Hacker News Reader

You need to be root or have CAP_SYS_CHROOT to use the chroot system call. You can however create a new user and mount namespace on distros that allow unprivileged namespaces (Ubuntu) and then chroot away. The challenge could have been solved that way depending on the kernel used and if the binary was a suid reading a flag file.

But the way the challenge was designed, it's more about just changing argv[0] rather than the actual executable path.

View on HN

Yep, challenge author here, and it was definitely to teach that `argv[0]` is not trustworthy. I've seen privileged processes try to re-invoke themselves (as, say, a child process) by looking at `argv[0]` rather than something like `/proc/self/exe` (which is also subject to race conditions if the directory is writable).

The binary was not setuid, but was only executable (not readable) by the user used.

>The binary was not setuid, but was only executable (not readable) by the user used.

Ah, then ptrace/gdb could have been used to dump it out as well :). Looks like a fun CTF, too bad I was too busy for bsides this year..

Yes. Thank you. I just missed that part.

It's been a long while since doing basic linux administration. I am getting rusty.

Reply on news.ycombinator.com