- C<\/li>
- Level 7 (So you can create your own SUID program)<\/li><\/ul>\n\n\n\n
Level11<\/strong><\/h2>\n\n\n\n
Before we go through this challenge, let me make an aside note. After facing some problems, I decided to google about this challenge, where I ended up finding that it has some problems. I read on various websites that the code<\/a> presented on the official webpage is not the one that originated the program present in \/home\/flag11. Therefore, I\u2019ve decided to upload the original code to the \/home\/flag11 and compile it, using the nebula account for this task.<\/p>\n\n\n\n
Having said that, let\u2019s move on.<\/p>\n\n\n\n
Level11 has, once more, a SUID program, flag11. Also, it has a system call with non sanitized arguments. Two nice ingredients to cook something\u2026<\/p>\n\n\n\n
So, you run the flag11 program and it\u2019ll wait for some kind of input, \u201cContent-Length: \u201c, that will be verified in the first two if clauses. After this, the program can follow two paths. The first one is the case of the number provided is between 1 and 1023. If you provide 1024 or some number above it will fall in the second clause. Negative numbers won\u2019t be accepted due to the while statement (and also due to mmap).<\/p>\n\n\n\n
The easiest way to get to the system call and exploit the program is by passing 1 as a length and then, as input, pass a random letter (except a, A, z and Z) or number. If you go through the function process, you\u2019ll notice that your character will end up being XORed with the length, 1. I\u2019ll go with \u201cl\u201d letter.<\/p>\n\n\n
\n![\"attempts\"](\"wp-content\/uploads\/2018\/06\/attempts.png\")
<\/figure>\n<\/div>\n\n\n
Now, when you execute the program, you\u2019ll see an \u201cm\u201d popping up. Within a few tries, you notice that the letter \u201cm\u201d appears all alone.
I\u2019ll use the old trick from challenge 7<\/a> and created my own SUID program. Can you see where I\u2019m going?<\/p>\n\n\n\nSo, after the letter \u201cl\u201d is encrypted<\/em>, process function will try to call the system function to execute \u201cm\u201d (\u201cl\u201d XORed). \u201cm\u201d command does not exist, so I\u2019ll create a symbolic link to my script wich will compile my SUID program.<\/p>\n\n\n\n
![\"Scripts\"](\"wp-content\/uploads\/2018\/06\/scripts-1.png\")
Scripts<\/figcaption><\/figure>\n\n\n\n ![\"Symbolic](\"wp-content\/uploads\/2018\/06\/link.png\")
Symbolic link<\/figcaption><\/figure>\n\n\n\n We also need to add the \/tmp folder to the environment variable PATH (export PATH=\/tmp\/:$PATH).<\/p>\n\n\n\n
After a few attempts, I get the \u201cm\u201d all alone and check the \/home\/flag11 directory I get the result of the following image.<\/p>\n\n\n
\n![\"suid\"](\"wp-content\/uploads\/2018\/06\/suid.png\")
<\/figure>\n<\/div>\n\n\nThen, it\u2019s just a matter of running the program and get the flag.<\/p>\n\n\n
\n![\"result](\"wp-content\/uploads\/2018\/06\/result_level11.png\")
<\/figure>\n<\/div>\n\n\nSolved. 8 more to go!<\/p>\n\n\n\n
Challenges completed: 12\/20<\/p>\n\n\n\n
Mitigation<\/strong><\/h2>\n\n\n\n
Same advices given for level09<\/a>, level07<\/a> and level00<\/a> apply.<\/p>\n\n\n\n
Walkthrough<\/strong><\/h2>\n\n\n\n