WeChall->Challenges->Challenge: Training: Warchall - 7 Tropical Fruits

Help with setuid Go to the Training: Warchall - 7 Tropical Fruits challenge

Anyone Else having Weird issues with GDB?Incorrect permissions?

pedroysb

Global Rank: 112

Totalscore: 168196

Posts: 14

Thanks: 10

UpVotes: 9

Registered: 11y 38d

The User is Offline

Help with setuid
Feb 29, 2016 - 04:27:09 (10y 246d) Google/translate0Thank You!1Good Post!0Bad Post! link

Hi,

I think I did the buffer overflow correctly and I am already getting the shell. However, I am getting a shell of my own user and without permission to read solution.txt. What am I doing wrong?

Thank in advance.

dloser

Global Rank: 2

Totalscore: 747640

Posts: 441

Thanks: 501

UpVotes: 478

Registered: 17y 97d

The User is Offline

RE: Help with setuid
Feb 29, 2016 - 14:35:02 (10y 246d) Google/translate0Thank You!0Good Post!0Bad Post! link

What you are doing wrong is not knowing something about how (ba)sh handles its invocation. Perhaps try the manual. Smile

There are several ways around this, with and without knowing.

pedroysb

Global Rank: 112

Totalscore: 168196

Posts: 14

Thanks: 10

UpVotes: 9

Registered: 11y 38d

The User is Offline

RE: Help with setuid
Feb 29, 2016 - 16:33:18 (10y 245d) Google/translate0Thank You!0Good Post!0Bad Post! link

Solved using another payload. I sill didn't understand why shell is not working.

dloser

Global Rank: 2

Totalscore: 747640

Posts: 441

Thanks: 501

UpVotes: 478

Registered: 17y 97d

The User is Offline

RE: Help with setuid
Feb 29, 2016 - 16:59:43 (10y 245d) Google/translate1Thank You!1Good Post!0Bad Post! link

See the solution board.

Redknee, ckclark, silenttrack, n0tHappy, nonfungiblesecurity, quangntenemy, TheHiveMind, Z, balicocat, Ge0, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89, braddie0, fpombal, csuquvq have subscribed to this thread and receive emails on new posts.
1 people are watching the thread at the moment.
This thread has been viewed 6920 times.

PHP Fatal Error(1): Constant E_STRICT is deprecated since 8.4, the error level was removed in www/protected/config.php line 6

Backtrace starts in [unknown file] line ?. GWF_Debug::shutdown_function() core/inc/util/GWF_Debug.php line 109. GWF_Debug::error_handler().... core/inc/util/GWF_Debug.php line 180.