Manpage0
Manpage Level 0 — an intentionally undocumented first level, with a method for investigating it.
Table of Contents
Source: This content is aggregated from overthewire (MIT). Visit the original repository for the latest version.
There is no information for this level, intentionally.
Study guide
Level map: logged in as manpage0, find the password for manpage1.
What to expect
Upstream states “There is no information for this level, intentionally.” That is part of the game: you discover what the level does by investigating it. Manpage is about breaking common Linux C-programming misconceptions. Its author’s advice is that a good way to begin auditing code is to read the manual pages for pitfalls and unusual behaviour.
Where it fits
Manpage is given only as x/10 in its original description, so effectively unrated, and lives under /manpage/ on the game server (SSH port 2224). This is page 1 of 8 in this mirror. Treat the first level as orientation: learn the account layout, the data directory and the tools available before looking for a bug.
How to approach it
- Start with
fileandstringson the level’s program to learn what it is and what text it contains. - Check permissions with
ls -l: a setuid or setgid bit tells you whose privileges the program runs with. - For every library function the program calls, read its man page, especially the sections on return values, NOTES, BUGS and CAVEATS, and ask what the programmer assumed that the manual does not guarantee.
- Write down the one thing the program assumes about its input, then test what happens when that assumption is false.
Why it matters
Each level is a miniature version of a real bug class. Working it out yourself without hints builds the investigative habits that no walkthrough can give you.