JAILE

[★★☆] JAILE - Calculator

Description

You have found an exposed calculator program. It doesn’t seem to do anything useful beyond simple arithmetic operations. The source code is also available on GitHub. Can you make this application more useful? Python version is 3.12.3

Service: exp.cybergame.sk:7002

Download: calc.pyarrow-up-right

Source

import socket
import os
import pty
import sys

def handle_client(conn):
    s_fd = conn.fileno()
    os.dup2(s_fd, 0)
    os.dup2(s_fd, 1)
    os.dup2(s_fd, 2)
    data = b""
    while True:
        chunk = conn.recv(4096)
        if not chunk:
            break
        data += chunk
        if b'\n' in data:
            break
    text = data.decode().strip()

    for keyword in ['eval', 'exec', 'import', 'open', 'os', 'read', 'system', 'write']:
        if keyword in text.lower():
            conn.sendall(b"Not allowed, killing\n")
            return

    # Check for forbidden characters.
    for character in ['\'', '\"']:
        if character in text.lower():
            conn.sendall(b"Not allowed, killing\n")
            return

    try:
        exec('print(' + text + ')')
    except Exception as e:
        conn.sendall(("Error: " + str(e) + "\n").encode())

def main():
    host = '0.0.0.0'
    port = 1337
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        s.bind((host, port))
        s.listen(1)
        print(f"Listening on {host}:{port}")
        conn, addr = s.accept()  # Handle one connection.
        with conn:
            print(f"Connection from {addr}")
            handle_client(conn)
    sys.exit(0)

if __name__ == "__main__":
    main()

Solution

We are given a python program which takes our input and passes it to exec('print(' + text + ')')

https://book.hacktricks.wiki/en/generic-methodologies-and-resources/python/bypass-python-sandboxes/index.htmlarrow-up-right

Initially I was thinking of exploiting __builtins__, but then realized that breakpoint is not blacklisted so......

circle-check

[★★☆] JAILE - User

Description

That is interesting functionality. We can see that a separate user was created to run the calculator, but maybe the root user has more secrets that can be uncovered.

Solution

Using the breakpoint like above upgrade the shell to bash since quoting is painful.

https://gtfobins.github.ioarrow-up-right doesn't have anything about netstat so probably not exploitable. env_keep+=LD_PRELOAD is definitely dangerous

https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#ld_preload--ld_library_patharrow-up-right

circle-check

[★★☆] JAILE - Final Escape

Description

You are root, but it seems you are inside a Docker container. Can you escape somehow once again?

Disclaimer: Was not able to solve it in time :(

Solution

Before we start, I used the following script to get back in the machine as root automatically.

circle-info

Note: Each connections spawns new container, nothing is same (AFAIK)

We are indeed inside a Container and have to escape somehow.

docker.sock exists, but not docker command.

It's possible to interact with the docker api using docker.sock over HTTP.

But the API is responding with Not Found message instead of Docker API responses.

We might not even be talking to Docker API at all... 🤔 uvicorn is a Python ASGI server, usually used to run FastAPI or Starlette apps.

There are some odd paths in mount,

I even tried getting deepcearrow-up-right on the box to enumerate further, but nothing promising.

I'll ignore it for the moment the capabilities

The vda* is suspicious and the findmnt command shows from volume name that it's in fact a fake socket :/

😢...

We are only allowed to inspect the containers, so there must be some hidden detail. Get all Container IDs and get details

/v1.48/containers/json and /v1.48/images/list IDs differ, inspecting containers API response returns details but not images.

Something about network is suspicious in this container.. We are inside 172.21.* subnet and can't connect to any other; essentially isolated from other containers.

Game was rigged from the start, the endpoint kept saying it was not required, yet it was the solution..

Credit: lukaskuzmiak: cybergame.sk-2025-writeups, JAILEarrow-up-right

circle-check

Last updated