Program Misuse and Privilege Escalation — PWN COLLEGE

PWN COLLEGE — Introduction

Pwn.college is an education platform for students (and other interested parties) to learn about, and practice, core cybersecurity concepts in a hands-on fashion. In martial arts terms, it is designed to take a “white belt” in cybersecurity to becoming a “blue belt”, able to approach (simple) CTFs and wargames. Our philosophy is “practice makes perfect”.

The platform is maintained by an awesome team of hackers at Arizona State University. It powers much of ASU’s cybersecurity curriculum, and is open, for free, to participation for interested people around the world!

PWN.COLLEGE

Program Misuse: Privilege Escalation

The ‘cat’ command is commonly used to display the contents of a file. In this scenario, the SUID bit is set for ‘cat,’ enabling us to read the /flag file, which the root user owns.

The ‘more’ command is used to view the contents of a file page by page. In this case, we attempt to read the /flag file, leveraging the SUID bit set on ‘more’ and accessing a file owned by root.

Similar to ‘more,’ ‘less’ is a command-line pager for viewing files interactively. Here, we aim to read the /flag file using ‘less’ with the SUID bit set, dealing with a file owned by root.

The ‘head’ command is employed to display the initial lines of a file. In this context, we try to read the /flag file with the SUID bit set on ‘head,’ accessing a file owned by root.

Used to display the last few lines of a file, the ‘tail’ command is applied here to read the contents of the /flag file. The SUID bit is set for ‘tail,’ facilitating access to a file owned by root.