From c7ec95a4cff687c590e79be23f70898d3670ea65 Mon Sep 17 00:00:00 2001 From: Connor Nelson Date: Fri, 17 Feb 2023 11:33:05 -0700 Subject: [PATCH] Lay down the laws of the land --- README.md | 38 +++++++++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index b4bab6c..9d0cdee 100644 --- a/README.md +++ b/README.md @@ -17,4 +17,40 @@ See each challenge's README for further information: - [banana](./hello/banana) - [earth](./world/earth) - [mars](./world/mars) -- [venus](./world/venus) \ No newline at end of file +- [venus](./world/venus) + +## Challenge Writing Laws + +### The Flag + +The flag is located at `/flag`, and is only readable by root. +The challenge will execute as root. +Nothing else is true. + +Do not assume any structure to the flag. +It may or may not have a prefix/suffix. +It may or may not be 50 bytes long. +These things WILL change, and if you rely on them, your challenge WILL break. + +### The Challenge + +The challenge is [`setuid`](https://en.wikipedia.org/wiki/Setuid). +This is how your challenge will execute as root. + +What this *really* means: +- The process will run with an **effective** user of `root`. +- The process will run with a **real** user of `hacker`. + +While an **effective** user of `root` is sufficient for opening the flag, there are some caveats. +When `/bin/sh` (which is linked to `/bin/dash`) is run under this, it will immediately set the **effective** user to the **real** user (unless the `-p` flag is provided). +This means that both the **effective** and **real** user will be `hacker`, and the flag will not be accessible. +This affects `system`, which ultimately just runs `/bin/sh`. + +The challenge can rememedy this by explicitly setting the **real** user to the **effective** user: +```c +setreuid(geteuid(), -1) +``` + + + +