6 ms·

I thought "/shurdles" problem was to be solved via "chroot".

• pizzalife 3y ago
  You need to be root or have CAP_SYS_CHROOT to use the chroot system call. You can however create a new user and mount namespace on distros that allow unprivileged namespaces (Ubuntu) and then chroot away. The challenge could have been solved that way depending on the kernel used and if the binary was a suid reading a flag file. But the way the challenge was designed, it's more about just changing argv[0] rather than the actual executable path.
  • Matir 3y ago
    Yep, challenge author here, and it was definitely to teach that `argv[0]` is not trustworthy. I've seen privileged processes try to re-invoke themselves (as, say, a child process) by looking at `argv[0]` rather than something like `/proc/self/exe` (which is also subject to race conditions if the directory is writable). The binary was not setuid, but was only executable (not readable) by the user used.
    • pizzalife 3y ago
      >The binary was not setuid, but was only executable (not readable) by the user used. Ah, then ptrace/gdb could have been used to dump it out as well :). Looks like a fun CTF, too bad I was too busy for bsides this year..
  • fsniper 3y ago
    Yes. Thank you. I just missed that part. It's been a long while since doing basic linux administration. I am getting rusty.