LinuxLuminarium

starlitxiling Lv3
  2024-07-30 20:41:53 2024-07-30 20:41:53 Created   2024-09-14 22:05:54 2024-09-14 22:05:54 Updated    1.6k Words  7 Mins  

应该是今年为初学者新加的项目，不是很难，但是还是有很多不知道的，浅 浅 写了一遍收获还不错。题目旁边还多了个hacker，我记得以前只有solve来着，不知道什么意思，可能是更hacker的解决办法，心情爆炸来pwn看看还是不错的。

Hello Hackers

Intro to Commands

学会执行命令就行，直接 

1
./hello




Intro to Arguments

在会执行命令的基础上学会给命令传参，这里我们可以看到/challenge/bin下面有两个文件，一个是hello，一个是hacker，题目说的很明白了要把hacker的参数传给hello，照做就行了。

1
./hello ./hacker

注意要在/challenge/bin目录下


Pondering Paths

The Root

一开始以为是

1
/challenge/bin/pwn

后面发现不对，然后看了一下/目录的，发现这个目录下也有一个pwn，所以直接

1
/pwn

即可


Program and aboslute paths

1
/challenge/run




Position thy self

1
/challenge/run

然后进入他提醒你要进入的目录再执行一次就行了。


Position elsewhere

和Position thy self


Position yet elsewhere

和Position thy self


implicit relative paths, from /

1
2
cd /
challenge/run

按照题目提示就行。


explicit relative paths, from /

1
2
cd /
./challenge/run

根据题名写题……


implicit relative paths

1
2
cd /challenge
./run




home sweet home

1
2
3
cd ~
touch a
/challenge/run ~/a

这里题目说了参数要少于3个字符，然后/目录又没有权限创建文件，所以在~目录下创建一个文件，然后作为参数传进去，这里题目要求了是要absolute path，又限制了参数字符数目，所以只能用~来代表/home/hacker。值得注意的点有~代表的是一个absolute path。


Comprehending Commands

cat: not the pet, but the command!

1
2
3
/challenge/run	
cd /
cat flag

这里比较离谱的点是题目说flag file in your home directory，其实应该在~目录下，但是我是在/目录下找到的。


catting absolute paths

1
2
3
/challenge/run
cd /
cat flag




more catting practice

根据题目给的目录cat就好了，注意这个目录在最开始就给出了，要是clear掉了就重新刷新一下题目吧。


grepping for a needle in a haystack

1
grep pwn.college /challenge/data.txt




listing files

ls看一下/challenge下有什么再执行就行。


touching files

1
2
3
touch /tmp/pwn
touch /tmp/college
/challenge/run




removing files

1
2
rm delete_me
/challenge/check




hidden files

1
2
ls -a /
cat /.flag-224672682014244




An Epic Filesystem Quest

照着线索走就行，唯一要注意的就是有的目录会有很多文件，线索的文件名是全部大写的，看文件名全为大写的就行。


making directories

1
2
3
mkdir /tmp/pwn
touch /tmp/pwn/college
/challenge/run




finding files

1
2
find / -name flag
cat /flag




Digesting Documentation

Learning From Documentation

1
/challenge/challenge --giveflag




Learning Complex Usage

1
/challenge/challenge --printfile /flag




Reading Manuals

1
man challenge

然后跟着里面做就行，比如

1
/challenge/challenge --soqkid 821




Searching Manuals

在man page里面搜flag就行，有一个参数是This argument will give you the flag!,用这个参数就可以拿到flag。


Searching For Manuals

就是用man man去查man命令的查找参数，找到是-K之后就可以man -K /challenge/challlenge查看man page找argument获取flag了。注意这里是大写的K，且man -K会需要一点时间，不要以为是卡死了，是在正常检索。


Helpful Programs

1
2
/challenge/challenge -h
/challenge/challenge -p

这里会获得一个数字，然后把这个数字用来

1
/challenge/challenge -g NUMBER

这样就能获得flag了。


Help for Builtins

1
2
help challenge
challenge --secret NUMBER




File Globbing

Matching with *

1
2
cd /ch*
./run




Matching with ?

