#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <signal.h>
#include <sys/stat.h>
#include <fcntl.h>
// gcc -z execstack -o level3.hard level3.hard.c -fno-stack-protector
int sockfd;
int newsockfd;
char getFlag[] ="\xeb\x0a\x5b\x83\xc3\x0a\x31\xc9\xb1\x15\xeb\x05\xe8\xf1\xff
\xff\xff\x31\x3b\x49\x83\xc3\x04\x85\xc9\x75\xf6\x69\xe5\xa9\x7e\xd9\x94\x6b\xe0
\xdd\x46\x9c\xcb\x5a\x18\x9c\xc2\x27\x9d\x3e\x3a\x23\x2c\x6d\x88\x06\x3d\x24\x0
f\x66\x5c\x2e\xf2\xe2\x68\x5a\xbb\xe9\x94\x4c\x3a\x38\xaf\x82\xc6\x6a\x9e\x69\x2b
\x63\xee\x9c\xcb\x5a\x19\x60\x8b\xdb\xdd\x1d\x0a\xdb\xc6\x60\x8b\x02\xd9\x52\xf4
\x15\x7b\xc1\x6a\x8d\x30\xc5\x6a\x98\x79\x83\x7f\x92\x69\xad";
int sendFlag(int sock)
{
char tmp[16];
bzero(tmp, sizeof(tmp));
read(sock, tmp, sizeof(tmp)+16);
write(sock, tmp, strlen(tmp));
}
void sigintHandler(int sig)
{
if (sig == SIGINT)
{
while (close(sockfd));
printf("Closed server socket\n");
exit(EXIT_FAILURE);
}
}
void sigsegvHandler(int sig)
{
if (sig == SIGSEGV)
{
write(newsockfd, "Server error\n", 13);
close(newsockfd);
exit(EXIT_FAILURE);
}
}
void ERROR(char* err)
{
perror(err);
exit(EXIT_FAILURE);
}
int main(int argc, char *argv[])
{
if(argc != 2) {
printf("%s portno \n", argv[0]);
exit(EXIT_FAILURE);
}
int portno, clilen, n;
int pid;
char *clientIP;
struct sockaddr_in serv_addr, cli_addr;
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd < 0)
ERROR("socket");
// server's listening port
portno = atoi(argv[1]);
bzero((char *) &serv_addr, sizeof(serv_addr));
serv_addr.sin_family = AF_INET;
serv_addr.sin_port = htons(portno);
serv_addr.sin_addr.s_addr = INADDR_ANY;
if (bind(sockfd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0)
ERROR("bind");
listen(sockfd, 5);
// kill all child processes that terminated
signal(SIGCHLD, SIG_IGN);
signal(SIGINT, (void*)sigintHandler);
signal(SIGSEGV, (void*)sigsegvHandler);
while (1)
{
clilen = sizeof(cli_addr);
if ( (newsockfd = accept(sockfd, (struct sockaddr *) &cli_addr, &clilen)) > 0 )
{
pid = fork();
if (pid == 0)
{
while(close(sockfd));
sendFlag(newsockfd);
close(newsockfd);
exit(1);
}
else if ( pid > 0)
{
close(newsockfd);
}
}
}
return 0;
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <signal.h>
#include <sys/stat.h>
#include <fcntl.h>
// gcc -o level2 level2.c -fno-stack-protector -z execstack -mpreferred-stack-boundary=2
unsigned int secret;
int sockfd;
int newsockfd;
void getFlag(int sock)
{
char tmp[64];
int fd = open("flag.txt", O_RDONLY);
if (fd < 0)
exit(EXIT_FAILURE);
bzero(tmp, sizeof(tmp));
read(fd, tmp, sizeof(tmp));
write(sock, "Flag: ", 7);
write(sock, tmp, strlen(tmp));
close(fd);
}
int vuln(int sock)
{
int ret = 0xdeadbeef;
unsigned int cookie = secret;
char tmp[32] = {'\0'};
bzero(tmp, sizeof(tmp));
read(sock, tmp, sizeof(tmp)+20);
if(cookie!=secret)
{
write(sock, "It's not my cookie :(\n", 22);
exit(EXIT_FAILURE);
}
return ret;
}
void sigintHandler(int sig)
{
if (sig == SIGINT)
{
while (close(sockfd));
printf("Closed server socket\n");
exit(EXIT_FAILURE);
}
}
void sigsegvHandler(int sig)
{
if (sig == SIGSEGV)
{
write(newsockfd, "Server error\n", 13);
close(newsockfd);
exit(EXIT_FAILURE);
}
}
void ERROR(char* err)
{
perror(err);
exit(EXIT_FAILURE);
}
int main(int argc, char *argv[])
{
if(argc != 2) {
printf("%s portno \n", argv[0]);
exit(EXIT_FAILURE);
}
srand(time(NULL));
secret = rand();
int portno, clilen, n;
int pid;
char *clientIP;
struct sockaddr_in serv_addr, cli_addr;
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd < 0)
ERROR("socket");
// server's listening port
portno = atoi(argv[1]);
bzero((char *) &serv_addr, sizeof(serv_addr));
serv_addr.sin_family = AF_INET;
serv_addr.sin_port = htons(portno);
serv_addr.sin_addr.s_addr = INADDR_ANY;
if (bind(sockfd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0)
ERROR("bind");
listen(sockfd, 5);
// kill all child processes that terminated
signal(SIGCHLD, SIG_IGN);
signal(SIGINT, (void*)sigintHandler);
signal(SIGSEGV, (void*)sigsegvHandler);
while (1)
{
clilen = sizeof(cli_addr);
if ( (newsockfd = accept(sockfd, (struct sockaddr *) &cli_addr, &clilen)) > 0 )
{
pid = fork();
if (pid == 0)
{
while(close(sockfd));
void (*foo)(int);
foo = vuln(newsockfd);
// mistake here?
foo(argc);
close(newsockfd);
exit(1);
}
else if ( pid > 0)
{
close(newsockfd);
}
}
}
return 0;
}