vimjail

[tiwanari]

• ssh ctfuser@ec2-54-200-176-5.us-west-2.compute.amazonaws.com
• password: loginPWforVimJail Can you read the flag?

[tiwanari]

ctfuser@ip-172-31-31-196:~$ ls -al
total 40
drwxr-x--x 3 root          ctfuser    4096 Feb 25 09:39 .
drwxr-xr-x 4 root          root       4096 Feb 25 08:42 ..
-rw-r--r-- 1 root          root         10 Feb 25 10:57 .bash_login
-rw-r--r-- 1 root          root         10 Feb 25 10:57 .bash_logout
-rw-r--r-- 1 root          root         10 Feb 25 10:57 .bash_profile
-rw-r--r-- 1 root          root          0 Feb 25 08:42 .bashrc
---S--x--- 1 topsecretuser secretuser 8768 Feb 25 08:42 flagReader
-rw-r--r-- 1 root          root         10 Feb 25 10:57 .profile
drwxr-xr-x 2 root          root       4096 Feb 25 09:39 .ssh

[tiwanari]

ctfuser@ip-172-31-31-196:~$ ls -al /
total 100
drwxr-xr-x  23 root          root           4096 Feb 25 19:05 .
drwxr-xr-x  23 root          root           4096 Feb 25 19:05 ..
drwxr-xr-x   2 root          root           4096 Feb 25 18:22 bin
drwxr-xr-x   3 root          root           4096 Feb 21 23:49 boot
drwxr-xr-x  17 root          root           3860 Feb 25 19:05 dev
drwxr-xr-x  91 root          root           4096 Feb 26 08:19 etc
-r--------   1 topsecretuser topsecretuser    39 Feb 25 08:42 .flag
drwxr-xr-x   4 root          root           4096 Feb 25 08:42 home
lrwxrwxrwx   1 root          root             32 Feb 21 23:48 initrd.img -> boot/initrd.img-4.4.0-64-generic
drwxr-xr-x  21 root          root           4096 Feb 25 08:28 lib
drwxr-xr-x   2 root          root           4096 Feb 21 23:47 lib64
drwx------   2 root          root          16384 Feb 21 23:49 lost+found
drwxr-xr-x   2 root          root           4096 Feb 21 23:46 media
drwxr-xr-x   2 root          root           4096 Feb 21 23:46 mnt
drwxr-xr-x   2 root          root           4096 Feb 21 23:46 opt
dr-xr-xr-x 202 root          root              0 Feb 25 19:05 proc
drwx------   4 root          root           4096 Feb 25 10:23 root
drwxr-xr-x  23 root          root            880 Feb 26 08:54 run
drwxr-xr-x   2 root          root          12288 Feb 21 23:49 sbin
drwxr-xr-x   2 root          root           4096 Feb 17 20:37 snap
drwxr-xr-x   2 root          root           4096 Feb 21 23:46 srv
dr-xr-xr-x  13 root          root              0 Feb 25 19:06 sys
drwxrwxrwt  26 root          root           4096 Feb 26 08:55 tmp
drwxr-xr-x  10 root          root           4096 Feb 21 23:46 usr
drwxr-xr-x  13 root          root           4096 Feb 21 23:49 var
lrwxrwxrwx   1 root          root             29 Feb 21 23:48 vmlinuz -> boot/vmlinuz-4.4.0-64-generic

[tiwanari]

また rbash

~/flagReader を使って /.flag を読む？