Олег, зачем?

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2025-12-25 | Status: Solved Techniques: file_permission_anomaly, file_timestamp_analysis, modified_system_binary_detection

Summary

Task: Find a hidden flag in /usr directory on a Linux system via SSH. Solution: Detected a modified /usr/bin/yes binary with 777 permissions and unusual file size; running it outputs the flag instead of standard behavior.

Олег, зачем? — HackerLab

Description

Сисадмин Олег снова решил пошутить и спрятал наш флаг где-то в директории /usr. Обычно он прячет их в программы, что доступны всем. Его ssh - oleg:megapass, мы используем ubuntu:22.04 в Docker.

Analysis

Key hints from the description:

1. "/usr directory" — the flag is hidden in /usr
2. "programs available to everyone" — standard utilities in /usr/bin
3. "decided to joke" — modified something unexpected

The task is to find a modified system binary. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: SSH Connection

 bash read-only • copy allowed Copy
ssh oleg@<host> -p 10422
# Password: megapass

Step 2: Searching for Anomalies in /usr/bin

Looking for files with suspicious properties:

 bash read-only • copy allowed Copy
# Search for files with unusual permissions (777)
ls -la /usr/bin | grep rwxrwxrwx

# Or search for recently modified files
find /usr -type f -mtime -90 2>/dev/null | head -20

Step 3: Discovering the Modified /usr/bin/yes

 bash read-only • copy allowed Copy
ls -la /usr/bin/yes
# -rwxrwxrwx 1 root root 150208 Oct  5 2024 /usr/bin/yes

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Anomaly indicators:

• 777 permissions (rwxrwxrwx) — system binaries usually have 755
• Size 150208 bytes — standard yes is about 35KB
• Modification date Oct 5 2024 — recently modified

Step 4: Running the Modified Binary

 bash read-only • copy allowed Copy
yes | head -1
# CODEBY{REDACTED}

# Or with an argument
yes flag | head -1
# CODEBY{REDACTED}

Instead of the standard "y" output (or the passed argument), the modified yes outputs the flag.

Checklist for Finding Modified Binaries

1. Access permissions: find /usr/bin -perm 777 2>/dev/null
2. Recent changes: find /usr -mtime -30 -type f 2>/dev/null
3. File size: compare with the reference utility size
4. Behavior: run and check the output
5. Hash sum: compare with the original package ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Notes

• The name yes in the flag (yEs) — a hint to the utility
• 777 permissions — a clear red flag for system binaries
• In real systems, such modifications are a sign of compromise ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