Touch

Technical Walkthrough

Writeup

Challenge

• Name: Touch
• Category: Misc
• Difficulty: Easy
• Mode: remote

Summary

The remote service exposes a Bash shell as ctf. The intended weakness is a

SUID/SGID /bin/touch. Normal touch is not directly useful for reading files,

but with umask 000 it can create root-owned world-writable files. That allows

creating /etc/ld.so.preload, pointing it to a controlled shared object, and

triggering the preload through the SUID touch binary.

The shared object cleans up /etc/ld.so.preload, marks /bin/bash SUID-root,

and copies /root/flag.txt to a readable temp file. The raw flag is stored only

in loot/flag.txt.

Artifact Inventory

Remote-only challenge:

• Target: <TARGET>:30353
• No downloadable challenge artifact was provided.
• analysis/tcp-probes.txt records the shell prompt behavior.
• analysis/touch-binary-behavior.txt records the SUID touch primitive.
• analysis/preload-exploit-redacted.txt records the final exploit transcript

with the flag redacted.

Analysis

1. Connected to the TCP service and confirmed it exposes /bin/bash -i as user

ctf.

1. Enumerated filesystem metadata and found /home/ctf/touch -> /usr/bin/touch

and /bin/touch with mode 6755.

1. Confirmed SUID touch creates root-owned files.
2. Confirmed /root/flag.txt exists with touch -r /root/flag.txt /tmp/ref.
3. Used umask 000 and SUID touch to create a writable

/etc/ld.so.preload.

1. Uploaded a Linux x86_64 shared object and pointed /etc/ld.so.preload to it.
2. Triggered SUID touch; the shared object ran as root, copied the flag to

/tmp/touch_flag.txt, and removed /etc/ld.so.preload.

Solve

Run:

python3 solve/solve.py --host <TARGET> --port 30353

Then capture with:

scripts/challenge_harness.py capture-flag Misc/Touch --from loot/flag-candidate.txt

The solve script builds solve/preload_touch.so with Zig if needed, uploads it

over the shell, executes the preload chain, writes the raw flag candidate to

loot/flag-candidate.txt, and keeps the normal transcript redacted.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

• SUID binaries that seem low-impact can become powerful when they can create

privileged files with attacker-controlled permissions.

• umask matters: touch creates files using process permissions masked by the

current shell umask.

• Keep /etc/ld.so.preload cleanup inside the payload so a failed exploit does

not leave the target in a noisy state.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Touch
• Category: Misc
• Difficulty: Easy
• Mode: remote
• Remote instance: <TARGET>:30353
• Start time: 2026-06-09T13:22:40Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• Remote service drops to a ctf Bash shell.
• /bin/touch is SUID/SGID root (6755), and /home/ctf/touch links to it.
• With umask 000, SUID touch can create a root-owned but world-writable /etc/ld.so.preload.
• A Linux x86_64 shared object preloaded through that file runs as root when SUID touch is invoked.
• The payload removes /etc/ld.so.preload, marks /bin/bash SUID-root, and copies /root/flag.txt to /tmp/touch_flag.txt.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Misc
• Challenge: Touch
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Misc
• Challenge: Touch
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: Touch
• Category: Misc
• Difficulty: Easy
• Mode: remote
• Remote instance: <TARGET>:30353
• Start time: 2026-06-09T13:22:40Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• Remote service drops to a ctf Bash shell.
• /bin/touch is SUID/SGID root (6755), and /home/ctf/touch links to it.
• With umask 000, SUID touch can create a root-owned but world-writable /etc/ld.so.preload.
• A Linux x86_64 shared object preloaded through that file runs as root when SUID touch is invoked.
• The payload removes /etc/ld.so.preload, marks /bin/bash SUID-root, and copies /root/flag.txt to /tmp/touch_flag.txt.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.