rparodi/snow-crash
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(maiboyer/levels): adding maiboyer levels (without all issues)

Browse source
This commit is contained in:
Raphael 2026-01-28 03:49:41 +01:00
parent e674ffcf4a
commit db7f1343c5
No known key found for this signature in database
48 changed files with 1864 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

105
snowcrash/level09/README.md Normal file
View file

@ -0,0 +1,105 @@
# Level 09
## how to login
username: level09
password: 25749xKZ8L7DkSCwJkT9dyv6f
## Goal
run `getflag` as user `flag09`
## Actually doing something
```bash
level09@SnowCrash:~$ ll
total 24
dr-x------ 1 level09 level09 140 Mar 5 2016 ./
d--x--x--x 1 root users 340 Aug 30 2015 ../
-r-x------ 1 level09 level09 220 Apr 3 2012 .bash_logout*
-r-x------ 1 level09 level09 3518 Aug 30 2015 .bashrc*
-rwsr-sr-x 1 flag09 level09 7640 Mar 5 2016 level09*
-r-x------ 1 level09 level09 675 Apr 3 2012 .profile*
----r--r-- 1 flag09 level09 26 Mar 5 2016 token
```
seems we need to do the same as last level
lets have fun hehe
```bash
level09@SnowCrash:~$ ./level09
You need to provied only one arg.
level09@SnowCrash:~$ ./level09 AAA
ABC
level09@SnowCrash:~$ ./level09 AAAAAAAAA
ABCDEFGHI
```
What happens if I give it a REALLY LONG argument ?
```bash
level09@SnowCrash:~$ ./level09 $(python -c "print('A' * 1000)")
ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~<7E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~<7E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~<7E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~<7E><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
```
Alright lets open this bad boy under Ghidra
Woops after reading the code, it seems that it specifically tells you to not reverse it.
Looking a the files a bit closer, we can actually read the token file...
```bash
level09@SnowCrash:~$ ll token
----r--r-- 1 flag09 level09 26 Mar 5 2016 token
level09@SnowCrash:~$ cat token
f4kmm6p|=pnDBDu{
```
trying to directly use this as the password doesnt work, but when looking at the output of the binary, it seems that the does weird stuff to the input, lets try to run it through.
```bash
level09@SnowCrash:~$ ./level09 `cat token`
f5mpq;vE{{TSW
level09@SnowCrash:~$ su -c getflag flag09
Password:
su: Authentication failure
```
Doesnt work.
Then lets try to reverse the effect of the binary ?
It looks like it does something like this:
> for every character in input
> output (character+idx) % 255
let do a script that does:
> for every character in input
> output (character-idx) % 255
we run it and we get
```bash
❯ ./levels/09/script.py <files/token
f3iji1ju5yuevaus41q1afiuq
```
lets try this one
```bash
level09@SnowCrash:~$ su -c getflag flag09
Password:
Check flag.Here is your token : s5cAJpM8ev6XHw998pRWG728z
```
Perfect !