Privilege Escalation with Nim Package Manager
Source: YouTube · John Hammond · published May 30, 2024 · 27:17
This video demonstrates solving a CTF challenge called "Jack B Nimble" by exploiting vulnerabilities in Nimble, the package manager for the Nim programming language 0:01-0:17. The challenge involves escalating privileges from a basic user account to root and capturing the flag 0:32-0:35.
Key Takeaways:
• Initial privilege escalation is achieved using sudo permissions to run Nimble as the "jack" user 1:12-1:17
• A vulnerability in Nimble version 0.12.0 allows command injection when installing packages 8:33-8:47
• By manipulating the /etc/hosts file and hosting a malicious packages.json, the presenter demonstrates arbitrary code execution 14:50-15:43
• The exploit successfully copies the root flag to an accessible location 21:04-21:14
• An alternative solution involves leveraging Nimble hooks to execute code without needing the version vulnerability 24:30-24:50
The video concludes by showing multiple paths to privilege escalation using Nim programming language package manager features 26:13-26:36.
Sources:
- 0:01-0:17 Introduction to the Jack B Nimble CTF challenge
- 1:12-1:17 Using sudo permissions with Nimble to escalate to jack user
- 8:33-8:47 Discovery of Nimble command injection vulnerability
- 14:50-15:43 Setting up malicious packages.json for code execution
- 21:04-21:14
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
this capture the flag challenge is called Jack B it's in the miscellaneous category dubbed with a medium difficulty however only 86 people solved it during the runtime of the ncon capture the flag this is a challenge that I created I put this together and it says wow Jack is trying to learn one of the hottest new programming languages and on top of that he wants you to learn it too he's giving you access to his development box so generous of him he says just don't hack it please so this is a privilege escalation challenge we need to escalate your privileges and retrieve the contents out of the /root flag. text file we could start this instance up this is one of the dynamic per user dedicated instances I will be running this locally but it requires SSH to log in now I am running this challe…