Overthewire Leviathan Level 5 To 6

Leviathan 5

Username: leviathan5
Password: redacted

Data for the levels can be found in **the homedirectories**. You can look at **/etc/leviathan\_pass** for the various level passwords.

Lets take a look.

leviathan5@leviathan:~$ ls
leviathan5
leviathan5@leviathan:~$ ./leviathan5
Cannot find /tmp/file.log

Another ltrace

leviathan5@leviathan:~$ ltrace ./leviathan5
__libc_start_main(0x80485db, 1, 0xffffd784, 0x80486a0 <unfinished ...>
fopen("/tmp/file.log", "r")                                               = 0
puts("Cannot find /tmp/file.log"Cannot find /tmp/file.log
)                                         = 26
exit(-1 <no return ...>
+++ exited (status 255) +++

Mkay, lets create the file and re-do that

leviathan5@leviathan:~$ touch /tmp/file.log
leviathan5@leviathan:~$ ltrace ./leviathan5
__libc_start_main(0x80485db, 1, 0xffffd784, 0x80486a0 <unfinished ...>
fopen("/tmp/file.log", "r")                                               = 0x804b008
fgetc(0x804b008)                                                          = '\377'
feof(0x804b008)                                                           = 1
fclose(0x804b008)                                                         = 0
getuid()                                                                  = 12005
setuid(12005)                                                             = 0
unlink("/tmp/file.log")                                                   = 0
+++ exited (status 0) +++

So fopen opens the file and unlink removes the file. I’m guessing we need to use the whole file link as previous

leviathan5@leviathan:~$ ln -s /etc/leviathan_pass/leviathan6 /tmp/file.log
leviathan5@leviathan:~$ ./leviathan5
redacted

VICTORY.

redacted