I'm setting up beginner CTF (Capture the flag) in a Linux environment. I will have questions that will tell the user to run specific commands.
The issue I'm having is restricting the user to a directory and only being able to run certain commands.
For example Players need to change the directory and then use "ls" to find the flag and complete the challenge.
But I don't want a player to see other directories in the server or people able to cd where there not supposed to go.
Any help would be much appreciated.
2 Answers
Investigate the possibility to use a restricted shell for the users. Together with modifying PATH to specify a directory wich contains only commands that you allow your users to run (you may create such a directory and just put symlinks or hardlinks to the original commands there) it may give you what you need.
I have 2 possible solutions:
- Give the ctf's user permissions only to their home directory, you will need a different user for every challenge. every time they will try to cd out of the directory they will be denied.
I found a different post that suggests using the adduser command:
adduser --home/restricted/directory restricted_user- Use docker and run each level in a different environment.
hope this helps!
2
