cat: flag.txt: Permission denied
Beginner Hint 1 (AI-translated)
- If you connect with
nc, you will see that a shell starts up. - If you read
chal.sh, you can see thatflag.txtis created before the shell starts. - After that, the permissions of
flag.txtare set to400. - These commands are executed by the
rootuser. - So
400means that only therootuser can read the file. - Then
runuser -u nobody -- shstarts a shell as thenobodyuser. - However, if you run
cat flag.txt, you getPermission denied, so you cannot read the flag. - So how can you read the flag?
Beginner Hint 2 (AI-translated)
- This is a more meta hint, but why does
chal.shbother setting the permissions offlag.txtin the first place? - The permissions of
chal.share specified in theDockerfile. - In the same way, it should also be possible to set the permissions of
flag.txtin theDockerfile. - Think about what behavioral difference is created between setting permissions in the
Dockerfileand setting them later inchal.sh.