iExploit

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Apply for Membership

Top Posters

Who's Online (0)

Powered by Vanilla. Made with Bootstrap.
Looking to introduce yourself? Look no further, and click here! We also have IRC! [irc.evilzone.org #iexploit]
Overthewire vortex level 0
  • chroniccommand
    Posts: 1,389
    Alright I've been playing the wargames over at http://overthewire.org/
    Vortex is the first so I've been playing that. Let me tell you it's the hardest wargame I've ever played :p

    So far I've only been able to beat the first level using python. So heres the solution:

    import socket
    import struct

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    host = \"vortex.labs.overthewire.org\"
    port = 5842
    s.connect((host, port))

    int = 0

    for n in range(4):
        data = s.recv(4)
        int += struct.unpack(\"<I\", data)[0]

    s.send(struct.pack(\"<I\",(int & 0xFFFFFFFF)))
    print s.recv(1000)
    s.close()

    Run it and you should get the username and password for level 1

    Explanation:
    First we use a TCP socket to connect to the vortex level 0 port. Then we use a for loop to get the 4 bytes that we need to get. After that we use struct to interpret what we get as binary data. Then we use unpack to unpack the bytes we get using "<I". The < symbol means little-endian byte order. Then I means unsigned integer. After this is done we get the unpacked data we needed to get. But then we need to send it back to the host. So we re-pack it and send it. After that we print what we have received, which is the username and password.
  • Xin
    Posts: 3,251
    Nice what sources/reading did you do to find out this, not walkthroughs but things that explain insigned integers and reading them in hostbyte order
    Xin
  • chroniccommand
    Posts: 1,389
    said:


    Nice what sources/reading did you do to find out this, not walkthroughs but things that explain insigned integers and reading them in hostbyte order



    http://docs.python.org/library/struct.html

    I used http://axtaxt.wordpress.com/2010/11/14/ ... ex-level0/ but recoded it and added an explanation.
  • Xin
    Posts: 3,251
    Cheers chronic, your write its way harder than Io and others i've tried.
    Xin
  • Sh3llc0d3
    Posts: 1,910
    Thanks for this chronic, i'd seen the site before but completely forgot the URL, was looking for it lol. Putting my coding to the test thats for sure.
  • sangf
    Posts: 203
    haha, these are pretty good. i've been trying a few of the other level 0s~ completed semtex just now~ woot.

    [spoiler]

    #! /usr/bin/dmd -run
     
    /* * * * * * * * * * * * * * * * * * * * * * * 
     *                                           *
     * OverTheWire&#46;org &#58; Semtex level 0 solution *
     * File &#58; otw_semtex0&#46;d                      *
     *                                           *
     * * * * * * * * * * * * * * * * * * * * * * */

     import std&#46;socket;
     import std&#46;stdio;
     
     int main(string args&#91;&#93;)
     {
        // Note&#58; port 24000&#58;x86/elf, 24001&#58;amd64/elf, 24002&#58;ppc/mach-O
        auto sock = new TcpSocket(new InternetAddress(\"semtex&#46;labs&#46;overthewire&#46;org\", 24001));
        //sock&#46;connect();
        
        char&#91;&#93; file;
        char&#91;1024&#93; buf;
        int sock_result;
        while (true)
        {
             sock_result = sock&#46;receive(buf);
             if ((sock_result == sock&#46;ERROR) || (!sock_result)) break;
            file ~= buf&#91;0 &#46;&#46; sock_result&#93;;
        }
        sock&#46;shutdown(SocketShutdown&#46;BOTH);
        sock&#46;close();
        
        if (file&#46;length &lt; 2) return 0;
        auto out_file = File(\"lev0&#46;elf64\", \"wb\");
        for (uint i = 0; i &lt; file&#46;length; i += 2)
            out_file&#46;write(file&#91;i&#93;);
        out_file&#46;close();
        
        return 0;
     }


    output:
    http://i.imgur.com/MdUE5.jpg
    [/spoiler]
  • Sh3llc0d3
    Posts: 1,910
    said:


    haha, these are pretty good. i've been trying a few of the other level 0s~ completed semtex just now~ woot.

    [spoiler]


    #! /usr/bin/dmd -run
     
    /* * * * * * * * * * * * * * * * * * * * * * * 
     *                                           *
     * OverTheWire&#46;org &#58; Semtex level 0 solution *
     * File &#58; otw_semtex0&#46;d                      *
     *                                           *
     * * * * * * * * * * * * * * * * * * * * * * */

     import std&#46;socket;
     import std&#46;stdio;
     
     int main(string args&#91;&#93;)
     {
        // Note&#58; port 24000&#58;x86/elf, 24001&#58;amd64/elf, 24002&#58;ppc/mach-O
        auto sock = new TcpSocket(new InternetAddress(\"semtex&#46;labs&#46;overthewire&#46;org\", 24001));
        //sock&#46;connect();
        
        char&#91;&#93; file;
        char&#91;1024&#93; buf;
        int sock_result;
        while (true)
        {
             sock_result = sock&#46;receive(buf);
             if ((sock_result == sock&#46;ERROR) || (!sock_result)) break;
            file ~= buf&#91;0 &#46;&#46; sock_result&#93;;
        }
        sock&#46;shutdown(SocketShutdown&#46;BOTH);
        sock&#46;close();
        
        if (file&#46;length &lt; 2) return 0;
        auto out_file = File(\"lev0&#46;elf64\", \"wb\");
        for (uint i = 0; i &lt; file&#46;length; i += 2)
            out_file&#46;write(file&#91;i&#93;);
        out_file&#46;close();
        
        return 0;
     }


    output:
    http://i.imgur.com/MdUE5.jpg
    [/spoiler]


    LOL @wallpaper :P

    I was looking at the semtex ones, hard to resist lol
Add a Comment