blob: 238ea65784dad8554f69bccaba083607d63a42a4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
title: "DEADFACE CTF 2023 Host Busters 3 Writeup"
date: 2023-10-26 12:00
---
> Continue characterizing the machine. Is there any way you can
escalate to a user that has permissions the vim user does not have? Find
the flag associated with this user.
Submit the flag as `flag{flag_here}`.
```
vim@ghost404.deadface.io letmevim
```
You first login to vim, which has vim open. Then you escape from it like you
did in the OverTheWire Bandit challenges with `:set shell=bash` and `:shell`. Now you have a proper shell over SSH.
The first thing I looked at after mistaking Host Busters 1's key in the home
directory as 3 was look at what other user home directories there were by
running `ls /home`. I saw there were a few users, notably `gh0st404` and
`spookyboi`.
`gh0st404`'s user home directory had his OpenSSH private key as
world-readable and in plain sight not in his `.ssh` hidden
directory. It being world-readable would have had OpenSSH scream at you, but
them being stupid was good for us.
So, once you use that SSH private key to login as `gh0st404`,
you can check the contents of hostbusters3.txt and you got the flag.
```
cat hostbusters3.txt
```
> "This is why you should have come to the Monday meetings for OverTheWire."
~Joey, FPUSEC President
[Here's](https://asciinema.org/a/ZhQQwEVwgaqtGCuaqRf6NWu8N) an
asciinema of the entire thing in action.
|
