webPromedium

Undervattensgalleriet

undutmaning

Task: Ruby/Sinatra photo gallery with tar file upload on Alpine Linux. Solution: Two-stage tar symlink attack to bypass BusyBox protections, overwrite ERB template, then use SUID sqlite3 readfile() to read root-owned flag.

$ ls tags/ techniques/
suidrubysymlinkbusyboxsinatratar_extractionsqlite3erbalpine
arbitrary_file_writetwo_stage_tar_symlink_attackerb_template_overwritesuid_sqlite3_readfile
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups