[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_222":223,"_224":176},"routes/_root/_root",{"_220":-7,"_42":55,"_148":-7,"_221":-7},"routes/_root.tags.$tagCanonical+/_root",{"_38":171,"_83":172,"_173":16,"_174":175},"routes/_root.tags.$tagCanonical+/challenges.$challengeCanonical+/_root",{"_79":80,"_81":82,"_83":84},"routes/_root.tags.$tagCanonical+/challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25,26,27,28],"name","permission denied","canonicalName","permission-denied",{"_29":72,"_31":73,"_33":74,"_35":16,"_36":16,"_37":16,"_38":75,"_40":76,"_42":43,"_44":16,"_45":77},{"_29":65,"_31":66,"_33":67,"_35":16,"_36":16,"_37":16,"_38":53,"_40":68,"_42":43,"_44":16,"_45":69},{"_29":59,"_31":60,"_33":61,"_35":16,"_36":16,"_37":16,"_38":53,"_40":62,"_42":43,"_44":16,"_45":63},{"_29":50,"_31":51,"_33":52,"_35":16,"_36":16,"_37":16,"_38":53,"_40":54,"_42":55,"_44":16,"_45":56},{"_29":30,"_31":32,"_33":34,"_35":16,"_36":16,"_37":16,"_38":39,"_40":41,"_42":43,"_44":16,"_45":46},"author",{"_20":47,"_48":49},"writeupElementId","8a5c7d5f","writeupId","8a5c7d5f-0ba2-48eb-a1c2-13fcfc89d6a3","canEdit","canLike","likedByViewer","title","Writeup for Daily AlpacaHack 4/26-5/2","url","https://www.notion.so/kakur41-wrteup/Daily-AlpacaHack-4-26-5-2-34dda8520c0281cf867ed4f089149af6?source=copy_link","language","ja","isOfficial","createdAt",["D",1778279596470],"kakur41","gravatarHash","b38a5e77015b23df77d112279a16aaba1c929e984106792bf5505dff367d67fa",{"_20":57,"_48":58},"b05d1b75","b05d1b75-4309-432d-a83c-bf8e20eaab51","Writeup for permission denied","https://blog.02labs.me/posts/permission-denied/","en",["D",1777956536328],"02loveslollipop","df37c2830d195ecbc13a52c45e51f8592dcb0326d1be1228773c99fe8bed4b2a",{"_20":64,"_48":-5},"1473678f","1473678f-08dd-4bb6-908d-00ec2d6022d4","https://github.com/nozokare/my-alpaca-ctf/tree/main/2026-04/29-daily-permission-denied",["D",1777567600977],"nozokare",{"_20":70,"_48":71},"7db52d90","7db52d90-fa7c-43e1-8d08-359491755faf","https://github.com/tadanobutubutu/permission-denied-solve/blob/master/README.md",["D",1777487733820],"tadanobutubutu","32d088d6e11be98c7280952c1fdfeb6a6ee1b5056555fe814e35720483c99e51",{"_20":78,"_48":-5},"a9fb6eb5","a9fb6eb5-0be6-467c-b8a1-52c6ced02294","Daily AlpacaHackに挑戦するつくよみちゃん 04/29 misc/Permission Denied/minaminao","https://www.nicovideo.jp/watch/sm46246153",["D",1777845891936],"tsukuyomi-chan","challenge",{"_20":21,"_22":23,"_88":89,"_90":91,"_92":93,"_94":95,"_96":97,"_98":99,"_100":101,"_102":103,"_104":16,"_105":-7,"_106":107,"_108":-7,"_109":-7,"_37":16,"_110":111,"_112":113,"_114":16,"_115":-7,"_116":16,"_117":-7,"_118":-7,"_119":120,"_121":-7,"_122":-7,"_123":-7,"_124":125,"_126":16,"_127":125,"_36":125,"_128":-7,"_129":130,"_131":132,"_133":134,"_135":136},"availablePages",[85,86,87],"canonicalUrl","https://alpacahack.com/tags/file-permission/challenges/permission-denied","Description","Solves","Writeups","solves",83,"difficulty",55,"flagFormat","Alpaca{...}","categories",[168],"attachments",[164],"remote",{"_161":162,"_163":125},"description","cat: flag.txt: Permission denied\n\n

Beginner Hint 1 (AI-translated)

\n\n- If you connect with `nc`, you will see that a shell starts up.\n- If you read `chal.sh`, you can see that `flag.txt` is created before the shell starts.\n- After that, the permissions of `flag.txt` are set to `400`.\n- These commands are executed by the `root` user.\n- So `400` means that only the `root` user can read the file.\n- Then `runuser -u nobody -- sh` starts a shell as the `nobody` user.\n- However, if you run `cat flag.txt`, you get `Permission denied`, so you cannot read the flag.\n- So how can you read the flag?\n\n

