> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/wne.md).

# wne

This isn't even binary Exploitation challenge lol, The objective was to read a `flag.txt` file located in a restricted directory (`/root`) that the current user `ctf-player` did not have permissions to access.

### **Vulnerability: Privilege Escalation via SUID and Env Var**

Upon inspecting the provided binary using `ls -la`, I noticed the following: `-rwsr-xr-x 1 root root bin`

The **`s`** in the permissions indicates the **SETUID** bit. This means when any user executes `bin`, it runs with the privileges of the file owner (in this case, **root**).

The binary was programmed to list the contents of a directory specified by the environment variable `SECRET_DIR`. Because the program does not properly sanitize this variable before passing it to a system call, it is vulnerable to **Command Injection**.

### **Exploitation Strategy**

#### **1. Identifying the Injection Point**

Initially, setting `export SECRET_DIR=/root` confirmed the binary would list the files in the protected directory. However, listing files is not enough; we need to read the content of the flag.

#### **2. Crafting the Injection**

By using command chaining (the pipe `|` or semicolon `;`), we can append our own commands to the one the binary intends to run.

I attempted to inject a `cat` command: `export SECRET_DIR="ls -la /root | cat /root/flag.txt"`

When the binary executes, it essentially runs a command similar to: `ls [SECRET_DIR]` $\rightarrow$ `ls ls -la /root | cat /root/flag.txt`

#### **3. Execution**

Running the binary with the manipulated environment variable forced the system to execute our injected `cat` command with root privileges, bypassing the standard filesystem permissions.

**Command:**

```bash
export SECRET_DIR="ls -la /root | cat /root/flag.txt"
./bin
```

**Result:** The program errored out on the `ls` portion but successfully executed the `cat` portion, revealing the flag: **`picoCTF{Power_t0_man!pul4t3_3nv_19a6873b}`**

***

### **Key Takeaway**

Programs running with elevated privileges (SUID) must never trust input from the user's environment. Environment variables like `PATH`, `LD_PRELOAD`, or custom variables like `SECRET_DIR` can be manipulated to hijack the program's logic.

***

#### **Suggested Commit Message**

> **feat: add write-up for SUID environment variable injection**
>
> * Explained SUID bit exploitation on 64-bit ELF.
> * Detailed command injection via SECRET\_DIR environment variable.
> * Included terminal logs showing the escalation from lising to reading the flag.

That was a clean solve! Are you planning to add this to your "Go Tool Builder’s Master Cheatsheet" repository as an example of insecure system calls?


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/binary-exploitation/wne.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.