# Not So Great Escape__Category__: Misc  __Points__: 440>We've set up a chroot for you to develop your musl code in. It's bare, so install whatever you need.>>Feel free to log in with a raw TCP socket at challenges.tamuctf.com:4353.>>The password is "2ff6b0b9733a294cb0e0aeb7269dea5ae05d2a2de569e8464b5967c6c207548e"
#### Overview
The server sets up a remote shell in a chroot for us where we can   do basically anything. Below is a snapshot of an interaction with   the server which shows essential information needed later on:```sh-5.0$ nc challenges.tamuctf.com 4353Password: 2ff6b0b9733a294cb0e0aeb7269dea5ae05d2a2de569e8464b5967c6c207548e
/ # ls -lls -ltotal 0drwxr-xr-x    2 root     root          1740 Mar 29 12:23 bindrwxr-xr-x    4 root     root           100 Mar 29 12:23 devdrwxr-xr-x   19 root     root           840 Mar 29 12:23 etcdrwxr-xr-x    2 root     root            40 Mar 29 12:23 homedrwxr-xr-x    6 root     root           320 Mar 29 12:23 libdrwxr-xr-x    5 root     root           100 Mar 29 12:23 mediadrwxr-xr-x    2 root     root            40 Mar 29 12:23 mntdrwxr-xr-x    2 root     root            40 Mar 29 12:23 optdr-xr-xr-x    2 root     root            40 Mar 29 12:23 procdrwx------    2 root     root            60 Mar 29 12:23 rootdrwxr-xr-x    2 root     root            40 Mar 29 12:23 rundrwxr-xr-x    2 root     root          2080 Mar 29 12:23 sbindrwxr-xr-x    2 root     root            40 Mar 29 12:23 srvdrwxr-xr-x    2 root     root            40 Mar 29 12:23 sysdrwxr-xr-t    2 root     root            40 Mar 29 12:23 tmpdrwxr-xr-x    7 root     root           140 Mar 29 12:23 usrdrwxr-xr-x   12 root     root           260 Mar 29 12:23 var/ # ididuid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)/ # envenvchroot_dir=/tmp/tmp.AFCIBhHOSTNAME=96e785d2213aSHLVL=3SOCAT_PEERADDR=178.6.193.66HOME=/rootSOCAT_PEERPORT=54244SOCAT_SOCKADDR=172.17.0.5version=2.10.4-r3SOCAT_VERSION=1.7.3.3SOCAT_SOCKPORT=4353arch=x86_64PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binmirror=http://mirror.math.princeton.edu/pub/alpinelinux/PWD=/SOCAT_PID=8SOCAT_PPID=1/ # exitexitsh-5.0$ ```Interesting things from the snapshot:- We are root- We have a full-blown Alpine linux setup- We know the chroot directory
The objective is clear: Do a chroot escape.
#### Chroot Escapes in TheoryA process has two important properties when it comes to locating files in the filesystem.- `cwd` (current working directory) which is used as the basis for relative paths- `root` which is used as the basis for absolute paths Everybody knows that when `cwd = /home` opening `asdf` would cause the operating system to open`/home/asdf`. In the same way when `root = /home` opening `/asdf` would still result in the operating system looking for `/home/asdf`.   We have the view of the process on the one hand and the view of the operating system on the other hand.  It starts to get interesting when the `cwd` is above the `root` like so:   `cwd = /tmp/tmp.AFCIBh` and `root = /tmp/tmp.AFCIBh/some-sub-dir`.    Opening `asdf` now would result in the operating system looking for `/tmp/tmp.AFCIBh/asdf`while opening `/asdf` would result in the operating system looking for `/tmp/tmp.AFCIBh/some-sub-dir/asdf`.    
And all that chroot() does is setting the `root` property of a process to the given path.   Note that only the root user is allowed to change this property and that doing a chroot()does not affect the `cwd`. You have to change `cwd` manually with chdir().
Utilizing that knowledge we can create a chroot escape plan.
#### Crafting a Chroot EscapeThe basic exploit plan is as follows:
| # | Command            | cwd of process                         | root of process        ||---|--------------------|----------------------------------------|------------------------|| 0 | _Login_            | /                                      | /tmp/tmp.AFCIBh        || 1 | mkdir("subdir")    | /                                      | /tmp/tmp.AFCIBh        || 2 | chroot("./subdir") | /tmp/tmp.AFCIBh                        | /tmp/tmp.AFCIBh/subdir || 3 | chdir("..")        | /tmp                                   | /tmp/tmp.AFCIBh/subdir || 4 | chdir("..")        | /                                      | /tmp/tmp.AFCIBh/subdir || 5 | exec("./bin/sh")   | /                                      | /tmp/tmp.AFCIBh/subdir |
See [payload.c](./payload.c) for an implementation of this in C.
#### Crafting an ExploitThe exploit for this challenge is:- Build a binary that implements a chroot escape like above- Convert that binary to base64- Upload it to the server- Decode it - Execute it
See [exploit.py](./exploit.py) for the concrete exploit.
After all that we get the flag```gigem{up_up_&_a_way_0u7}```