http://wiki.zenk-security.com/ 2026-05-04T01:28:09+02:00 http://wiki.zenk-security.com/ http://wiki.zenk-security.com/lib/tpl/dokuwiki/images/favicon.ico text/html 2017-04-09T15:33:57+02:00 http://wiki.zenk-security.com/doku.php?id=overthewire_narnia:level0&rev=1491744837&do=diff ssh narnia0@narnia.labs.overthewire.org pass : narnia0 #include <stdio.h> #include <stdlib.h> int main(){ long val=0x41414141; char buf[20]; printf("Correct val's value from 0x41414141 -> 0xdeadbeef!\n"); printf("Here is your chance: "); scanf("%24s",&buf); printf("buf: %s\n",buf); printf("val: 0x%08x\n",val); if(val==0xdeadbeef) system("/bin/sh"); else { printf("WAY OFF!!!!\n"); exit(1); } return 0; } text/html 2017-04-09T15:33:57+02:00 http://wiki.zenk-security.com/doku.php?id=overthewire_narnia:level1&rev=1491744837&do=diff ssh narnia1@narnia.labs.overthewire.org pass : efeidiedae #include <stdio.h> int main(){ int (*ret)(); if(getenv("EGG")==NULL){ printf("Give me something to execute at the env-variable EGG\n"); exit(1); } printf("Trying to execute EGG!\n"); ret = getenv("EGG"); ret(); return 0; } text/html 2013-03-01T19:32:17+02:00 http://wiki.zenk-security.com/doku.php?id=overthewire_narnia:level2&rev=1362162737&do=diff ssh narnia2@narnia.labs.overthewire.org pass : nairiepecu #include <stdio.h> #include <string.h> #include <stdlib.h> int main(int argc, char * argv[]){ char buf[128]; if(argc == 1){ printf("Usage: %s argument\n", argv[0]); exit(1); } strcpy(buf,argv[1]); printf("%s", buf); return 0; } text/html 2013-03-01T19:44:51+02:00 http://wiki.zenk-security.com/doku.php?id=overthewire_narnia:level3&rev=1362163491&do=diff ssh narnia3@narnia.labs.overthewire.org pass : vaequeezee #include <stdio.h> #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <unistd.h> #include <stdlib.h> #include <string.h> int main(int argc, char **argv){ int ifd, ofd; char ofile[16] = "/dev/null"; char ifile[32]; char buf[32]; if(argc != 2){ printf("usage, %s file, will send contents of file 2 /dev/null\n",argv[0]); exit(-1); … text/html 2017-04-09T15:33:57+02:00 http://wiki.zenk-security.com/doku.php?id=overthewire_narnia:level4&rev=1491744837&do=diff ssh narnia4@narnia.labs.overthewire.org pass : thaenohtai #include <string.h> #include <stdlib.h> #include <stdio.h> #include <ctype.h> extern char **environ; int main(int argc,char **argv){ int i; char buffer[256]; for(i = 0; environ[i] != NULL; i++) memset(environ[i], '\0', strlen(environ[i])); if(argc>1) strcpy(buffer,argv[1]); return 0; } text/html 2017-04-09T15:33:57+02:00 http://wiki.zenk-security.com/doku.php?id=overthewire_narnia:level5&rev=1491744837&do=diff ssh narnia5@narnia.labs.overthewire.org pass : faimahchiy #include <stdio.h> #include <stdlib.h> #include <string.h> int main(int argc, char **argv){ int i = 1; char buffer[64]; snprintf(buffer, sizeof buffer, argv[1]); buffer[sizeof (buffer) - 1] = 0; printf("Change i's value from 1 -> 500. "); if(i==500){ printf("GOOD\n"); system("/bin/sh"); } printf("No way...let me give you a hint!\n"); printf("buffer : [%s] (%d)\n", buffer, strlen(buffer)); printf ("i = %d (%p)\n", i, … text/html 2013-03-03T15:24:52+02:00 http://wiki.zenk-security.com/doku.php?id=overthewire_narnia:level6&rev=1362320692&do=diff ssh narnia6@narnia.labs.overthewire.org pass : neezocaeng #include <stdio.h> #include <stdlib.h> #include <string.h> extern char **environ; int main(int argc, char *argv[]){ char b1[8], b2[8]; int (*fp)(char *)=(int(*)(char *))&puts, i; if(argc!=3){ printf("%s b1 b2\n", argv[0]); exit(-1); } /* clear environ */ for(i=0; environ[i] != NULL; i++) memset(environ[i], '\0', strlen(environ[i])); /* clear argz */ for(i=3; argv[i] != NULL; i++) memset(argv[i], '\0', strlen(argv[i])… text/html 2013-03-03T15:51:58+02:00 http://wiki.zenk-security.com/doku.php?id=overthewire_narnia:level7&rev=1362322318&do=diff ssh narnia7@narnia.labs.overthewire.org pass : ahkiaziphu #include <stdio.h> #include <stdlib.h> #include <string.h> #include <stdlib.h> #include <unistd.h> int goodfunction(); int hackedfunction(); int vuln(const char *format){ char buffer[128]; int (*ptrf)(); memset(buffer, 0, sizeof(buffer)); printf("goodfunction() = %p\n", goodfunction); printf("hackedfunction() = %p\n\n", hackedfunction); ptrf = goodfunction; printf("before : … text/html 2013-03-17T15:32:59+02:00 http://wiki.zenk-security.com/doku.php?id=overthewire_narnia:level8&rev=1363530779&do=diff ssh narnia8@narnia.labs.overthewire.org pass : mohthuphog #include <stdio.h> #include <stdlib.h> #include <string.h> // gcc's variable reordering fucked things up // to keep the level in its old style i am // making "i" global unti i find a fix // -morla int i; void func(char *b){ char *blah=b; char bok[20]; //int i=0; memset(bok, '\0', sizeof(bok)); for(i=0; blah[i] != '\0'; i++) bok[i]=blah[i]; printf("%s\n",bok); } int main(int argc, char **argv){ if(argc > 1) …