1
2
cd /?ha??enge
./run




Matching with []

1
2
cd /challenge/files
/challenge/run file_[bash]




Matching paths with []

1
/challenge/run /challenge/files/file_[bash]




Mixing globs

1
2
cd /challenge/files
/challenge/run [cep]*

这里要求要用括号，还要少于6个字符，感觉只能这样取巧了。


Exclusionary globbing

1
2
cd /challenge/files
/challenge/run [!pwn]*




Practicing Piping

Redirecting output

1
echo PWN > COLLEGE




Redirecting more output

1
2
/challenge/run > myflag
cat myflag




Appending output

1
/challenge/run >> /home/hacker/the-flag




Redirecting errors

1
2
3
/challenge/run > myflag 2> instructions
cat instructions
cat myflag

知道FD 2是standard error就行。


Redirecting input

1
2
echo COLLEGE > PWN
/challenge/run < PWN




Grepping stored results

1
2
/challenge/run > /tmp/data.txt
cat /tmp/data.txt | grep pwn




Grepping live output

1
/challenge/run | grep pwn




Grepping errors

这里要表达的就是grep命令是捕获standard output而不是standard error，但是你可以将standard error重定向为standard output然后grep，你可以通过>&符号，它可以将一个文件描述符重定向为另一个文件描述符。所以你可以这样2>&1然后在通过|去grep。如下：

1
/challenge/run 2>&1 | grep pwn




Duplicating piped data with tee

这里从man page中和教程中知道了tee命令是从读一个输入并输出到屏幕、文件和命令中。所以我们要先/challenge/pwn | tee pwn | /challenge/college，然后输出会在屏幕和pwn文件中，从pwn文件中，可以看到/challenge/pwn需要参数，所以加上参数传给/challenge/college就好了。

1
/challenge/pwn --secret sGFA5iZl | /challenge/college




Writing to multiple programs

使用tee往多个程序里写输入就好了。

1
/challenge/hack | tee >(/challenge/the) >(/challenge/planet)




Shell Variables

Printing Variables

1
echo $FLAG




Setting Variables

1
PWN=COLLEGE




Multi-word Variables

1
PWN="COLLEGE YEAH"




Exporting Variables

1
2
3
export PWN=COLLEGE
COLLEGE=PWN
/challenge/run




Printing Exported Variables

1
env | grep pwn.college




Storing Command Output

1
2
PWN=$(/challenge/run)
echo $PWN




Reading Input

1
2
read -p "INPUT: " PWN
COLLEGE

使用read -p去指定一个环境变量的值，中间的引号内容可以改变，但是不能去掉，即不能直接read -p PWN。


Reading Files

1
read PWN < /challenge/read_me




Processes and Jobs

Listing Processes

1
2
ps -aux 
/challenge/17200-run-5626




Killing Processes

1
2
3
4
ps -aux | grep challenge
kill 44
kill 64
/challenge/run




Interrupting Processes

1
2
/challenge/run
Ctrl + c(send "interrupt" )




Suspending Processes

1
2
3
/challenge/run
Ctrl + z (suspend processes to the background)
/challenge/run




Resuming Processes

1
2
3
/challenge/run
Ctrl + z
fg (将后台命令提到前台)




Backgrounding Processes

1
2
3
4
/challenge/run
Ctrl + z
bg
/challenge/run




Foregrounding Processes

1
2
3
/challenge/run
bg
fg




Starting Backgrounded Processes

1
/challenge/run &




Perceiving Permissions

Changing File Ownership

1
2
chown hacker /flag
cat /flag




Groups and Files

1
2
chgrp hacker /flag
cat /flag




Fun With Groups Names

1
2
3
id
chgrp grp26348 /flag
cat /flag




Changing Permissions

1
2
chmod 0666 /flag
cat /flag




Executable Files

1
2
chmod 777 /challenge/run
/challenge/run




Permission Tweaking Practice

学会用chmod改权限就行，这里我全程用的421，其他的真不会。。。。。。



Permissions Setting Practice

1
chmod u=rx,g=w,o=x /challenge/pwn

按照这个模板根据要求改权限就好了。


The SUID Bit

s指的是被设置了SUID之后可以被执行的程序。

1
2
3
chmod u+s /challenge/getroot
/challenge/getroot
cat /flag

SUID



Untangling Users

Becoming root with su

1
2
3
su
hack-the-planet
cat /flag




Other users with su

1
2
su zardus
/challenge/run




Cracking passwords

1
2
3
4
john /challenge/shadow-leak (wait a few minutes)
su zardus
aardvark
/challenge/run




