Skip to content
logo
Red tradecraft
Bash: System 1
  • Privacy greenhouse
  • Defence blues
  • Purple crossroads
  • Indigo observatory
  • Contact
Initializing search
    • An adversary mind map, one of many
    • The grounds
    • Ankh-Morpork: the city leaves a footprint
    • Fungolia earthworks
    • Unseen University Power & Light Co.
    • The Scarlet Semaphore
    • TryHackMe rooms
    • Root-Me challenges
      • Boars in the API undergrowth
      • Rooting around in memory
      • Picking the locks of ciphers
      • Where a script hands over the keys
        • Bash: System 1
          • Resources
        • sudo: weak configuration
        • Bash: System 2
        • LaTeX: Input
        • Powershell: Command Injection
        • Bash: unquoted expression injection
        • Perl: Command injection
        • Bash: cron
        • Python input()
        • Python pickle
      • Rhizomatic sprawl: the network underworld
      • Prising binaries open
      • Secrets buried in pixels
      • Foraging in the web orchard
    • RIPE NCC Academy labs
    • Resources

    Bash: System 1¶

    root-me challenge: ELF32-System-1: Find your path, padawan!


    Source
    
    #include <stdlib.h>
    #include <stdio.h>
     
    /* gcc -m32 -o ch11 ch11.c */
     
    int main(void) 
    {
    	system("ls /challenge/app-script/ch11/.passwd"); 
    	return 0;
    }
    

    The ls command is not using an absolute path.

    Resources¶

    • Dangers of SUID Shell Scripts

    • SUID Privileged Programs

    2026-07-30 17:57
    © Copyright 2025, TyMyrddin.
    Created using Sphinx 7.2.6. and Sphinx-Immaterial

    Made with love by Ty Myrddin, 2026, with a forest garden fostered by /ut7