- Use ln command<\/li>
- Environment Variables<\/li>
- Other basic Unix commands<\/li><\/ul>\n\n\n\n
Level01<\/strong><\/h2>\n\n\n\n
If we analyze the code of level01 program, one of the first things that I notice is the use of a C function, system, and although it doesn\u2019t<\/em> receive input from the user, it\u2019s still exploitable. Time to run the flag01 program.<\/p>\n\n\n
\n![\"Flag01\"](\"wp-content\/uploads\/2018\/05\/flag01_run.png\")
<\/figure>\n<\/div>\n\n\nThis output is (obviously) caused by the system function, more specifically by the \u201cecho and now what?\u201d<\/em>. But how about the \u201c\/usr\/bin\/env\u201d? Imagine that you have multiple programs in your system called echo<\/em>. Which one will be executed? The answer is the first one that appears in the PATH variable. This is ensured by the \u201c\/usr\/bin\/env\u201d.<\/p>\n\n\n\n
To find out where the echo<\/em> is located, run the command \u201cwhich echo\u201d.<\/p>\n\n\n
\n![\"which\"](\"wp-content\/uploads\/2018\/05\/which.png\")
<\/figure>\n<\/div>\n\n\nThen, cross-reference the path resultant with the paths in the PATH variable.<\/p>\n\n\n
\n![\"path\"](\"wp-content\/uploads\/2018\/05\/path.png\")
<\/figure>\n<\/div>\n\n\nNotice the folder that contains the echo program, it\u2019s almost the last one. If we were able to put an echo program in some other folder that appears before \/bin, that would be the one that would run. But we don\u2019t have write permissions on any of those\u2026<\/p>\n\n\n\n
So the solution is to append to the beginning, a location where we actually can write, \/home\/level01.<\/p>\n\n\n
\n![\"printenv\"](\"wp-content\/uploads\/2018\/05\/printenv.png\")
<\/figure>\n<\/div>\n\n\nNow, my goal is to get a shell, so I\u2019ll create a little C program called echo.<\/p>\n\n\n
\n![\"echo.c\"](\"wp-content\/uploads\/2018\/05\/echo.png\")
<\/figure>\n<\/div>\n\n\nI compile the program using the command \u201cgcc -o echo echo.c\u201d and now I have a little program that gives me a shell.<\/p>\n\n\n\n
Before I run the flag01 let\u2019s recap. We have a program called flag01 that will call the first echo program it finds in the environment variable PATH. The first entry in this variable is \/home\/level01, inserted by us, and this folder contains an echo program written also by us, which will give us a shell.<\/p>\n\n\n\n
Let\u2019s check the current user, run the program and get the flag.<\/p>\n\n\n
\n![\"Solution](\"wp-content\/uploads\/2018\/05\/solution.png\")
<\/figure>\n<\/div>\n\n\nAnother solution, and if you didn\u2019t want a shell, would be with symbolic links. Once more, we can add \/home\/level01 to the PATH and in this folder, place a symbolic link called echo which points to \/bin\/getflag. So, when you run the flag01 program, the following happens\u2026<\/p>\n\n\n
\n![\"Another](\"wp-content\/uploads\/2018\/05\/another_solution.png\")
<\/figure>\n<\/div>\n\n\nChallenges completed: 2\/20<\/p>\n\n\n\n
Mitigation<\/strong><\/h2>\n\n\n\n
Same advice as level00<\/a>.<\/p>\n\n\n\n
Walkthrough<\/strong><\/h2>\n\n\n\n
https:\/\/youtube.com\/watch?v=hxjN-xASoaw%3Fstart%3D54%26feature%3Doembed<\/p>\n\n\n\n
<\/h2>\n\n\n\n
Further Reading<\/strong><\/p>\n\n\n\n
- UNIX: Set Environment Variable<\/a><\/li>
- Understanding Symbolic Links<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"
Still under the SUID programs category, level01 makes use of another trick in order to be solved, the manipulation of environment variables. What you\u2019ll need…<\/p>\n
- Understanding Symbolic Links<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"
- UNIX: Set Environment Variable<\/a><\/li>