More recently at SpamAndFlags CTF there was a similar challenge, where an innocent looking shell script was to be exploited multiple times, each time by a different environment variable. There is a nice writeup at https://github.com/p4-team/ctf/tree/master/2020-05-10-spam-a...
Re:Hacking with environment variables
by pentestercrab on Tuesday July 14, 2020 @01:58AM
(#23828991)
Sounds very interesting, thanks for sharing. Do you have any more information or perhaps a URL to a write-up for this? Or do you remember the challenge name?
Why would you change "every cli Debian package" to setuid and not expect hundreds of exploits? Solution is not to do something so silly.
Because in the real world, you might have a vulnerability that lets you run one of those packages as root. The competition is to show how many of those you could exploit.
Of course some of them are trivial, you don't get any props for showing arbitrary file reading when you can run bash or perl as root. But exploiting readline that way is pretty interesting!
There are some very interesting ways to load shared objects or read files with environment variables, and we even found ways to leverage common libraries like readline and gconv to pop apps that used them.