181–190 of 219 posts
Earlier quoted context omitted.
I'd love to see how people solved #2, and if they used any special tools like I did or if there's an easier way to do it. And I can't wait to delve deeper into #3 tomorrow :)
I used a Firefox add-on that lets you [mumble mumble]. I found at least two add-ons that looked like they would work when I googled it.
The asshole who fork bombed it is boasting on Reddit: http://www.reddit.com/r/programming/comments/q1qii/want_to_t... Anyone else not at all surprised who it is?
It is 5am - time for bed =)
Earlier quoted context omitted.
Yeah, same here. :( Part of me wonders whether someone with access to level06 went mucking around in the /tmp/level05 folder (which is itself 770 root.level06, so a level06 user can probably chmod 000 the queue folders) to keep other people from being able to get past that point.
I actually just found a way to kill the worker process remotely (on my localhost). Perhaps they don't have it hooked up to supervisord for autorestart. It's almost trivial to run sys.exit() on that worker. That being said, your tmp folder permissions theory is much more interesting though and that would be a brilliant way keep everyone else from catching up. :)
Once they've run this for a while, I'd love to see a post and screencast on some of the techniques needed to solve it. I don't know much about this subject, and I'd enjoy having a chance to learn in a setting unlikely to get me arrested.
I'd love to see how people solved #2, and if they used any special tools like I did or if there's an easier way to do it. And I can't wait to delve deeper into #3 tomorrow :)
From there you basically only need curl.
curl --user user:pw --digest does digest authentication.
curl --verbose will show what headers are being sent down from the server.
curl --headers 'Cookie: blah' will send a header back.
So no special tools required.
Any subtle--no spoiler--hints for level03? I got the mem address for run() but can't seem to find the correct index for it.
You will likely encounter stack randomization but there is a way to do it without worrying about that.
Earlier quoted context omitted.
I'd love to see how people solved #2, and if they used any special tools like I did or if there's an easier way to do it. And I can't wait to delve deeper into #3 tomorrow :)
FWIW I looked at the source and recognized the exploit. From there you basically only need curl. curl --user user:pw --digest does digest authentication. curl --verbose will show what headers are being sent down from the server. curl --headers 'Cookie: blah' will send a header back. So no special tools required.
Once I figured out what to do, it was only a matter of finding the right tool to do it. I didn't realize curl could [edit: --redacted--] (cool!), but I used OWASP ZAP and did a [edit: --redacted--]. Same method, different tool. Btw, thank you for explaining the curl options, I normally don't use curl much, but apparently I should :)
EDIT: Redacted stuff so as not to ruin the fun for others
Read this if you're stuck on level 3: http://destroy.net/machines/security/P49-14-Aleph-One
gcc -S -o example1.s example1.c
However, example1.s looks very different on Mac than on Linux, in particular, on Mac the parameters are pushed in reverse order:
Leh_func_begin2: ...
movl $1, %eax
movl $2, %ecx
movl $3, %edx
movl %eax, %edi
movl %ecx, %esi
callq _function
movl $3, %edx
movl $2, %esi
movl $1, %edi
call function
Earlier quoted context omitted.
I'd love to see how people solved #2, and if they used any special tools like I did or if there's an easier way to do it. And I can't wait to delve deeper into #3 tomorrow :)
Tool used: One line of javascript, entered in location bar. (Seems Chrome resource inspector doesn't allow the edit I needed.)