Narnia9

Source: This content is aggregated from overthewire (MIT). Visit the original repository for the latest version.

There is no information for this level, intentionally.

Study guide

Level map: logged in as narnia9. This is the highest-numbered Narnia page; the upstream index counts ten levels, narnia0 to narnia9.

What this level teaches

Putting the whole Narnia toolbox together without a hint about which technique to use.

Key ideas

• Diagnose before attacking. Read the source, identify the unsafe operation, and decide whether you are looking at an overflow, a format string, a pointer problem or something else.
• Use all your tools. gdb for layout, objdump or ghidra for the compiled view, and a short script for building payloads.
• Check what the goal is. As in earlier levels, the program is setuid to another user; reading that user’s file under /etc/narnia_pass/ is the objective.

How to approach it

1. Read the source carefully and annotate it.
2. Reproduce a crash or unexpected behaviour before writing any exploit.
3. Build the payload in small, tested steps.

What to do next

• Re-derive one earlier exploit from scratch using only the source and gdb.
• Move on to Behemoth. From the games index, Behemoth is the next step; it does not hand you source code.
• Learn the defences. Read about stack canaries, non-executable memory and address randomisation to see why today’s exploits are harder.