Narnia 3
C File
int main(int argc, char **argv){
int ifd, ofd; char ofile[16] = "/dev/null"; char ifile[32]; char buf[32];
if(argc != 2){ printf("usage, %s file, will send contents of file 2 /dev/null\n",argv[0]); exit(-1); }
/* open files */ strcpy(ifile, argv[1]); if((ofd = open(ofile,O_RDWR)) < 0 ){ printf("error opening %s\n", ofile); exit(-1); } if((ifd = open(ifile, O_RDONLY)) < 0 ){ printf("error opening %s\n", ifile); exit(-1); }
/* copy from file1 to file2 */ read(ifd, buf, sizeof(buf)-1); write(ofd,buf, sizeof(buf)-1); printf("copied contents of %s to a safer place... (%s)\n",ifile,ofile);
/* close 'em */ close(ifd); close(ofd);
exit(1);}
Approach
Again we another unsafe strcpy
, but this time we can’t rewrite the return address since they are using exit
What we can do though is overwrite the ofile
to whatever we want
The only problem is that our ifile
will have to be a string + contents of ofile, or ofile
is the substring of ifile
after 32 chars
Solution
/narnia/narnia3 /tmp/tmp.3TVcyK0aB0/hello123456/pass
When we do this our ifile
becomes /tmp/tmp.3TVcyK0aB0/hello123456/pass
and our ofile
becomes pass
Now we just make a symbolic link from /tmp/tmp.3TVcyK0aB0/hello123456/pass
to /etc/narnia_pass/narnia4
, and keep an empty local file called pass
Now when the code runs it will copy the contents of the password into our local pass file
We open up our file, grab the password, and move on
Conclusion
Again be careful with strcpy
as its an easy way to cause a buffer overflow