Learned a lot, but I'm still not sure if there wasn't a much simpler solution that I missed. Was return-to-libc really required to exploit it, or was I trying to kill a fly with a sledge hammer?
Return-to-libc (a.k.a. ret2libc) is usually used to bypass NX-bit / DEP, but NX was disabled for level04 - the solution does not require return-to-libc.
In the meantime, if anyone wants tips/tricks or just to chat about it, feel free to contact me (email in my profile). I captured the flag late last last week.
That's a little bit of a shame. I'm not close enough to make it to the meetup, but I and others would love some way to take part and chat with everyone.
Awesome, I'm really looking forwards to these. I was stumped from level 1 and it made me worry about what I'm doing wrong/not doing for my own servers.
Learned a lot, but I'm still not sure if there wasn't a much simpler solution that I missed. Was return-to-libc really required to exploit it, or was I trying to kill a fly with a sledge hammer?