While messing around with the Shenanigans module of the Linux Luminarium, I noticed that a typo somewhere in /challenge/victim has the script leak the randomly-generated password because it tries to pass it to Bash as a command, which makes Bash complain.
What's more, even if sudo is disabled on the container, we can use that handy /challenge/bin/su, pass the leaked string and login as zardus, thereby breaking the flow of (some of) the challenges. Below is a demo screenshot.
While messing around with the Shenanigans module of the Linux Luminarium, I noticed that a typo somewhere in
/challenge/victimhas the script leak the randomly-generated password because it tries to pass it to Bash as a command, which makes Bash complain.What's more, even if
sudois disabled on the container, we can use that handy/challenge/bin/su, pass the leaked string and login as zardus, thereby breaking the flow of (some of) the challenges. Below is a demo screenshot.