level00: done
level01: done
This commit is contained in:
1
level00/ressources/exploit
Normal file
1
level00/ressources/exploit
Normal file
@ -0,0 +1 @@
|
||||
(echo 5276; cat) | ./level00
|
20
level00/source.c
Normal file
20
level00/source.c
Normal file
@ -0,0 +1,20 @@
|
||||
#include <stdio.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
int main(void)
|
||||
{
|
||||
int buf[4];
|
||||
|
||||
puts("***********************************");
|
||||
puts("* \t -Level00 -\t\t *");
|
||||
puts("***********************************");
|
||||
printf("Password:");
|
||||
scanf("%d", buf);
|
||||
if (buf[0] != 5276) {
|
||||
puts("\nInvalid Password!");
|
||||
} else {
|
||||
puts("\nAuthenticated!");
|
||||
system("/bin/sh");
|
||||
}
|
||||
return buf[0] != 5276;
|
||||
}
|
8
level00/walkthrough
Normal file
8
level00/walkthrough
Normal file
@ -0,0 +1,8 @@
|
||||
# Level00
|
||||
|
||||
Using ghidra, we can decompile the code and see that it calls `scanf()` on an int buffer.
|
||||
It will then compare its value to 5276 and opens a shell if the value matches.
|
||||
All we have to do is input that value.
|
||||
|
||||
Here is the command:
|
||||
`(echo 5276; cat) | ./level00`
|
Reference in New Issue
Block a user