CMD1#
In this ctf we get a program that seems to run a command with a whitelist filter
#include <stdio.h>
#include <string.h>
int filter(char* cmd){
int r=0;
r += strstr(cmd, "flag")!=0;
r += strstr(cmd, "sh")!=0;
r += strstr(cmd, "tmp")!=0;
return r;
}
int main(int argc, char* argv[], char** envp){
putenv("PATH=/thankyouverymuch");
if(filter(argv[1])) return 0;
setregid(getegid(), getegid());
system( argv[1] );
return 0;
}
if our input containt flag/sh/tmp then we exit the program we want to get the flag inside the directroy we also see that it changes the PATH env parameter in order to bypass it we can use “?” as a single character wildcard and use a full absolute path for commands
we can solve it using ./cmd1 “/bin/cat fl?g” and we got the flag
