Behemoth2
Behemoth Level 2 — a privileged program runs another program by name, so how it finds that program becomes the weakness.
Table of Contents
Source: This content is aggregated from overthewire (MIT). Visit the original repository for the latest version.
There is no information for this level, intentionally.
Study guide
Level map: logged in as behemoth2, find the password for behemoth3.
What this level teaches
How the PATH environment variable and the current directory influence which program gets executed.
Key ideas
- Commands run by name. When a program calls a command without an absolute path, the system searches the directories in
PATHin order. - Controlling the search. If you can put your own program earlier in that search, your program runs with the caller’s privileges.
- Trace to see the call.
straceandltraceshow exactly what the program executes and in which directory it works. - Writable workspace. Make a private directory under
/tmpfor your files.
How to approach it
- Trace the program and note every command it runs by name.
- Think about what a replacement for that command should do with its privileges.
- Make it findable and run the original program.
Why it matters
Unsafe use of system() and relative commands in setuid programs is a long-standing source of privilege escalation.