More pwnables work

This commit is contained in:
Neale Pickett 2009-10-06 12:06:30 -06:00
parent 266951612b
commit 140aad23ff
8 changed files with 39 additions and 8 deletions

View File

@ -5,23 +5,24 @@ TARGET = $(CURDIR)/target
FAKE = fakeroot -s $(CURDIR)/fake -i $(CURDIR)/fake
INSTALL = $(FAKE) install
all: target
all: 99-pwnables.tce
99-pwnables.tce: target
$(FAKE) sh -c 'cd target && tar -czf - --exclude=placeholder --exclude=*~ .' > $@
target:
$(INSTALL) -d $(TARGET)
(cd skel; tar cf - .) | (cd $(TARGET); tar xf -)
$(MAKE) -C daemons TARGET=$(TARGET) install
$(INSTALL) -D init/networking $(TARGET)/var/service/networking/run
$(INSTALL) -D init/telnetd $(TARGET)/var/service/networking/run
$(INSTALL) -D init/tftpd $(TARGET)/var/service/networking/run
$(INSTALL) -d $(TARGET)/usr/lib/www
$(INSTALL) $(CGI) $(TARGET)/usr/lib/www
$(INSTALL) -D flag $(TARGET)/var/lib/tftp/flag
$(INSTALL) -D flag $(TARGET)/var/lib/notes/flag
$(INSTALL) -D flag $(TARGET)/var/lib//flag
$(INSTALL) -D flag $(TARGET)/var/lib/tftp/flag
$(INSTALL) -D flag $(TARGET)/home/flag/.plan
clean:

25
pwnables/init Executable file
View File

@ -0,0 +1,25 @@
#! /bin/sh
## This is the init for the desktop services box.
. /sbin/db-funcs.sh
dbmsg
dbmsg "-----------------------------------------------------------------------"
dbmsg "Bringing up pwnables personality"
dbmsg "-----------------------------------------------------------------------"
dbmsg
# /usr and /home live in RAM
mount -t tmpfs usr /usr
mount -t tmpfs home /home
# Unpackage everything. Globs are sorted in busybox.
cd /
for i in /opt/tce/*.tce; do
dbmsg "Unpacking $i..."
tar xzf $i
done
# Pass control to /usr/sbin/init
[ -x /usr/sbin/init ] && exec /usr/sbin/init
exec busybox init

View File

@ -0,0 +1 @@
ctf

View File

@ -0,0 +1 @@
root::::::::

View File

@ -0,0 +1,3 @@
#! /bin/sh
# Nothing to see here.

View File

@ -2,7 +2,7 @@
# busybox's dc doesn't support i :<
# Its awk does support 0xa0 as an int, but gawk doesn't. This only works on busybox.
lastd=awk -F ':' '{for (i=1; i<NF; i++) {q = xor(q, "0x" $i);} print (q<2?2:q);}' /sys/class/net/eth0/address
lastd=$(awk -F ':' '{for (i=1; i<NF; i++) {q = xor(q, "0x" $i);} print (q<2?2:q);}' /sys/class/net/eth0/address)
myip=10.0.0.$lastd