diff --git a/jailbreak/Dockerfile b/jailbreak/Dockerfile new file mode 100644 index 0000000..5c3e610 --- /dev/null +++ b/jailbreak/Dockerfile @@ -0,0 +1,27 @@ +FROM --platform=linux/amd64 ubuntu@sha256:86ac87f73641c920fb42cc9612d4fb57b5626b56ea2a19b894d0673fd5b4f2e9 AS build + +RUN apt-get update -y && apt-get install -y gcc && apt-get install -y wget && apt-get install -y unzip && rm -rf /var/lib/apt/lists/* + +RUN wget -Oynetd.c https://raw.githubusercontent.com/johnsonjh/ynetd/master/ynetd.c \ + && gcc -o ynetd ynetd.c \ + && rm -f /tmp/ynetd.zip + + +FROM --platform=linux/amd64 python:3.8-slim-buster AS deployer + +RUN useradd -m -d /home/ctf -u 12345 ctf +WORKDIR /home/ctf + +# copy over ynetd +COPY --from=build ynetd ynetd +RUN chmod +x ynetd + +# copy over source and set permissions +COPY . . +RUN chown -R root:root /home/ctf + + +# run and expose +USER ctf +EXPOSE 9999 +CMD ["./ynetd", "-p", "9999", "python3 main.py"] \ No newline at end of file diff --git a/jailbreak/chall.yaml b/jailbreak/chall.yaml new file mode 100644 index 0000000..cbc6a65 --- /dev/null +++ b/jailbreak/chall.yaml @@ -0,0 +1,19 @@ +name: JailBreak +categories: + - misc +value: 75 +flag: + file: ./flag.txt +description: |- + After a recent prison escape due to hidden messages in letters, the facility has tightened security. Can you find a way around these new measures? +hints: + - How can you gain access to all global variables in python? +files: + - src: ./main.py +authors: + - Jack Crowley +visible: true +deploy: + nc: + build: . + expose: 3000/tcp \ No newline at end of file diff --git a/jailbreak/flag.txt b/jailbreak/flag.txt new file mode 100644 index 0000000..54a3304 --- /dev/null +++ b/jailbreak/flag.txt @@ -0,0 +1 @@ +camp{PYth0n_M4steR_M2!f45} \ No newline at end of file diff --git a/jailbreak/main.py b/jailbreak/main.py new file mode 100644 index 0000000..c47bd27 --- /dev/null +++ b/jailbreak/main.py @@ -0,0 +1,20 @@ +def sanitize(): + try: + return eval(msg) + except Exception: + return str(msg) + +try: + global hidden_flag + with open("flag.txt","r") as f: + hidden_flag = f.read() + +except Exception: + hidden_flag = "REDACTED" + + +print("Welcome to the prison's mail center") +msg = input("Please enter your message: ") + +print("Your message is:",end=' ') +print(sanitize()) \ No newline at end of file diff --git a/jailbreak/solve.md b/jailbreak/solve.md new file mode 100644 index 0000000..ee2ab60 --- /dev/null +++ b/jailbreak/solve.md @@ -0,0 +1,5 @@ +# JailBreak + +The `eval` function in python is very dangerous, especially with it evaluating an input given by the user. For instance, if you type evaluatate a string with the value of `randomVariable`, it will evaluatate to the value of a variable `randomVariable`. + +This can be used to retrieve the flag, as when it asked for the user input, if you give it `hidden_flag`, it will print out contents of the `hidden_flag` variable, which in this case is the flag. \ No newline at end of file