\n\n

Beginner Hint 2 (AI-translated)

\n\n- This is a more meta hint, but why does `chal.sh` bother setting the permissions of `flag.txt` in the first place?\n- The permissions of `chal.sh` are specified in the `Dockerfile`.\n- In the same way, it should also be possible to set the permissions of `flag.txt` in the `Dockerfile`.\n- Think about what behavioral difference is created between setting permissions in the `Dockerfile` and setting them later in `chal.sh`.\n\n

\n","descriptionJa","cat: flag.txt: Permission denied\n\n

初心者向けヒント1

\n\n- `nc` で接続すると、シェルが起動することがわかります。\n- `chal.sh` を読むと、シェルが起動する前に `flag.txt` が作成されています。\n- その後、 `flag.txt` のパーミッションが `400` に設定されます。\n- これらのコマンドを実行するのは `root` ユーザーです。\n- そのため、 `400` は `root` ユーザーのみ読み取りができることを意味します。\n- そして `runuser -u nobody -- sh` によって `nobody` ユーザーでシェルが起動します。\n- しかし、 `cat flag.txt` を実行しても `Permission denied` となり、フラグを読むことができません。\n- では、どうすればフラグを読み取れるでしょうか？\n\n

\n\n

初心者向けヒント2

\n\n- メタ的な視点ですが、そもそも、なぜわざわざ `chal.sh` の中で `flag.txt` のパーミッションを設定しているのでしょうか？\n- `chal.sh` のパーミッションは `Dockerfile` で指定されています。\n- 同じように、 `flag.txt` も `Dockerfile` 側でパーミッションを設定することは可能なはずです。\n- `Dockerfile` でパーミッションを指定したときと、`chal.sh` のようにパーミッションを指定するときで、どのような挙動の差が生まれるかを考えてみましょう。\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[158],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[150,151,152],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","hard","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","dailyProgramCanonicalForAction","previewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_137":138,"_119":120,"_139":140,"_141":142,"_143":144,"_145":146},"nextDailyCanonical","permission-denied-2","httpsProxyHostname","permission-denied.chal.alp4ca.com","program",{"_22":130,"_20":147,"_148":149},"scheduledDate",["D",1777388400000],"releaseAt",["D",1777388400000],"status","PUBLISHED","plannedTopic","File Permission","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":156,"_22":157},{"_20":154,"_22":155},{"_20":146,"_22":153},"file-permission","Linux","linux","Race Condition","race-condition",{"_20":159,"_48":160},"minaminao","8923101afaa06c6be81216763685dbd0cac8ff24fbd6646250f67608d4924b02","instances",[],"canSpawn",{"_165":166,"_40":167},"fileName","permission-denied.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/7976a934-1650-4feb-b56f-f191e997f352/permission-denied.tar.gz",{"_20":169,"_22":170},"Misc","misc","Tag: File Permission","https://alpacahack.com/tags/file-permission","isLoggedIn","tag",{"_20":146,"_22":153,"_100":176,"_102":177,"_106":178,"_179":180,"_181":182,"_183":184},"","File Permission は、ファイルやディレクトリに対する読み取り、書き込み、実行などの権限設定です。\n\nCTF では、権限の設定ミス、所有者やグループ、実行ビットの扱いを利用する問題で扱われます。\n",[218],"updatedAt",["D",1781696353287],"challenges",[186,187,188],"relatedTags",[185],{"_20":154,"_22":155},{"_20":208,"_22":208,"_88":209,"_112":210,"_106":211,"_94":212,"_108":-7},{"_20":21,"_22":23,"_88":89,"_112":200,"_106":201,"_94":202,"_108":-7},{"_20":189,"_22":134,"_88":89,"_112":190,"_106":191,"_94":192,"_108":-7},"permission denied 2",[195,196,197],[194],[193],{"_20":169,"_22":170},{"_20":159,"_48":160},{"_20":198,"_22":199},{"_20":146,"_22":153},{"_20":154,"_22":155},"Local Privilege Escalation","local-privilege-escalation",[205,206,207],[204],[203],{"_20":169,"_22":170},{"_20":159,"_48":160},{"_20":156,"_22":157},{"_20":154,"_22":155},{"_20":146,"_22":153},"chmod-swapper",84,[217],[214],[213],{"_20":169,"_22":170},{"_20":215,"_48":216},"shiragi","c22e446c8c70b52ed5707e9939f191b7d2ee4d10fba60300b54ea68099cea638",{"_20":146,"_22":153},{"_20":219,"_48":-5},"alpakun","user","timeZoneAbbr","clientConfig",{"_225":226,"_227":125,"_228":229,"_230":229,"_231":232,"_233":234,"_235":16,"_236":176},"cspNonce","firebaseOptions",{"_237":238,"_239":240,"_241":242,"_243":244,"_245":246,"_247":232},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]