Leviathan — OverTheWire

The Leviathan wargame primarily focuses on basic reverse engineering, file permissions, exploiting SUID binaries, and understanding system library calls.

Level 0 → Level 1

Goal: Find the hidden password for the next level.

Process:

• Log into the server using SSH as leviathan0 with the password leviathan0.
• Use the ls -la command to list all files, including hidden ones.
• A hidden directory named .backup is discovered.
• Navigate into .backup using cd .backup.
• Inside, there is a file named bookmarks.html.
• Since it is a large file, use the grep command to search for the keyword "leviathan": grep leviathan bookmarks.html.
• This outputs the line containing the password for leviathan1.

Level 1 → Level 2

Goal: Exploit a SUID binary to spawn a shell as the next user.

Process:

• Log in as leviathan1.
• There is an executable file named check in the home directory.
• Running ./check prompts for a password. Guessing randomly fails.
• Use the ltrace command (ltrace ./check) to trace the library calls made by the binary.
• The output shows a strcmp() (string compare) function checking the user input against a hardcoded string: "sex".
• Run ./check again and type sex as the password.
• The program spawns a new shell with leviathan2 privileges.
• Retrieve the password by reading the protected file: cat /etc/leviathan_pass/leviathan2.

Level 2 → Level 3

Goal: Bypass a file access check using a space-in-filename exploit.

Process:

• Log in as leviathan2.
• Find a SUID binary named printfile which prints the contents of a file passed as an argument.
• Running ltrace ./printfile reveals how it works: it uses the access() function to check if the current user has permission to read the file, and then uses the system() function to run /bin/cat <filename>.
• The vulnerability: system() doesn't handle spaces in filenames securely. If a filename has a space, cat interprets it as two separate files.
• Create a temporary workspace: mkdir /tmp/workspace and cd /tmp/workspace.
• Create a symbolic link named space pointing to the password file: ln -s /etc/leviathan_pass/leviathan3 space.
• Create a dummy file with a space in its name: touch "space file".
• Run the program: ~/printfile "space file".
• The access() check passes because "space file" belongs to the user. But system("/bin/cat space file") executes cat space and cat file.
• cat space follows the symlink and prints the password for leviathan3.

Level 3 → Level 4

Goal: Reverse engineer another binary to find a hidden password.

Process:

• Log in as leviathan3.
• There is a SUID binary named level3 that prompts for a password.
• Run ltrace ./level3 and input a test password.
• The trace reveals that the program compares the user input against the hardcoded string "snlprintf" using strcmp().
• Run ./level3 and enter snlprintf.
• It drops you into a shell as leviathan4.
• Retrieve the password: cat /etc/leviathan_pass/leviathan4.

Level 4 → Level 5

Goal: Find a hidden binary and decode its output.

Process:

• Log in as leviathan4.
• Running ls -la reveals a hidden directory named .trash.
• Inside .trash, there is a SUID binary named bin.
• Running ./bin outputs a string of binary code (1s and 0s).
• This binary data represents ASCII characters.
• Copy the binary output and use an online Binary-to-ASCII converter, or pipe it through a local script/tool to decode it.
• The decoded ASCII text is the password for leviathan5.

Level 5 → Level 6

Goal: Exploit a hardcoded file path using a symbolic link.

Process:

• Log in as leviathan5.
• There is a SUID binary named leviathan5.
• Running ./leviathan5 gives an error saying it cannot find /tmp/file.log.
• Run ltrace ./leviathan5 to confirm that the program explicitly looks for a file at that exact path to print its contents.
• To exploit this, create a symbolic link at that location pointing to the next password file: ln -s /etc/leviathan_pass/leviathan6 /tmp/file.log.
• Run ./leviathan5 again. The program reads the symlink and outputs the password for leviathan6.

Level 6 → Level 7

Goal: Brute-force a 4-digit PIN.

Process:

• Log in as leviathan6.
• There is a SUID binary named leviathan6 that requires a 4-digit PIN as an argument.
• Manual guessing would take too long, so a simple bash script loop is used to brute-force all combinations from 0000 to 9999.
• Run the following one-liner in the terminal:

for i in {0000..9999}; do ~/leviathan6 $i; done

1. The loop will rapidly test numbers. Once it hits the correct PIN, it will spawn a shell as leviathan7 and pause the loop.
2. Retrieve the final password: cat /etc/leviathan_pass/leviathan7.

Level 7 (Conclusion)

Goal: Log in and claim victory.

Process:

• Log in as leviathan7 using the retrieved password.
• This level does not have a subsequent challenge; logging in successfully marks the completion of the Leviathan wargame.