Same here, but I'm stuck on level 3 though...maybe my strategy is wrong. I am able to execute the function run from /levels/level03 with the following command:

  cat /home/level04/.password

But I'm still getting access denied. I thought that would have done it for sure. The program runs under the following credentials:

  uid=1003(level03) gid=1004(level03) groups=1001(chroot),1004(level03)

Which is kind of weird since /levels/level03 has a setuid of level04. It could be gdb...

Since gdb is the parent of your process, it's running as level03, not root. You can't use gdb on a setuid binary unless you run gdb itself as root.

Ah man, I couldn't agree more. I've learned a ton just messing around with the first few, though getting this was a real bummer:

Run till exit from #0 run (str=0xffece7ec "cat /home/level04/.password") at level03.c:53 cat: /home/level04/.password: Permission denied

Ah well, a sign to go to sleep. Tomorrow I'll have to learn more things to figure it out if it's still up.

setuid doesn't work inside of GDB. You have to run the program without a debugger to get level04 permissions.

(Disclaimer: I haven't succeeded yet.)

I mostly live inside a Java world or XCode world, so GDB is almost a totally foreign concept to me - and I definitely welcome the challenge. Never really had to look at assembly before either, so this is a fun learning experience.