Rating:

## WorkComputer

My first bash-like question I actually solved, learnt alot. At first I tried to see what I could do, obviously I looked at /bin. Nothing really familiar (I'm still a noob at linux) but one binary really caught my attention, setpriv

I realized that there is a busybox binary, that could probably give me more binaries to use, but i couldn't access it

![](images/1.png)

I fiddled around at it turns out `setpriv --nnp` gives us uid 0 (which somehow isnt root (?) ), this is interesting because maybe uid 0 has more ownership in the shell.

Also it turns out with `setpriv /bin/busybox` I can run the binaries in busybox, such as cat, less, etc. But with this im still uid 1338.

So combining the 2 tricks above I can use the other binaries with "root" (uid 0 :P)

#### Unintended Solution :o

I found using `ls -Rla` that there is a folder named /srv/challenge_setup, owned by uid 0. Looking into the folder I see this xD

![](images/2.png)

"Whoops I dont think i should be here", oh well I'll just try to cat the files..."

![](images/3.png)

"Wow it worked"

##### Flags
* CTF{4ll_D474_5h4ll_B3_Fr33}
* CTF{Th3r3_1s_4lw4y5_4N07h3r_W4y}

#### Easier way

`setpriv --nnp` isnt good actually, I could instead just do `setpriv busybox` and do a chmod on both README.flag and ORME.flag in /challenge. Oh well atleast i solved it and learnt alot

Original writeup (https://github.com/Zafirrt/CTF-Things/tree/master/2019/GoogleCTF-BeginnersQuest/WorkComputer).