Ahmad Mahfouz

Category: tech

• By Ahmad
• Posted on December 1, 2014
• Posted in Security, tech

SMASH THE STACK LEVEL2

time to play

level2@io:/levels$ ./level02 source code is available in level02.c

1 2	level2@io:/levels$ ./level02 source code is available in level02.c

let’s read what it says

level2@io:/levels$ cat level02.c //a little fun brought to you by bla #include <stdio.h> #include <stdlib.h> #include <signal.h> #include <setjmp.h> void catcher(int a) { setresuid(geteuid(),geteuid(),geteuid()); printf("WIN!\n"); system("/bin/sh"); exit(0); } int main(int argc, char **argv) { puts("source code is available in level02.c\n"); if (argc != 3 || !atoi(argv[2])) return 1; signal(SIGFPE, catcher); return abs(atoi(argv[1])) / atoi(argv[2]); } level2@io:/levels$

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

level2@io:/levels$ cat level02.c //a little fun brought to you by bla   #include <stdio.h> #include <stdlib.h> #include <signal.h> #include <setjmp.h>   void catcher(int a) {         setresuid(geteuid(),geteuid(),geteuid()); printf("WIN!\n");         system("/bin/sh");         exit(0); }   int main(int argc, char **argv) { puts("source code is available in level02.c\n");           if (argc != 3 || !atoi(argv[2]))                 return 1;         signal(SIGFPE, catcher);         return abs(atoi(argv[1])) / atoi(argv[2]); }   level2@io:/levels$

first function catcher  and it trigger the suid  and drop the bash nice  this is what we want

• By Ahmad
• Posted on December 1, 2014
• Posted in Security, tech

SMASH THE STACK Level1

after login to the ssh server levels located on /levels so let’s play  level1

level2@io:/levels$ ls -alh level01 -r-sr-x--- 1 level2 level1 1.2K Jan 13 2014 level01

1 2	level2@io:/levels$ ls -alh level01 -r-sr-x--- 1 level2 level1 1.2K Jan 13  2014 level01

as u notice it had suid permeation  -r-sr-x— for level2  so it will lead us to a user (level2 )

level1@io:/levels$ ./level01 Enter the 3 digit passcode to enter: 838

1 2	level1@io:/levels$ ./level01 Enter the 3 digit passcode to enter: 838

I entered any test number and it leads me with no respond 😀 crazy huh! so I decided to look

Read More