Is /home/level02/.password empty?
Hack your way through Stripe's Capture the Flag
41–50 of 219 posts
Re: Hack your way through Stripe's Capture the Flag
#42Is /home/level02/.password empty?
It includes the password for the level02 account.
Re: Hack your way through Stripe's Capture the Flag
#43What am I doing wrong: Current time: cat: /home/level02/.password: Permission denied Does someone has a tip?
The whole point is that you're supposed to find vulnerabilities in what you have access to and exploit them to view contents of things you don't have permission to.
Re: Hack your way through Stripe's Capture the Flag
#44Earlier quoted context omitted.
Same, the only thing I can think of is doing something with the pointers in the fns variable in main, but I can't quite figure out what to do.
I've been playing with nm, but without a hex editor I feel crippled :/
gdb works fine.
(gdb) x/4x fns (gdb) x run (gdb) gdb) x/40x (void*)fns-0x40
Re: Hack your way through Stripe's Capture the Flag
#45What am I doing wrong: Current time: cat: /home/level02/.password: Permission denied Does someone has a tip?
The whole point is that you're supposed to find vulnerabilities in what you have access to and exploit them to view contents of things you don't have permission to.
I replaced the date with my own script, but it still gets executed as level01 user
Re: Hack your way through Stripe's Capture the Flag
#46Bonus to anyone who gets the answer by intercepting another solver's email message.
I just hope this machine is isolated from Stripe's network, in case someone makes it to secret level 99.
Re: Hack your way through Stripe's Capture the Flag
#47Earlier quoted context omitted.
The whole point is that you're supposed to find vulnerabilities in what you have access to and exploit them to view contents of things you don't have permission to.
I replaced the date with my own script, but it still gets executed as level01 user
Hint: not all shells blindly run scripts as the setuid user.
Re: Hack your way through Stripe's Capture the Flag
#48Re: Hack your way through Stripe's Capture the Flag
#49Bonus to anyone who gets the answer by intercepting another solver's email message.
I just hope this machine is isolated from Stripe's network, in case someone makes it to secret level 99.
Yep, it's completely isolated. Someone rooting the machine is very much within our threat model :).
Re: Hack your way through Stripe's Capture the Flag
#50Earlier quoted context omitted.
EDIT: doh, didn't know we had write access to /tmp, that makes it easy
You can write to /tmp. But since most people are also doing that, /tmp/date gets overriden frequently. I'd recommend mkdir /tmp/CZ-18; PATH=/tmp/CZ-18:$PATH; And then you can figure it out :)
I now feel like the most awesome tutorial following script kiddie ever.