Over the Wire - Leviathan 1

Leviathan 1


Objective

Solution

ok

so lets see whats in the home direcotry

leviathan1@leviathan:~$ lscheckleviathan1@leviathan:~$ file ./check./check: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=c735f6f3a3a94adcad8407cc0fda40496fd765dd, not stripped

ok so there is a binary there lets see what it does..

leviathan1@leviathan:~$ ./checkpassword: jjjWrong password, Good Bye ...

It's checking for a password  I assume if given the correct password it will give us the password to the next level
I orignally solved this a much different way looking a the text contained in the binary file but then found out about ltrace which make this much simplier

leviathan1@leviathan:~$ ltrace ./check__libc_start_main(0x804853b, 1, 0xffffd784, 0x8048610 <unfinished ...>printf("password: ")                              = 10getchar(1, 0, 0x65766f6c, 0x646f6700password: jfjfj)             = 106getchar(1, 0, 0x65766f6c, 0x646f6700)             = 102getchar(1, 0, 0x65766f6c, 0x646f6700)             = 106strcmp("jfj", "sex")                              = -1puts("Wrong password, Good Bye ..."Wrong password, Good Bye ...)              = 29+++ exited (status 0) +++

highlighted it where the binary compares what I typed in to the word jfj and gives out the wrong password message lets try it gain with the word sex

leviathan1@leviathan:~$ ltrace ./check

__libc_start_main(0x804853b, 1, 0xffffd784, 0x8048610 <unfinished ...>printf("password: ")                              = 10getchar(1, 0, 0x65766f6c, 0x646f6700password: sex)             = 115getchar(1, 0, 0x65766f6c, 0x646f6700)             = 101getchar(1, 0, 0x65766f6c, 0x646f6700)             = 120strcmp("sex", "sex")                              = 0geteuid()                                         = 12001geteuid()                                         = 12001setreuid(12001, 12001)                            = 0system("/bin/sh"$ 

$ 
Bingo a new shell lets see who it is

$ whoamileviathan2

let's read the password file for level2 from this user account since they should have access

$ cat /etc/leviathan_pass/leviathan2ougahZi8Ta