rparodi/snow-crash
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs(lvl10): adding the english readme

Browse source
This commit is contained in:
Raphael 2026-01-29 12:54:01 +01:00
parent 11be7b4919
commit b8eac83370
No known key found for this signature in database
1 changed files with 9 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

18
rparodi/level10/README.md
View file

@ -1,4 +1,4 @@
Lors de mon arriver sur le level10 je remarque 2 fichier dans mon home Then arriving on level10 I notice 2 files in my home.
```bash ```bash
ls -l ls -l
@ -7,14 +7,14 @@ total 16
-rw------- 1 flag10 flag10 26 Mar 5 2016 token -rw------- 1 flag10 flag10 26 Mar 5 2016 token
``` ```
level10 est un executable qui prends 2 arguments level10 is an executable which takes 2 arguments.
```bash ```bash
./level10 ./level10
./level10 file host ./level10 file host
sends file to host if you have access to it sends file to host if you have access to it
``` ```
Bien sur token n'est pas lisible par le programme Of course token is not readable by the program.
```c ```c
ltrace ./level10 ./token ltrace ./level10 ./token
__libc_start_main(0x80486d4, 2, 0xbffff7e4, 0x8048970, 0x80489e0 <unfinished ...> __libc_start_main(0x80486d4, 2, 0xbffff7e4, 0x8048970, 0x80489e0 <unfinished ...>
@ -25,7 +25,7 @@ exit(1 <unfinished ...>
+++ exited (status 1) +++ +++ exited (status 1) +++
``` ```
Je tente de faire un autre fichier /tmp/test et de lancer le programme avec I try to make another file /tmp/test and to launch the program with it.
```bash ```bash
echo 'test' > /tmp/test echo 'test' > /tmp/test
@ -50,7 +50,7 @@ puts("wrote file!"wrote file!
+++ exited (status 12) +++ +++ exited (status 12) +++
``` ```
Il essaye donc l'envoyer un fichier sur le 6969, effectivement lors de la l'ecoute du port avec netcat It therefore tries to send a file on port 6969. Indeed while listening on the port with netcat:
```bash ```bash
nc -lv 6969 nc -lv 6969
Connection from 127.0.0.1 port 6969 [tcp/*] accepted Connection from 127.0.0.1 port 6969 [tcp/*] accepted
@ -58,13 +58,13 @@ Connection from 127.0.0.1 port 6969 [tcp/*] accepted
test test
``` ```
Le programme semble s'arreter a access lorsque il n'est pas possible de lire le fichier The program seems to stop at access when it is not possible to read the file.
Mais access est vulnerable a TOUCTOU (Time-Of-Check to Time-Of-Use) But access is vulnerable to TOCTOU (Time-Of-Check to Time-Of-Use).
Je vais donc faire un script en bash pour effectuer l'exploit I therefore make a bash script to perform the exploit.
```bash ```bash
Connection from 127.0.0.1 port 6969 [tcp/*] accepted Connection from 127.0.0.1 port 6969 [tcp/*] accepted
.*( )*. .*( )*.
woupa2yuojeeaaed06riuj63c woupa2yuojeeaaed06riuj63c
``` ```
au bout de 30s le flag tombe After 30 seconds the flag drops.