Obezbashenniy (Obez-bash-enniy)

Platform: hackerlab | Category: Misc | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2025-12-26 | Status: Solved Techniques: HTTP request crafting without curl, Internal service discovery via netstat, Output filter bypass using character substitution (tr), Python socket as alternative to broken curl, Source code analysis via base64 encoding

Summary

Task: Restricted bash shell with output filtering and broken curl. Solution: Used base64 to read source code, discovered internal Flask service via netstat, bypassed error filter with tr command, and used Python socket instead of broken curl to get the flag.

Obezbashenniy - Hackerlab

Description

Вам предоставлено приложение с интерпретатором bash, но что-то пошло не так. Необходимо найти и исправить неполадки, используя только bash и доступные в нем инструменты.

Analysis

1. Environment Reconnaissance

After connecting to the service on port 10005, I discovered a restricted bash interpreter with commands:

• /cmd <command> - execute command
• /help - help
• /exit - exit

2. Reading Source Code

Direct reading with cat main.py didn't work due to filtering. Used base64 to bypass: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
/cmd base64 main.py

After decoding the output, I found the key filtering logic:

 python read-only • copy allowed Copy
# If the command output contains "error" - returns "Try harder!"
if "error" in output.lower():
    return "Try harder!"

3. Internal Service Discovery

 bash read-only • copy allowed Copy
/cmd netstat -an

Discovered a Flask service on 127.0.0.1:5000 with /flag endpoint.

4. Problem with curl

Attempting to use curl failed:

 bash read-only • copy allowed Copy
/cmd ./curl http://127.0.0.1:5000/flag
# symbol lookup error: ./curl: undefined symbol: curl_easy_option_by_name

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The curl binary in the home directory was broken (libcurl incompatibility).

Solution

Bypassing Two Problems Simultaneously

1. Broken curl - use Python socket for HTTP requests
2. "error" filter - use tr for character substitution

 bash read-only • copy allowed Copy
/cmd python3 -c "import socket;s=socket.socket();s.connect(('127.0.0.1',5000));s.send(b'GET /flag HTTP/1.0\r\n\r\n');d=b'';[d:=d+s.recv(1024) for _ in range(10)];print(d.decode())" 2>&1 | tr "e" "E"

Command breakdown:

• python3 -c "..." - execute Python code
• socket.socket() - create TCP socket
• s.connect(('127.0.0.1',5000)) - connect to Flask
• s.send(b'GET /flag HTTP/1.0\r\n\r\n') - send HTTP request
• [d:=d+s.recv(1024) for _ in range(10)] - read response
• 2>&1 - redirect stderr to stdout
• tr "e" "E" - replace all 'e' with 'E' so the word "error" doesn't trigger the filter ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Alternative Filter Bypass Methods

 bash read-only • copy allowed Copy
# Via sed
... | sed 's/error/err0r/g'

# Via awk
... | awk '{gsub(/error/,"err0r")}1'

# Via base64
... | base64

Lessons

1. base64 - universal way to read files bypassing text filters
2. netstat/ss - internal service discovery
3. Python socket - replacement for curl/wget when unavailable
4. tr/sed - simple bypass of string-based filters via character substitution
5. Always check stderr (2>&1) - it may contain useful information ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