webmedium

Undervattensgalleriet

undutmaning

Task: Ruby/Sinatra photo gallery with tar file upload on Alpine Linux. Solution: Two-stage tar symlink attack to bypass BusyBox protections, overwrite ERB template, then use SUID sqlite3 readfile() to read root-owned flag.

$ ls tags/ techniques/
suidrubysymlinkbusyboxsinatratar_extractionsqlite3erbalpine
arbitrary_file_writetwo_stage_tar_symlink_attackerb_template_overwritesuid_sqlite3_readfile
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]