#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
int main(void) {
uid_t uid = geteuid();
setuid(uid);
system("clear");
printf("Want to play a game? ");
char buff[128];
fgets(buff, 127, stdin);
sleep(2);
int length = strlen(buff);
if(length == -10) {
printf("Good job! Spawning shell...\n\n\n");
execl("/bin/sh", "sh");
} else {
printf("Incorrect password!\nGoodbye!\n\n");
}
return 0;
}
Dump of assembler code for function main:
0x08048574 <main+0>: lea ecx,[esp+0x4]
0x08048578 <main+4>: and esp,0xfffffff0
0x0804857b <main+7>: push DWORD PTR [ecx-0x4]
0x0804857e <main+10>: push ebp
0x0804857f <main+11>: mov ebp,esp
0x08048581 <main+13>: push ecx
0x08048582 <main+14>: sub esp,0xa4
0x08048588 <main+20>: call 0x80484a4 <geteuid@plt>
0x0804858d <main+25>: mov DWORD PTR [ebp-0xc],eax
0x08048590 <main+28>: mov eax,DWORD PTR [ebp-0xc]
0x08048593 <main+31>: mov DWORD PTR [esp],eax
0x08048596 <main+34>: call 0x8048454 <setuid@plt>
0x0804859b <main+39>: mov DWORD PTR [esp],0x8048700
0x080485a2 <main+46>: call 0x8048414 <system@plt>
0x080485a7 <main+51>: mov DWORD PTR [esp],0x8048706
0x080485ae <main+58>: call 0x8048474 <printf@plt>
0x080485b3 <main+63>: mov eax,ds:0x8049890
0x080485b8 <main+68>: mov DWORD PTR [esp+0x8],eax
0x080485bc <main+72>: mov DWORD PTR [esp+0x4],0x7f
0x080485c4 <main+80>: lea eax,[ebp-0x8c]
0x080485ca <main+86>: mov DWORD PTR [esp],eax
0x080485cd <main+89>: call 0x8048424 <fgets@plt>
0x080485d2 <main+94>: mov DWORD PTR [esp],0x2
0x080485d9 <main+101>: call 0x8048484 <sleep@plt>
0x080485de <main+106>: lea eax,[ebp-0x8c]
0x080485e4 <main+112>: mov DWORD PTR [esp],eax
0x080485e7 <main+115>: call 0x8048464 <strlen@plt>
0x080485ec <main+120>: mov DWORD PTR [ebp-0x8],eax
0x080485ef <main+123>: cmp DWORD PTR [ebp-0x8],0xfffffff6
0x080485f3 <main+127>: jne 0x8048617 <main+163>
---Type <return> to continue, or q <return> to quit---
0x080485f5 <main+129>: mov DWORD PTR [esp],0x804871c
0x080485fc <main+136>: call 0x8048494 <puts@plt>
0x08048601 <main+141>: mov DWORD PTR [esp+0x4],0x804873a
0x08048609 <main+149>: mov DWORD PTR [esp],0x804873d
0x08048610 <main+156>: call 0x8048444 <execl@plt>
0x08048615 <main+161>: jmp 0x8048623 <main+175>
0x08048617 <main+163>: mov DWORD PTR [esp],0x8048745
0x0804861e <main+170>: call 0x8048494 <puts@plt>
0x08048623 <main+175>: mov eax,0x0
0x08048628 <main+180>: add esp,0xa4
0x0804862e <main+186>: pop ecx
0x0804862f <main+187>: pop ebp
0x08048630 <main+188>: lea esp,[ecx-0x4]
0x08048633 <main+191>: ret