1. I'm solving CTF challenge, and have to escalate the privilege from user1 to user2, $HOME is read-only, so i can't change $HOME/.bashrc.

  2. sudo -l shows (user2) NOPASSOWRD: /usr/rbash -- i can't write any commands before or after --, it doesn't escalate.

I must get user2 privilege to read a file owned by it, any idea how to get through this?

while $HOME is user1 home, sudo -u user2 rbash -- will cd me to my home $HOME/jail. in a restricted shell, and PATH is set to $HOME/jail, i have tested all possible commands that i can use to escape jail, i almost left nothing, so i can tell that $HOME/jail is empty directory!

  • Is rbash the real rbash, or is it custom/modified for the CTF? What commands are allowed? – multithr3at3d Nov 8 '20 at 15:21
  • yes i guess, it conforms to the man page description, hell of a jail! – Error Nov 8 '20 at 15:28
  • the challenge starts with rbash shell, then you need to go escalate through 14 layers to get your target, in first layer PATH is set to $HOME/jail1 which has vim, and i can break through it, in layer 14, once again PATH is set to $HOME/jail2, which is user2 home, and i can't use ls, or even echo *, and i tested all possible commands i can used to escalate my privilege but nothing works! so the solution around the commands rbash -- itself, – Error Nov 8 '20 at 15:33
  • You still haven't said which commands are available at layer 14, if any. – multithr3at3d Nov 8 '20 at 15:36
  • native shell commands, and echo * lists only sl – Error Nov 8 '20 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.