Challenge Description:
Can you abuse the banner?The server has been leaking some crucial information on tethys.picoctf.net 64075. Use the leaked information to get to the server.To connect to the running application use nc tethys.picoctf.net 56966. From the above information abuse the machine and find the flag in the /root directory.
Approach:
Netcatting into port 64075 gives us
This is an SSH banner that leaks a password. Ssh'ing into this port doesn't give us any further access
Moving on to port 56966, we get a small quiz
After answering the quiz with the gotten password, we get access to the player account on this machine.
Moving onto /root for the flag:
Bummer, let's look at the conspicuous script:
2 interesting points:
+ We are using a pty shell
+ The script reads and prints /home/player/banner
I also made the assumption that the script process probably has sudo priveleges
Unable to use my favorite text editor nano to change the banner location in the script, I had to make the script read from /root/flag.txt. Thus, I decided to try using a symbolic link:
And it works after nc'ing again!
