3 ms·

Any tips? I want to actually learn from this - I'm not just looking for the answers. But I've read wikipedia on setuid, googled around a bit, and am still not s

• lftl 15y ago
  My hint for level01 would be to look at the system line, and think about how it is executed.
  • CZ-18 15y ago
    EDIT: doh, didn't know we had write access to /tmp, that makes it easy
    • farnsworth 15y ago
      When you first connect, you are in a /tmp/tmp.something directory which you can edit.
      • pvsnp 15y ago
        You can also do cd $(mktemp -d) and get a new one if you need another one.
    • sim0n 15y ago
      Remember that you have write access to /tmp(/date) ;)
    • dmuino 15y ago
      You can write to /tmp. But since most people are also doing that, /tmp/date gets overriden frequently. I'd recommend mkdir /tmp/CZ-18; PATH=/tmp/CZ-18:$PATH; And then you can figure it out :)
      • aw3c2 15y ago
        I now feel like the most awesome tutorial following script kiddie ever.
• jpablo 15y ago
  The setuid flags allows you to run a binary as someone else. Since processes inherit the credentials they have when they run another program, if you find a bug[1] in a setuid program that let's you run another program of your choosing you can gain the credentials of the setuid user. [1] Buffer over flow, calling exec/system without proper escaping, creating predictable temp files, etc, etc.