www.hackingarticles.in/linux-privilege-escalation-using-ld_preload/ , I used the same c langugage code , changed the root's id to insight's id which was 1004
+
+```c
+#include
+#include
+#include
+void _init() {
+unsetenv("LD_PRELOAD");
+setgid(1004);
+setuid(1004);
+system("/bin/sh");
+}
+```
+
+Now to compile this
+
+
+
+Host the shared object file and transfer it to the target machine
+
+
+
+
+
+
+## Privilege Escalation (pathfinder)
+
+Running `sudo -l` again , we can see this user can run `pathfinder` binary , another custom binary
+
+
+
+on running this in a directory where we don't have permissions to read file , it will give us an error that `ls` cannot open directory , which means that ls binary is being used here and it's possible that it isn't using it's absolute path i.e `/bin/ls` , here comes PATH variable exploit in which we create a fake `ls` binary which will invoke `bash` and for that we will need to add the path for our fake binary
+
+
+
+## Privilege Escalation (ETSCTF)
+Doing `sudo -l` with this user will show us that we can run `/usr/bin/env` which is used to print environmental variables as `ETSCTF` user
+
+
+
+Let's just visit GTFOBINS for this binary
+
+
+
+