Level1 should be pretty straightforward. Looking at the assenbly, you can see that it prints the current working directory by using system(“pwd”) and then strcpy user controlled data to a fixed size buffer.
Continue reading Insomni’hack 2013 Armory level1 & level2Orange Cyberdefense Switzerland's technical blog