Semtex4

Source: This content is aggregated from overthewire (MIT). Visit the original repository for the latest version.

Ptrace your way

Pass prints the password for the level you are on. Try to make it print the next level’s password. This time it is not so easy:

/semtex/semtex4: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for GNU/Linux 2.6.15, stripped

Tip :

• Pass uses geteuid() to get its information.
• Read man ptrace

Study guide

Level map: the pass program prints your own level’s password; you must make it print the next one.

What this level teaches

Using ptrace, the system call behind debuggers, to alter another process.

Key ideas

• Stripped, static binary. The page shows the file is 32-bit, statically linked and stripped, so there are no symbols and no dynamic library calls to intercept.
• geteuid(). The program decides what to print from the effective user ID.
• ptrace. A tracing parent can read and change a child’s registers and memory, so you can alter the value the child sees.
• Reading. man ptrace, as the page advises.

How to approach it

1. Find where the program calls geteuid (by tracing system calls).
2. Write a launcher that traces the program and changes the result.
3. Run it and read the output.

Why it matters

This is how debuggers, sandboxes and many anti-debugging tricks work.