Loading
A junior admin at Kirana Mart saved the ls -l output of the company web server. Something in the permissions is wrong.
The permission string shows who can read, write and execute a file. The last three characters are for everyone else: a w there means anyone on the system can change that file. If root owns such a file, an attacker who rewrites it can cause real damage.
What you are given: the directory listing below.
What to find: the one file that is world-writable AND owned by root. Then build the flag exactly like this: the letters MXC, an opening brace, the file name without its extension, an underscore, the 4 characters stamped on the ticket below, and a closing brace.
Ticket code: 431x
Listing of /srv/kiranamart:
total 48
drwxr-xr-x 2 root root 4096 Mar 3 09:10 .
drwxr-xr-x 4 root root 4096 Mar 3 09:10 ..
-rw-r--r-- 1 root root 220 Mar 3 09:10 config.ini
-rw-r--r-- 1 kirana kirana 1843 Mar 3 09:10 index.html
-rwxr-xr-x 1 root root 512 Mar 3 09:10 deploy.sh
-rw-rw-rw- 1 root root 214 Mar 3 09:10 world_writable_mistake.txt
-rw-r--r-- 1 www-data www-data 4096 Mar 3 09:11 access.log
-rw------- 1 root root 128 Mar 3 09:11 secrets.env
drwxr-xr-x 2 kirana kirana 4096 Mar 3 09:11 uploads
-rw-r--r-- 1 priya priya 96 Mar 3 09:12 notes.txt
-r--r--r-- 1 root root 2048 Mar 3 09:12 price.db
Submit the flag when you have it.
This challenge only. All names, addresses and data are fictional. Do not test any real system.
Stuck? Open hints in order: a nudge, then the next step, then an explicit pointer. Costs are taken from this solve's points.
Sign in to open hints.
Sign in to submit a flag.
Sign in, then solve this challenge or give up on it to read write-ups.