Memory Corruption & Binary Reversing Tasks -- 3

Memory corruption and binary reversing tasks are coming in hot.
Let’s warm up (and recover from any trauma induced by the midterm exam) with what we call in the biz data-only memory corruption attacks. These may not be as fancy as what’s coming later, but they are in fact very damaging, as they often remain unhindered by the modern defenses designed to block more complex attacks.
Here are your learning goals:
● Meet memory corruption.
● Ease into binary reversing.
● Get familiar with gdb.
● Overcome the fear of binary exploitation.
Your Task
Find the program sun installed under /usr/local/bin/.
This program serves to...
Well, actually, we have no clue what it does. We found it sitting on the server one day.
But let’s not get distracted by that trivial inconvenience.
sun is owned by the group prog10, and its setgid bit is enabled.
So your task should be familiar: Find a way to exploit the program and execute /usr/local/bin/win withtheeffectivegroupIDofprog10togetyoursolutiontoken.
Collect this one token, complete the challenge.
There is of course no source code for this mysterious program, but we harassed a poor intern to reverse it for us, and reconstructed a viable C program. This is available under /usr/local/course/src/. Unlessyouarealeetreverseryourself,youMUSTreaditto solve the challenge. But don’t blindly trust the code. The intern sucked, and many parts of the program are either inaccurate, or entirely missing. When in doubt, reverse yourself.