Snow-Crash-write-up [level05]

📜 Level 05 Write-up

Level Overview

Category: Privilege Escalation / Cron Job Exploitation
Difficulty: Intermediate — requires knowledge of ACLs, cron, and basic scripting.
Description:
This level contains a scheduled task (cron job) that runs a script from /usr/sbin/openarenaserver as user flag05 every two minutes. The script executes every file inside /opt/openarenaserver/ with flag05 privileges and then removes the executed file — creating an opportunity for privilege escalation if an attacker can place a file in that directory.

Analysis

Initial Investigation

Inside the system, we find an email-like file pointing to a scheduled job and some hints:

Standard Linux local mail is stored under /var/spool/mail or /var/mail. In this environment /var/spool/mail is a symlink to /var/mail and contains a message relevant to the level.

Inspecting the cron configuration reveals:

*/2 * * * * su -c "sh /usr/sbin/openarenaserver" - flag05

Cron schedule explained

Key finding: /usr/sbin/openarenaserver is executed as flag05 periodically (every two minutes).

Permission & ACL Analysis

Listing the script shows:

-rwxr-x---+ 1 flag05 flag05 94 Mar  5  2016 /usr/sbin/openarenaserver*

Querying ACLs:

getfacl /usr/sbin/openarenaserver
# file: usr/sbin/openarenaserver
# owner: flag05
# group: flag05
user::rwx
user:level05:r--
group::r-x
mask::r-x
other::---

What the ACLs show

• flag05 (owner) has rwx.
• level05 has r-- — explicit read permission granted via ACL.
• The group hasr-x, others have no access.

Security implication: Although standard UNIX perms might deny the level05 user, an extended ACL explicitly gives level05 read access to the privileged script. So level05 can read /usr/sbin/openarenaserver and analyze what it does.

Script Analysis

Reading /usr/sbin/openarenaserver reveals:

#!/bin/sh

for i in /opt/openarenaserver/* ; do
 (ulimit -t 5; bash -x "$i")
 rm -f "$i"
done

Behaviour breakdown

• Iterates over every file in /opt/openarenaserver/.
• Executes each file under bash -x inside a subshell with CPU time limit ulimit -t 5.
• Deletes the file after execution (rm -f "$i").
• The whole script is executed as flag05 (because cron runs it under su -c ... - flag05).

Vulnerability: Any file that can be placed into /opt/openarenaserver/ will be executed with flag05 privileges — perfect for privilege escalation if the level05 user can write to that directory.

Exploitation Process

Attack Strategy

1. Create a small script that runs getflag (or other commands) and redirects output to a location accessible to level05.
2. Place the script in /opt/openarenaserver/ where the cron-activated script will execute it.
3. After the cron job runs, the script is executed as flag05 and removed, but the command output is persisted to the chosen output file.
4. Read the output file as level05 to obtain the flag.

Because the cron job executes every 2 minutes, the injected script will be executed by the next scheduled run.

Payload Creation

Create a script named test.sh:

#!/bin/bash
# test.sh - placed into /opt/openarenaserver/
getflag > /var/crash/test.txt

Why this works

• getflag is invoked under flag05 privileges, so the returned token/flag will be produced with flag05 permissions.
• Output is redirected to/var/crash/test.txt, a location where level05 has read access (adjust based on actual filesystem permissions in the environment).
• The cron-runner deletes the script after execution, so avoid expecting the payload file to remain.

Deployment & Retrieval

Step 1 — Deploy payload

# As level05
cp test.sh /opt/openarenaserver/

Step 2 — Execution (cron)

• The cron job runs openarenaserver every 2 minutes, which in turn executes scripts inside /opt/openarenaserver/.
• When it runs, your test.sh gets executed as flag05.

Step 3 — Retrieve output

# As level05
cat /var/crash/test.txt

The file should contain the flag output from the getflag command executed under flag05.

Note: The cron job deletes the script after execution, so if you want to run multiple commands you can create a script that performs several actions in one execution or write outputs to uniquely named files.

Successful Exploitation

By following the above steps, the cron job executes the attacker-supplied script with the flag05 account privileges, which allow the retrieval of the flag05 token/flag into a file readable by level05. The exploit leverages:

• Read access to the privileged script (via ACL) to discover behavior,
• Write access to the watched directory (if present) to drop the payload,
• Cron scheduling that runs the trusted script as flag05.

Conclusion

Vulnerability Summary:
This level demonstrates an insecure cron job configuration combined with permissive file/directory permissions (or misconfigured ACLs). The periodic execution of any file placed in /opt/openarenaserver/ with flag05 privileges enables a straightforward privilege escalation path.

Get B.R.O.L.Y’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Root causes

• Cron runs a script as a privileged user, which blindly executes files from a world-writable (or writeable-by-level05) directory.
• Lack of validation around which files are executed.
• Cleanup (deleting the executed file) hides traces but does not mitigate the privilege escalation risk.

Mitigations & Recommendations

1. Avoid executing arbitrary files from directories writable by untrusted users. If a directory must be used for dynamic scripts, restrict write permissions and enforce strict ownership/permissions.
2. Whitelist scripts by name or use a controlled interface. Instead of for i in /path/*, use an allowlist or a queue mechanism that validates scripts before execution.
3. Drop privileges before executing untrusted content. If the supervisor must run as a privileged user, spawn the executed scripts under a less-privileged user.
4. Use a secure configuration for cron jobs. Avoid su -c "sh /path/script" patterns that execute untrusted content as high-privileged users.
5. Audit and monitor directories that affect system behavior and log executions; alert on unexpected file drops and executions.
6. Use immutable script locations (root-owned, not writable by users) and provide a secure deployment mechanism for admin-controlled scripts.

Final Thoughts

This level is a clean example of how operational convenience (automatic script execution) plus small misconfigurations (ACLs / directory permissions) can lead to full privilege escalation. It reinforces three essential security principles: enforce least privilege, validate inputs (and scripts), and never trust files simply because they appear in a particular directory.

If you want, I can:

• produce a hardened replacement for /usr/sbin/openarenaserver that safely executes only vetted scripts, or
• Craft a short Medium-ready TL;DR block and SEO-friendly title/tags to accompany this write-up for your post.