Guide how to get root (Forgive me senior colleagues. But not everyone understands reverse engineering)
Find commands with privileges "root": find / -perm -4000 -type f 2>/dev/null
Finding a program `/usr/local/bin/notes`
Download `notes` to ourselves and analyze with the help of `cutter` or any other program for reverse engineering
On the left, double-click on the `main` function, on the right, the section of code we need will be displayed.
Here we see an offer to make our choice, look below at the options to choose from.
https://ibb.co/KWzVZCy
When we press 1 - create user, the program creates a 40-byte (0x28) memory partition with the first 24 bytes (0x18) for the username, the last 16 bytes (0x10) for the role, which is automatically assigned as `user`.
https://ibb.co/TqzywGr
When we press 3 - delete the user, the program only frees the memory without setting the pointer to zero, so the pointer position still points to the user object that is created when the user is created.
https://ibb.co/12jJMjM
If you then press 4. The program also creates a 40-byte memory section for writing notes.
https://ibb.co/7V28cJm
And so, in this program there is a problem of code logic.
We first create a user, then delete that user, after which the pointer that points to the memory created by the malloc function will remain in the original location, which is the location of the user object.
Then we create a note, the malloc function will create a 40-byte memory area at the user's original location and write the first 24 bytes as the username, and the next bytes as the user's role.
Case 8 - check if the user is an administrator, and if it is an administrator, then the program will execute the `tar` command: "tar -czvf /root/backups/backup_notes.tar.gz /opt/notes"
And here, too, there is a drawback, the program implicitly calls the tar command without an absolute path, which is a disadvantage of setuid.
The action plan is:
1) You need to create a file called `tar`, for example, in the `tmp` folder with the code:
#!/bin/bash
cp /bin/bash /tmp/bash
chmod +s /tmp/bash
2) Add our `tar` to the $PATH variable
3) Run the program `/usr/local/bin/notes`
Press sequentially 1 (enter any name) -> 3 -> 4 (enter 24 bytes of the name and 16 bytes of the role that we need) -> 8
If you saw the inscription "Access_granted" then you did everything right
4) Run /tmp/bash -p and pick up the root flag
