4 ms·
It's fun to feel like a nefarious hacker. I'm at level2, see you at level 6 guys!
by jetsnoc 15y ago
It's fun to feel like a nefarious hacker. I'm at level2, see you at level 6 guys!
- farnsworth 15y agoAny tips? I want to actually learn from this - I'm not just looking for the answers. But I've read wikipedia on setuid, googled around a bit, and am still not sure what to do.
- lftl 15y agoMy hint for level01 would be to look at the system line, and think about how it is executed.
- CZ-18 15y agoEDIT: doh, didn't know we had write access to /tmp, that makes it easy
- farnsworth 15y agoWhen you first connect, you are in a /tmp/tmp.something directory which you can edit.
- pvsnp 15y agoYou can also do cd $(mktemp -d) and get a new one if you need another one.
- sim0n 15y agoRemember that you have write access to /tmp(/date) ;)
- dmuino 15y agoYou can write to /tmp. But since most people are also doing that, /tmp/date gets overriden frequently. I'd recommend mkdir /tmp/CZ-18; PATH=/tmp/CZ-18:$PATH; And then you can figure it out :)
- aw3c2 15y agoI now feel like the most awesome tutorial following script kiddie ever.
- jpablo 15y agoThe setuid flags allows you to run a binary as someone else. Since processes inherit the credentials they have when they run another program, if you find a bug[1] in a setuid program that let's you run another program of your choosing you can gain the credentials of the setuid user. [1] Buffer over flow, calling exec/system without proper escaping, creating predictable temp files, etc, etc.
- jetsnoc 15y agoStuck at level3 for a minute
- jc4p 15y agoSame, the only thing I can think of is doing something with the pointers in the fns variable in main, but I can't quite figure out what to do.
- gue5t 15y agoI've been playing with nm, but without a hex editor I feel crippled :/
- dmuino 15y agogdb works fine. (gdb) x/4x fns 0xffeaa0cc: 0x080485e4 0x08048640 0x0804869c 0x08048719 (gdb) x run 0x804875b <run>: 0x83e58955 (gdb) gdb) x/40x (void*)fns-0x40 etc.
- jetsnoc 15y agoWell, I got my math right to tweak the index I think and now the system is unavailable. Blasted!
- unixpickle 15y agoYou could also use objdump -d to decompile the binary.
- lukegb 15y agoNeither can I... ):
- joe_bleau 15y agoYeah, I'm stuck on level 3 as well. I see the printf() bug in capitalize(), but I don't think it's any help. I don't see anything obviously wrong in truncate_and_copy() (the strncpy() call and friends look right). run() is the juicy target, and I know where it's at in memory. There's the obvious comparison bug in main(), and I can use that to call a function pointer other than in the array, but I can't seem to locate a pointer to run(). I thought there might be a way to overflow atoi(), but that doesn't seem useful either. Several posters have hinted at buffer overflow, but I'm not yet seeing a buffer that I can overflow. [edit: Nevermind, I got it. Whew.]