Silent Snake [63 Solves]

$ tar ztf silent_snake.tar.gz
chall/
chall/silent_snake.py
chall/repl.py
chall/flag.txt
docker-compose.yml
Dockerfile

#!/usr/bin/env python3

import os
import random
import subprocess
import time

DEBUG = os.environ.get("DEBUG", "0") == "1"


def drop_to_unprivileged(uid: int, gid: int):
    # Drop to a unprivileged user and group.
    assert uid != 0 and gid != 0
    os.setresgid(uid, uid, uid)
    os.setresuid(gid, gid, gid)


def drop_to_ctf_uid_gid():
    drop_to_unprivileged(4242, 4242)


(r, w) = os.pipe()
os.set_inheritable(w, True)

print(r)
print(w)

repl = subprocess.Popen(
    ["./repl.py", str(w)], close_fds=False, preexec_fn=drop_to_ctf_uid_gid
)

os.close(w)
ppipe = os.fdopen(r, "r", buffering=1)

allowed = {
    "ls": True,
}


try:
    while repl.poll() == None:
        cmd = ppipe.readline()
        if cmd == "":
            break

        cmd = cmd.strip().split(" ")
        if DEBUG:
            print("RECEIVED COMMAND:", cmd)

        if cmd[0] == "exit":
            break
        elif cmd[0] == "ls" and allowed["ls"] and len(cmd) == 2:
            valid = True
            resolved = []
            path = cmd[1]

            if not path.startswith("-") and os.path.isdir(path):
                cmd = ["ls", "-l", path]
                if DEBUG:
                    print(cmd)

                subprocess.run(
                    cmd,
                    stderr=(subprocess.STDOUT if DEBUG else subprocess.DEVNULL),
                    preexec_fn=drop_to_ctf_uid_gid,
                )

            allowed["ls"] = False
except Exception as ex:
    if DEBUG:
        import traceback

        traceback.print_exc()

if DEBUG:
    print("Terminating REPL process...")

repl.kill()
repl.wait()

if DEBUG:
    print("REPL terminated - waiting...")

time.sleep(random.randrange(300, 600))

#!/usr/bin/env python3

import os
import sys
import code

DEBUG = os.environ.get("DEBUG", "0") == "1"

cpipe = os.fdopen(int(sys.argv[1]), "w", buffering=1)
devnull = open("/dev/null", mode="w")

print(
    """
Welcome to silent-snake, the blind REPL!

You've got a single ls that you can redeem using
`run_command('ls <directory_to_ls>')`

To exit the jail, use `exit()` or `run_command('exit')`

Have fun!
"""
)

if not DEBUG:
    sys.stdout.close()
    sys.stderr.close()
    os.close(1)
    os.close(2)
    sys.stdout = devnull
    sys.stderr = devnull

else:
    print(50 * "=")
    print(
        "WARNING: Debugging mode is *ON*. stdout and stderr are available here, but you won't be able to see the REPL's output during the challenge."
    )
    print(50 * "=")

    # Redirect stderr to stdout
    os.dup2(1, 2, inheritable=True)


def run_command(cmd: str):
    cpipe.write(cmd + "\n")


code.interact(local=locals())

run_command("exit")

print("debug")