Hacker News Reader

Comment by mhartl | Hacker News Reader

Once they've run this for a while, I'd love to see a post and screencast on some of the techniques needed to solve it. I don't know much about this subject, and I'd enjoy having a chance to learn in a setting unlikely to get me arrested.

View on HN

I would also like to see a detailed explanation of how they prepared the box to safely allow people to play (ie logins, permissions, etc). How to restrict privileges yet allow just enough to make it varied and fun.

The big thing is that we are connected into a chroot that has neither /proc nor /sys mounted, and which itself is on a read-only filesystem.

I'd love to see how people solved #2, and if they used any special tools like I did or if there's an easier way to do it. And I can't wait to delve deeper into #3 tomorrow :)

For 2, I just used this short command line:

http://pastebin.com/4nAWNrgV

I've stuck it on pastebin instead of in this comment, so it doesn't spoil it for anyone not looking.

Tool used: One line of javascript, entered in location bar. (Seems Chrome resource inspector doesn't allow the edit I needed.)

Damn, I always forget you can actually just use javascript to "do it", and end up using a Firefox add-on.

If I were in Firefox at the time I would have used Firebug (or I guess Firecookie, I don't remember if Firebug allows native editing of cookies), but I just happened to have Chrome running at the time.

FWIW I looked at the source and recognized the exploit.

From there you basically only need curl.

curl --user user:pw --digest does digest authentication.

curl --verbose will show what headers are being sent down from the server.

curl --headers 'Cookie: blah' will send a header back.

So no special tools required.

My first thought before I realized you could actually see the php code, was that it was some kind of sanitizing input exploit, maybe SQL injection (with the name or age) or, since the HTML input fields had "length" to go over that.

Once I figured out what to do, it was only a matter of finding the right tool to do it. I didn't realize curl could [edit: --redacted--] (cool!), but I used OWASP ZAP and did a [edit: --redacted--]. Same method, different tool. Btw, thank you for explaining the curl options, I normally don't use curl much, but apparently I should :)

EDIT: Redacted stuff so as not to ruin the fun for others

I used a Firefox add-on that lets you [mumble mumble]. I found at least two add-ons that looked like they would work when I googled it.

I love all the different responses on this -- I used OWASP ZAP to do it.

I just posted http://news.ycombinator.com/item?id=3631381 It's a complete walkthrough to the flag.

Reply on news.ycombinator.com