[ Docker ] Bandit Wargame 만들기 - 32번 문제 ( 33 / 33 )

1. Bandit32 목표

After all this git stuff, it’s time for another escape. Good luck!

Commands you may need to solve this level
sh, man

 

2. Bandit32 구현

# 비밀번호 root 입력 접속
ssh -oStrictHostKeyChecking=no root@localhost -p 2220

useradd bandit33 && echo -e "tQdtbs5D5i2vJwkO8mEyYEyTL8izoeJ0\ntQdtbs5D5i2vJwkO8mEyYEyTL8izoeJ0" | passwd bandit33

chmod 755 /home/bandit33

chown root:root /home/bandit33

chown -R root:root /home/bandit33/.[!.]*

echo tQdtbs5D5i2vJwkO8mEyYEyTL8izoeJ0 > /etc/bandit_pass/bandit33

chown bandit33:bandit33 /etc/bandit_pass/bandit33

chmod 400 /etc/bandit_pass/bandit33

cat <<'BANDIT_TMP' > /tmp/uppershell.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <ctype.h>

#define MAX_CMD_LEN 1024

void to_uppercase(char *str) 
{
    for (int i = 0; str[i]; i++) 
    {
        str[i] = toupper(str[i]);
    }
}

int main() 
{
    char cmd[MAX_CMD_LEN];

    printf("WELCOME TO THE UPPERCASE SHELL\n");

    while (1) 
    {
        printf(">> ");

        if(fgets(cmd, MAX_CMD_LEN, stdin) == NULL) 
        {
            break;
        }

        cmd[strcspn(cmd, "\n")] = '\0';

        to_uppercase(cmd);

        pid_t pid = fork();
        if(pid == 0) 
        {
            execlp("sh", "sh", "-c", cmd, (char *)NULL);
            perror("Command execution failed");
            exit(EXIT_FAILURE);
        }
        else if(pid > 0) 
        {
            wait(NULL);
        }
        else 
        {
            perror("Fork failed");
            exit(EXIT_FAILURE);
        }
    }

    return 0;
}
BANDIT_TMP

gcc -o /home/bandit32/uppershell /tmp/uppershell.c

chown bandit33:bandit32 /home/bandit32/uppershell

chmod 4750 /home/bandit32/uppershell

chsh -s /home/bandit32/uppershell bandit32

 

3. Bandit32 문제풀의

# bandit32 로 설정한 패스워드를 입력하여 접속한다.
# 3O9RfhqyAlVBEZpVb6LYStshZoqoSx5K
ssh -oStrictHostKeyChecking=no bandit32@localhost -p 2220

# 실행중인 파일의 쉘 프로그램을 실행
$0

# 패스워드 확인
cat /etc/bandit_pass/bandit33