deadface23_hostbusters3.md (1368B)
1 title: "DEADFACE CTF 2023 Host Busters 3 Writeup" 2 date: 2023-10-26 12:00 3 --- 4 > Continue characterizing the machine. Is there any way you can 5 escalate to a user that has permissions the vim user does not have? Find 6 the flag associated with this user. 7 Submit the flag as `flag{flag_here}`. 8 9 ``` 10 vim@ghost404.deadface.io letmevim 11 ``` 12 13 You first login to vim, which has vim open. Then you escape from it like you 14 did in the OverTheWire Bandit challenges with `:set shell=bash` and `:shell`. Now you have a proper shell over SSH. 15 16 The first thing I looked at after mistaking Host Busters 1's key in the home 17 directory as 3 was look at what other user home directories there were by 18 running `ls /home`. I saw there were a few users, notably `gh0st404` and 19 `spookyboi`. 20 21 `gh0st404`'s user home directory had his OpenSSH private key as 22 world-readable and in plain sight not in his `.ssh` hidden 23 directory. It being world-readable would have had OpenSSH scream at you, but 24 them being stupid was good for us. 25 26 So, once you use that SSH private key to login as `gh0st404`, 27 you can check the contents of hostbusters3.txt and you got the flag. 28 29 ``` 30 cat hostbusters3.txt 31 ``` 32 33 > "This is why you should have come to the Monday meetings for OverTheWire." 34 ~Joey, FPUSEC President 35 36 [Here's](https://asciinema.org/a/ZhQQwEVwgaqtGCuaqRf6NWu8N) an 37 asciinema of the entire thing in action.