snow-crash/level13

Lors de l'arriver sur le level13 je remarque le fichier level13

ls -l level13
-rwsr-sr-x 1 flag13 level13 7303 Aug 30  2015 level13

Et je remarque egallement que c'est du C

ltrace ./level13
__libc_start_main(0x804858c, 1, 0xbffff7f4, 0x80485f0, 0x8048660 <unfinished ...>
getuid()                                                                  = 2013
getuid()                                                                  = 2013
printf("UID %d started us but we we expe"..., 2013UID 2013 started us but we we expect 4242
)                       = 42
exit(1 <unfinished ...>
+++ exited (status 1) +++

en le lancant (plus proprement), il attente l'UID 4242

level13@SnowCrash:~$ ./level13
UID 2013 started us but we we expect 4242

Voici le code de la fonction main

0804858c <main>:
 804858c:	55                   	push   ebp
 804858d:	89 e5                	mov    ebp,esp
 804858f:	83 e4 f0             	and    esp,0xfffffff0
 8048592:	83 ec 10             	sub    esp,0x10
 8048595:	e8 e6 fd ff ff       	call   8048380 <getuid@plt>
 804859a:	3d 92 10 00 00       	cmp    eax,0x1092
 804859f:	74 2a                	je     80485cb <main+0x3f>
 80485a1:	e8 da fd ff ff       	call   8048380 <getuid@plt>
 80485a6:	ba c8 86 04 08       	mov    edx,0x80486c8
 80485ab:	c7 44 24 08 92 10 00 	mov    DWORD PTR [esp+0x8],0x1092
 80485b2:	00
 80485b3:	89 44 24 04          	mov    DWORD PTR [esp+0x4],eax
 80485b7:	89 14 24             	mov    DWORD PTR [esp],edx
 80485ba:	e8 a1 fd ff ff       	call   8048360 <printf@plt>
 80485bf:	c7 04 24 01 00 00 00 	mov    DWORD PTR [esp],0x1
 80485c6:	e8 d5 fd ff ff       	call   80483a0 <exit@plt>
 80485cb:	c7 04 24 ef 86 04 08 	mov    DWORD PTR [esp],0x80486ef
 80485d2:	e8 9d fe ff ff       	call   8048474 <ft_des>
 80485d7:	ba 09 87 04 08       	mov    edx,0x8048709
 80485dc:	89 44 24 04          	mov    DWORD PTR [esp+0x4],eax
 80485e0:	89 14 24             	mov    DWORD PTR [esp],edx
 80485e3:	e8 78 fd ff ff       	call   8048360 <printf@plt>
 80485e8:	c9                   	leave
 80485e9:	c3                   	ret
 80485ea:	90                   	nop
 80485eb:	90                   	nop
 80485ec:	90                   	nop
 80485ed:	90                   	nop
 80485ee:	90                   	nop
 80485ef:	90                   	nop

Notamment cette ligne (7) qui vas nous interesser

804859a:    cmp    eax,0x1092

0x1092 = 0d4242 il suffit de changer la valeur de notre uid lors de la comparaison (a l'aide de gdb)

(gdb) b main
Breakpoint 1 at 0x804858f
(gdb) b *0x804859a
Breakpoint 2 at 0x804859a
(gdb) r
Starting program: /home/user/level13/level13

Breakpoint 1, 0x0804858f in main ()
(gdb) s
Single stepping until exit from function main,
which has no line number information.

Breakpoint 2, 0x0804859a in main ()
(gdb) set $eax=0x1092
(gdb) c
Continuing.
your token is 2A31L79asukciNyi8uppkEuSx
[Inferior 1 (process 2288) exited with code 050]