[ Docker ] Leviathan Wargame 만들기 - 3번 문제 ( 5 / 8 )

1. Leviathan3 목표

There is no information for this level, intentionally.

 

2. Leviathan3 구현

# 비밀번호 root 입력 접속
ssh -oStrictHostKeyChecking=no root@localhost -p 2223

chown -R root:root /home/leviathan3/.[!.]*

chmod 755 /home/leviathan3

# leviathan4 유저를 생성하여 준다.
useradd leviathan4 && echo -e "WG1egElCvO\nWG1egElCvO" | passwd leviathan4

cat <<'EOF' > /tmp/level3.c
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <stdlib.h>

int main(int argc, char *argv[]) 
{
    char password[256];

    const char *correct_password = "snlprintf\n";

    const char *dummy_password = "kakaka";

    if(strcmp("h0no33", dummy_password) == 0)
    {
        perror("error");
    }

    printf("Enter the password> ");

    fgets(password, sizeof(password), stdin);

    if(strcmp(password, correct_password) == 0) 
    {
        puts("[You've got shell]!");

        if (setreuid(geteuid(), geteuid()) != 0) 
        {
            perror("setreuid failed");
            return 1;
        }

        system("/bin/sh");
    } 
    else 
    {
        puts("bzzzzzzzzap. WRONG");
    }

    return 0;
}
EOF

gcc -o /home/leviathan3/level3 /tmp/level3.c

chown leviathan4:leviathan3 /home/leviathan3/level3

chmod 4550 /home/leviathan3/level3

# 다음 패스워드가 담긴 파일을 생성한다.
echo 'WG1egElCvO' > /etc/leviathan_pass/leviathan4

chown leviathan4:leviathan4 /etc/leviathan_pass/leviathan4

chmod 400 /etc/leviathan_pass/leviathan4

exit

3. Leviathan3 문제풀의

# 비밀번호 : f0n8h2iWLP
ssh leviathan3@localhost -p 2223

# 호출 라이브러리 확인
echo | ltrace /home/leviathan3/level3

# 비밀번호 : snlprintf
/home/leviathan3/level3

# 다음 문제 비밀번호를 확인
# WG1egElCvO
cat /etc/leviathan_pass/leviathan4