Wow, I read in this very thread that NX was for sure disabled on level03 so I've been barking up the wrong tree completely. Your direction is brilliant! I never would have come up with that. Here's my attempt: http://pastebin.com/XVkfLaiB

Wait. wtf how is yours working with NX on?

Edit: OH! Yours doesn't actually manipulate the stack so it doesn't get caught? That makes sense. I should have noticed the __stack_chk_fail calls.

For level 06, I came up with a completely different solution. After hitting my head against the wall all day trying to fight with blocking/non-blocking IO, I resorted to a timing attack on the system call which worked really well. Check it out:

https://gist.github.com/1899389 (SPOILERS!)

That's neat. Timing. Awesome.

I made mine a bit more reliable and made a movie.

Source: http://pastebin.com/6M4cq8gB Video: http://www.youtube.com/watch?v=_q2wTd1jgUQ

i did it a different way to both of you but similar to zx2c4 's :) i found a way to block the child process from writing to stderr. i thought the way they were writing to stderr/ stdout was too much of a coincidence. all stdout writes end with \n

Wadja end up doin'? Source?

I had the same solution, just different heuristics..

http://pastebin.com/VfdmgwSA

All cleaned up now: http://git.zx2c4.com/Stripe-CTF/tree/