fusion_level01.c

/*

About

level00 with stack/heap/mmap aslr, without info leak :)

Vulnerability Type 			        Stack
Position Independent Executable 	No
Read only relocations 			No
Non-Executable stack 			No
Non-Executable heap 			No
Address Space Layout Randomization Yes
Source Fortification 			        No

*/

#include "../common/common.c"    

int fix_path(char *path)
{
	char resolved[128];

	if (realpath(path, resolved) == NULL) return 1; 
	// can't access path. will error trying to open
	strcpy(path, resolved);
}

char *parse_http_request()
{
	char buffer[1024];
	char *path;
	char *q;

	// printf("[debug] buffer is at 0x%08x :-)\n", buffer); :D

	if (read(0, buffer, sizeof(buffer)) <= 0)
		errx(0, "Failed to read from remote host");
	if (memcmp(buffer, "GET ", 4) != 0) 
		errx(0, "Not a GET request");

	path = &buffer[4];
	q = strchr(path, ' ');
	if (!q) errx(0, "No protocol version specified");
	*q++ = 0;
	if (strncmp(q, "HTTP/1.1", 8) != 0)
		errx(0, "Invalid protocol");

	fix_path(path);

	printf("trying to access %s\n", path);

	return path;
}

int main(int argc, char **argv, char **envp)
{
	int fd;
	char *p;

	background_process(NAME, UID, GID);
	fd = serve_forever(PORT);
	set_io(fd);

	parse_http_request();
}