1

The following code should be exploited and I need to exploit it in such a way that it runs my command (l33t) and there should be shellcode and exploit included, so that it runs my command. I believe I need to use GDB and it has something to do with the global offset table and is potentially a string format vulnerability (although I could be wrong). It is the C code shown below.

include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>

int sudoexec(char *command)
{
  FILE *f = NULL;
  char log_entry[64];
  char line[256];

  f = fopen("sudolog", "a");
  if (f == NULL)
    {
      fprintf(stderr, "Can't open sudolog file\n");
      return -1;
    }
  snprintf(log_entry, 64, "%d: %s\n", getuid(), command);
  
  fprintf(f, log_entry, NULL);
  fclose(f);

  f = fopen("sudoers", "r");
  if (f == NULL)
    {
      fprintf(stderr, "Can't open sudoers file\n");
      return -1;
    }

  while(fgets(line, 256, f) != NULL)
    { 
      if (atoi(line) == getuid())
        {
          if (setuid(0) == 0) {
            system(command);
          } else {
            fprintf(stderr, "Setting the UID to root failed: check permissions\n");
          }

          fclose(f);
          return 0;
        }
    }
  fprintf(stderr, "User not listed in the sudoers file\n");
return -1;
}

int main (int argc, char** argv)
{

  if (argv[1] == NULL)
    {
      fprintf(stderr, "Missing args\n");
      return -1;
    }
  
  if (sudoexec(argv[1]) != 0)
    {
      fprintf(stderr, "Cannot execute your command\n");
      return -1;
    }
  return 0;
}


Please share the exploit and shellcode and please explain the procedure used to exploit this code so that it ran my command (l33t).

6
  • 1
    Welcome to the community. What have you already researched and tried? Commented Dec 13, 2023 at 20:41
  • Hi Muffington, thank you. I honestly don't really know where to begin with this, unfortunately. As I don't program in C
    – A M
    Commented Dec 13, 2023 at 21:08
  • 1
    The language doesn’t really matter. And you could start by learning C syntax…
    – LvB
    Commented Dec 13, 2023 at 21:54
  • If you do not know the language, we're not going to hand you a pre-made exploit. We can help with a specific problem, but we don't do "hack this for me please". And I'm guessing this is homework. We can help with homework, but you have to at least try to come up with an answer on your own.
    – schroeder
    Commented Dec 13, 2023 at 22:40
  • okay, do you have any tips on how I can approach this?
    – A M
    Commented Dec 14, 2023 at 0:02

0