Guild icon
Project Sekai
🔒 CrewCTF 2023 / ❌-misc-setjail
Avatar
Sutx BOT 07/07/2023 10:02 PM
setjail - 1000 points
Category: Misc Description: What can you do with one set? Author : Satoooon nc setjail.chal.crewc.tf 8085 Files:Tags: No tags.
07/07/2023 10:02 PM
Sutx pinned a message to this channel. 07/07/2023 10:02 PM
Avatar
Sutx BOT 07/07/2023 10:16 PM
@unpickled admin bot wants to collaborate 🤝
Avatar
Sutx BOT 07/08/2023 2:31 AM
@Violin wants to collaborate 🤝
Avatar
unpickled admin bot 07/08/2023 4:26 AM
this looks like absolute hell btw
04:27
looks like overwriting sys.stdout.flush, but
04:27
ast wont allow functions?
04:28
or perhaps, overwriting print
04:28
but both need funcs
04:29
i will say
04:29
if this was the case:
04:30
path = input("path: ") value = to_value(input("value: ")) ..... module = input("import: ") __import__(module) it would be a trivial challenge as then you could abuse the antigrav module with overwriting os.environ (edited)
Avatar
Avatar
unpickled admin bot
path = input("path: ") value = to_value(input("value: ")) ..... module = input("import: ") __import__(module) it would be a trivial challenge as then you could abuse the antigrav module with overwriting os.environ (edited)
unpickled admin bot 07/08/2023 4:37 AM
(should clarify while it may seem reaching os is not possible, its trivial)
04:37
random._os!
04:38
importing sys is def the best
04:38
because sys gives us alot more modules
04:45
given os we can get posix without raising the posix check
04:51
message.txt
8.5 KB
04:52
shared by os, posix, and their types
Avatar
Sutx BOT 07/08/2023 5:31 AM
@Legoclones wants to collaborate 🤝
Avatar
Legoclones 07/08/2023 5:57 AM
wow wtf is this
06:00
hmm so we can set the attribute of anything of void to a literal
06:01
valid datatypes for value - strings, bytes, numbers, tuples, lists, dicts, sets, booleans, and None (edited)
06:05
And then it looks like walk takes each part of path and passes each through the same validation function, so those are the only types allowed for value or anywhere in path (unless we find mistake in regex parsing), but I'm guessing intended solution is not? I guess I'll go under the assumption no trickeries in checks, but if find nothing I'll come back and challenge this assumption
06:06
here's the other thing - it's setjail, I don't see anything that specifically points to a set tho in code? So maybe it's a hint towards actual solution?
06:07
dir(void) = ['__builtins__', '__cached__', '__doc__', '__file__', '__loader__', '__name__', '__package__', '__spec__']
Avatar
Legoclones 07/08/2023 6:21 AM
how do any imports help us? can we even use it at all?
06:21
Like I can't set value to sys.version even tho it's a string
Avatar
Sutx BOT 07/08/2023 8:47 AM
@Surg wants to collaborate 🤝
Avatar
Avatar
Legoclones
dir(void) = ['__builtins__', '__cached__', '__doc__', '__file__', '__loader__', '__name__', '__package__', '__spec__']
unpickled admin bot 07/08/2023 1:18 PM
well
13:18
sorry wrong msg
Avatar
Avatar
Legoclones
how do any imports help us? can we even use it at all?
unpickled admin bot 07/08/2023 1:18 PM
importing a module can provide code execution
13:18
consider the antigravity module for example
13:18
it opens a web browser
13:19
so like if that was imported after our set, we could add a BROWSER var to os.environ
Avatar
Legoclones 07/08/2023 1:20 PM
ahhh
Avatar
Avatar
unpickled admin bot
random._os!
unpickled admin bot 07/08/2023 1:56 PM
just realised no cuz
13:56
[word in item_key
Avatar
unpickled admin bot 07/08/2023 2:13 PM
stuff in os/posix we can overwrite
message.txt
2.12 KB
14:14
p sure everything capitalised in the beginning are args to posix
14:15
seems env overwriting is the way to go (edited)
Avatar
unpickled admin bot 07/08/2023 3:08 PM
https://docs.python.org/3/using/cmdline.html#envvar
1. Command line and environment
The CPython interpreter scans the command line and the environment for various settings. CPython implementation detail: Other implementations’ command line schemes may differ. See Alternate Impleme...
Thumbnail
Avatar
unpickled admin bot 07/08/2023 3:39 PM
ok i think the module that gives us the most is distutils
15:40
we get all of sys.modules + subproc
Avatar
unpickled admin bot 07/08/2023 3:49 PM
distutils.sys.modules['sysconfig']._CONFIG_VARS we can write to this
Avatar
unpickled admin bot 07/08/2023 5:01 PM
wait
Avatar
Legoclones 07/08/2023 5:01 PM
i'm waiting
Avatar
Avatar
unpickled admin bot
distutils.sys.modules['sysconfig']._CONFIG_VARS we can write to this
unpickled admin bot 07/08/2023 5:02 PM
do we know if sysconfig is just a clone?
17:02
or does it actually change shit
17:06
ok no checking source it does not
17:06
:<<<<<
Avatar
sahuang 07/08/2023 7:19 PM
kurenaif_pray
Avatar
unpickled admin bot 07/08/2023 10:45 PM
whats killing my ideas rn is p much
22:45
we have to import first
22:45
like, there are libraries which if you could set smthng then import you can get them to run code for you
Avatar
unpickled admin bot 07/08/2023 11:46 PM
could we hijack apport?
Avatar
unpickled admin bot 07/08/2023 11:56 PM
no
23:56
we cannot
23:56
auidchaiusdcjhaiuscda
Avatar
unpickled admin bot 07/09/2023 1:13 AM
welp tried my last few ideas, so now imma just read docs on common modules
Avatar
Sutx BOT 07/09/2023 2:22 AM
@kanon wants to collaborate 🤝
Avatar
unpickled admin bot 07/09/2023 2:38 AM
nonak elloh
02:38
ytlaeh era sliajyp
Avatar
unpickled admin bot 07/09/2023 2:45 PM
WE CAN RUN STUFF TWICE??????
14:45
HOW
14:45
WHAT
14:45
aint there any while true
Image attachment
14:47
ogh
14:47
import main
14:47
runs it again
14:47
gives us another setattr
14:47
THATS SO SMART
14:47
:////////////////////////////////////////////////////////////
14:47
im an idiot
14:47
ok
Avatar
Surg 07/09/2023 2:49 PM
Hmm
14:49
Interesting approach
14:49
Intended doesn't run twice tho
Avatar
unpickled admin bot 07/09/2023 2:49 PM
ye
14:49
ctypes
14:50
had no clue ctypes had environ access
14:50
ig what i prob shouldve done is recursed all available modules to check for an env var (edited)
14:50
welp
Avatar
Surg 07/09/2023 2:50 PM
What would an import main exp start to look like
Avatar
unpickled admin bot 07/09/2023 2:50 PM
i fucked up
Avatar
Surg 07/09/2023 2:50 PM
¯\_(ツ)_/¯
14:50
1st is 1st
Avatar
unpickled admin bot 07/09/2023 2:51 PM
:/ ye but im not first in pyjail so im sadge for now (edited)
14:51
PYTHONINSPECT kinda cool tho
Exported 89 message(s)