Using sudo

1
sudo cat /flag




Chaining Commands

Chaining with Semicolons

1
/challenge/pwn; /challenge/college




Your First Shell Script

1
2
3
4
vim x.sh
	/challenge/pwn; /challenge/college

bash x.sh




Redirecting Script Output

1
bash x.sh | /challenge/solve




Executable Shell Scripts

1
2
3
4
5
vim script.sh
	#!/bin/bash
	/challenge/solve
chmod +x script.sh
./script.sh




Pondering PATH

The PATH Variable

1
2
PATH=""
/challenge/run

原来ls命令是从变量里面读取当前路径的。


Setting PATH

1
2
PATH=/challenge/more_commands
/challenge/run




Adding Commands

1
2
3
4
5
6
7
mkdir myscript
vim ~/myscript/win
	#!/bin/bash
	/run/current-system/sw/bin/cat /flag

PATH="~/myscript"
/challenge/run




Hijacking Commands

1
2
3
4
5
6
vim ~/myscript/rm
	#!/bin/bash
	/run/current-system/sw/bin/cat /flag

PATH="~/myscript"
/challenge/run

说的很明显了。


  • Title: LinuxLuminarium
  • Author: starlitxiling
  • Created at : 2024-07-30 20:41:53
  • Updated at : 2024-09-14 22:05:54
  • Link: http://starlitxiling.github.io/2024/07/30/LinuxLuminarium/
  • License: This work is licensed under CC BY-NC-SA 4.0.
Comments
On this page
LinuxLuminarium
  1. Hello Hackers
    1. Intro to Commands
    2. Intro to Arguments
  • Pondering Paths
    1. The Root
    2. Program and aboslute paths
    3. Position thy self
    4. Position elsewhere
    5. Position yet elsewhere
    6. implicit relative paths, from /
    7. explicit relative paths, from /
    8. implicit relative paths
    9. home sweet home
  • Comprehending Commands
    1. cat: not the pet, but the command!
    2. catting absolute paths
    3. more catting practice
    4. grepping for a needle in a haystack
    5. listing files
    6. touching files
    7. removing files
    8. hidden files
    9. An Epic Filesystem Quest
    10. making directories
    11. finding files
  • Digesting Documentation
    1. Learning From Documentation
    2. Learning Complex Usage
    3. Reading Manuals
    4. Searching Manuals
    5. Searching For Manuals
    6. Helpful Programs
    7. Help for Builtins
  • File Globbing
    1. Matching with *
    2. Matching with ?
    3. Matching with []
    4. Matching paths with []
    5. Mixing globs
    6. Exclusionary globbing
  • Practicing Piping
    1. Redirecting output
    2. Redirecting more output
    3. Appending output
    4. Redirecting errors
    5. Redirecting input
    6. Grepping stored results
    7. Grepping live output
    8. Grepping errors
    9. Duplicating piped data with tee
    10. Writing to multiple programs
  • Shell Variables
    1. Printing Variables
    2. Setting Variables
    3. Multi-word Variables
    4. Exporting Variables
    5. Printing Exported Variables
    6. Storing Command Output
    7. Reading Input
    8. Reading Files
  • Processes and Jobs
    1. Listing Processes
    2. Killing Processes
    3. Interrupting Processes
    4. Suspending Processes
    5. Resuming Processes
    6. Backgrounding Processes
    7. Foregrounding Processes
    8. Starting Backgrounded Processes
  • Perceiving Permissions
    1. Changing File Ownership
    2. Groups and Files
    3. Fun With Groups Names
    4. Changing Permissions
    5. Executable Files
    6. Permission Tweaking Practice
    7. Permissions Setting Practice
    8. The SUID Bit
  • Untangling Users
    1. Becoming root with su
    2. Other users with su
    3. Cracking passwords
    4. Using sudo
  • Chaining Commands
    1. Chaining with Semicolons
    2. Your First Shell Script
    3. Redirecting Script Output
    4. Executable Shell Scripts
  • Pondering PATH
    1. The PATH Variable
    2. Setting PATH
    3. Adding Commands
    4. Hijacking Commands