5 ms·

Dig at Apple from the third stage of the beginners' quest; "Your first thought is "Why does the display stand need to announce its price? And exactly how much

by AJRF 7y ago

Dig at Apple from the third stage of the beginners' quest; "Your first thought is "Why does the display stand need to announce its price? And exactly how much does 999 dollars convert to in Xenonivian Bucklets?"

tito3 7y ago
Stuck on this one, can see readme.flag but not sure how to proceed
- kwesthaus 7y ago
  Same. As far as I can tell, none of the usual restricted shell escape tricks work, so you just have to search through all the binaries on the system until you find one you can abuse to print the file contents, and that seems like more of a time sink than it's worth.
  - shripadk 7y ago
    Use iconv.
    - archgoon 7y ago
      LOL; I used split in the temp directory to create files of a single byte each and ran md5sum on them. That's quite a bit more straightforward :)
      - shripadk 7y ago
        Well I spent an hour trying out as many commands as possible before giving up. Then came across this comment: https://news.ycombinator.com/item?id=20252612 https://news.ycombinator.com/item?id=20252612 and went through his Twitch recordings to see if he could get past this stage. That is how I learnt about iconv. :)
      - redbluething 7y ago
        Hehe. I kinda love this though :P
    - RaptorJ 7y ago
      shuf also works (its in /usr/bin) -- this took me a ~long~ time to figure out
  - grafporno 7y ago
    env /bin/busybox strings README.flag
    - scrollaway 7y ago
      Nice one! Was wondering if there would be a way to call BusyBox with one of the missing binaries.
- dvno42 7y ago
  Ended up using makemime which showed the data in base64. Good enough! Interestingly enough though the ORME.flag showed permission denied... I'll have to go back to that one later.
  - scrollaway 7y ago
    I think one of the binaries probably has a privilege escalation vulnerability. Looking with la -al you can see the last modified dates, there's a couple of interesting ones
- chris92de 7y ago
  i ended up using fold. theres also has to be a way to read the ORME.flag by modifying the file permissions but i haven't figured that one out yet.
  - ehsankia 7y ago
    Yeah I went through all of the non-deleted commands and fold ended up being the one I found too. The beginning instruction says some levels have multiple flags, so I'm guessing ORME.flag is the hardmode flag.
  - clashmeifyoucan 7y ago
    I bypassed the shell by executing the binary straight from the loader so I was able to do a chmod +r and cat to get it.
    - aereal 7y ago
      how did you do this? amazing
      - clashmeifyoucan 7y ago
        /lib/ld-musl-x86_64.so.1 /bin/busybox chmod +r ORME.flag /lib/ld-musl-x86_64.so.1 /bin/busybox cat ORME.flag
viscanti 7y ago
I wonder if Google will end up buying more of those $999 stands than any other individual customer.
pjmlp 7y ago
Their Android team could learn a thing or two about proper framework development from Apple.
forgot-my-pw 7y ago
Google also sells expensive stands: https://cloud.withgoogle.com/hardware/ https://cloud.withgoogle.com/hardware/ Though it does more (rolls) and actually made by BenQ.

by AJRF 7y ago

tito3 7y ago

Stuck on this one, can see readme.flag but not sure how to proceed

kwesthaus 7y ago
Same. As far as I can tell, none of the usual restricted shell escape tricks work, so you just have to search through all the binaries on the system until you find one you can abuse to print the file contents, and that seems like more of a time sink than it's worth.
- shripadk 7y ago
  Use iconv.
  - archgoon 7y ago
    LOL; I used split in the temp directory to create files of a single byte each and ran md5sum on them. That's quite a bit more straightforward :)
    - shripadk 7y ago
      Well I spent an hour trying out as many commands as possible before giving up. Then came across this comment: https://news.ycombinator.com/item?id=20252612 https://news.ycombinator.com/item?id=20252612 and went through his Twitch recordings to see if he could get past this stage. That is how I learnt about iconv. :)
    - redbluething 7y ago
      Hehe. I kinda love this though :P
  - RaptorJ 7y ago
    shuf also works (its in /usr/bin) -- this took me a ~long~ time to figure out
- grafporno 7y ago
  env /bin/busybox strings README.flag
  - scrollaway 7y ago
    Nice one! Was wondering if there would be a way to call BusyBox with one of the missing binaries.
dvno42 7y ago
Ended up using makemime which showed the data in base64. Good enough! Interestingly enough though the ORME.flag showed permission denied... I'll have to go back to that one later.
- scrollaway 7y ago
  I think one of the binaries probably has a privilege escalation vulnerability. Looking with la -al you can see the last modified dates, there's a couple of interesting ones
chris92de 7y ago
i ended up using fold. theres also has to be a way to read the ORME.flag by modifying the file permissions but i haven't figured that one out yet.
- ehsankia 7y ago
  Yeah I went through all of the non-deleted commands and fold ended up being the one I found too. The beginning instruction says some levels have multiple flags, so I'm guessing ORME.flag is the hardmode flag.
- clashmeifyoucan 7y ago
  I bypassed the shell by executing the binary straight from the loader so I was able to do a chmod +r and cat to get it.
  - aereal 7y ago
    how did you do this? amazing
    - clashmeifyoucan 7y ago
      /lib/ld-musl-x86_64.so.1 /bin/busybox chmod +r ORME.flag /lib/ld-musl-x86_64.so.1 /bin/busybox cat ORME.flag

viscanti 7y ago

I wonder if Google will end up buying more of those $999 stands than any other individual customer.

pjmlp 7y ago

Their Android team could learn a thing or two about proper framework development from Apple.

forgot-my-pw 7y ago

Google also sells expensive stands: https://cloud.withgoogle.com/hardware/ https://cloud.withgoogle.com/hardware/ Though it does more (rolls) and actually made by BenQ.