LEVEL 0

Binary execution

The binary prints a header and prompts for a user input as password for continuing. After input it terminates when input validation failed/wrong password was entered.

level00@OverRide:~$ ./level00 
***********************************
* 	     -Level00 -		  *
***********************************
Password:1234

Invalid Password!
level00@OverRide:~$

Ghidra

bool main(void)

{
    int local_14 [4];
    
    puts("***********************************");
    puts("* \t     -Level00 -\t\t  *");
    puts("***********************************");
    printf("Password:");
    __isoc99_scanf(&DAT_08048636,local_14);
    if (local_14[0] != 0x149c) {
        puts("\nInvalid Password!");
    }
    else {
        puts("\nAuthenticated!");
        system("/bin/sh");
    }
    return local_14[0] != 0x149c;
}

Code analysis / Exploit

After decompiling the code with Ghidra and a first analysis we can see, that the user input is compared against the hard coded hex value 0x149c which equals 5276 in decimal numbers and on success opens a shell.

Executing the binary and entering the value leads to a shell with userright of level01. The .pass file content can be obtained with

cat /home/users/level01/.pass

and is

uSq2ehEGT6c9S24zbshexZQBXUGrncxn5sD5QfGL