journal-rights
- •
Attribution
- •
Solved by Fauzi Ismail during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.
- •
- •
What it asked
- •
Explain a risky
sudo journalctlrule and reconstruct a protected note from recorded audit evidence, without performing privilege escalation.
- •
- •
Approach
- •
The sudoers fragment allowed
auditorto runjournalctl -n 50as root without a password and lackedNOEXEC. - •
The transcript showed an interactive pager. Its recorded shell escape read the protected note and emitted seven-byte hexadecimal chunks.
- •
Filter the chunks to
session=pts/2andevent=root-note, sort byseq, concatenate the hex, then decode. The challenge is evidence reconstruction; no live escalation is needed.
- •
- •
Solution
- •
parts = [ "4b4d49504e387b", "7375646f5f7061", "6765725f657363", "6170655f726571", "75697265735f72", "65737472696374", "696f6e7d", ] print(bytes.fromhex("".join(parts)).decode())
- •
- •
Verification
- •
The supplied chunks decode locally to the recorded flag.
- •
- •
Concepts
- •
Sudo command delegation; pager shell escapes;
NOEXEC; log filtering; hex reconstruction.
- •
- •