Playing a CTF, I am trying to gain access to level 3 (you have to gain access sequentially from level 1 to level 2 and so on...), and in the level 2 directory there's this source code 2.c and along with it an executable called "2". If you look at the code, you can see the vulnerability that when I run script 2 in the background, I am be able to quickly modify (within the 5s window) the script.sh file in home directory by giving it any command I want it to run. So far I ran the commands in this similar manner echo -e "#!/bin/bash\ncat /var/challenge/level3/devel\n" >> script.sh
With these types of commands I was even able to copy all of its contents and move it to my home directory, and yet no matter what I do, I can't get access to level 3 directory. What am I doing wrong? I tried to do chmod and chown of that file but it still says not permitted.
#include <fcntl.h>
#include <limits.h>
#include <pwd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/types.h>
int main(int argc, char * argv[]) {
char buf[1024], path[PATH_MAX + 1];
int fd, i;
strcpy(path, getpwuid(getuid()) -> pw_dir); //determine user's home directory
strcat(path, "/script.sh");
strcpy(buf, "#!/bin/bash\necho Hello.\ndate\nrm \"$0\"\n");
umask(0); //set file mode creation
if ((fd = open(path, O_CREAT | O_EXCL | O_WRONLY, 02760)) < 0) { // 276 = --w-rwxrw-
perror("open");
return 1;
}
write(fd, buf, strlen(buf));
close(fd);
printf("please wait for us to run your script");
fflush(stdout);
for (i = 0; i < 5; i++) {
printf(".");
fflush(stdout);
sleep(1);
}
printf(" starting script\n");
execl("/bin/sh", "/bin/sh", path, (char * ) 0);
perror("execl");
return 0;
}