\documentclass[noanswers,addpoints,12pt]{exam}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage[most]{tcolorbox}
\usepackage{datetime}
\usepackage{enumerate}
\usepackage{xltxtra}
\usepackage{listings}

\usepackage{graphicx}
\usepackage{hyperref}
\usepackage{makecell}
\usepackage{multicol}
\usepackage{multirow}

\usepackage{tabularx}
\usepackage{textcomp}
\usepackage{tikz}
\usetikzlibrary{arrows,automata,decorations.pathmorphing,backgrounds,positioning,fit}
\usepackage{pgf-umlcd}

\usepackage{fontspec}
\setmainfont{Gentium Basic}
\setmonofont{Comic Code}[
  Scale          = 0.80,
]

\lstset{
  basicstyle=\ttfamily,
  language=java
}


% classname
\newcommand\examNumber{\lstinline{pWhatsSoFunny} - Getting (to) the Joke}
\newcommand\semester{Fall 2022}
\newcommand\className{Security in Computer Science}
\newcommand\classNumber{CIS~371}
\newcommand\classFullName{\classNumber~\className}
\renewcommand{\dateseparator}{-}
\yyyymmdddate

% /classname

\pagestyle{headandfoot}
\firstpageheader{\classFullName\\\semester}{\examNumber\\~}{\today\\~}
\runningheader{\examNumber}{}{\today}



\author{Brian C. Ladd}
\date{Fall 2022}
\title{What's So Funny?\\\classFullName}


\newenvironment{showExample}[1]{
  \begingroup
  \renewcommand{\solutiontitle}{\noindent\textbf{Example:}\enspace}
  \printanswers
  \begin{solution}[#1]
  }{
  \end{solution}
  \endgroup
}

\begin{document}
\pointsinrightmargin{}
\maketitle
\section*{Learning Outcomes}
After completing this assignment, a student should be able to
\begin{itemize}
\item Examine a Linux executable.
\item Use \lstinline{man} and on-line documentation to find new (to
  them) tools.
\item Exploit particularly bad programming practice to get to
  ``hidden'' contents.
\end{itemize}

\section*{Procedure}
\begin{questions}

\question{} Read the assignment.
\question{} Get \lstinline{whatsSoFunny}.

  The \lstinline{whatsSoFunny} is a file in the assignment directory
  for this assignment. You should download a copy.


\question{} Bet you wonder what \emph{kind} of file you just
  downloaded. Just guessing, but there is probably a command for
  that. Your favorite search engine can get you started on that one.

\begin{tcolorbox}[
  colback=magenta!5!white,
  colframe=magenta!75!black,
  title={\centering Include}]
  Give the commandline you used to get the type
  of \lstinline{whatsSoFunny} and the answer that you got.
\end{tcolorbox}

\question{} So, if you want to run an executable program on Linux, it
  must have the executable permission bit set. If yours is a
  well-behaved browser, that bit is not set for the file you just
  downloaded.

  Note: making a random file executable is not good security
  practice. \lstinline{whatsSoFunny} is not \emph{malicious} (it was
  not written with bad intent) but you are trusting that it does not
  call the \lstinline{unlink} system call to remove all the files you
  have write access to on your computer when you run it.

\begin{tcolorbox}[
  colback=magenta!5!white,
  colframe=magenta!75!black,
  title={\centering Include}]
  Show the initial permissions \lstinline{whatsSoFunny} had when it
  was downloaded, the command you ran to change its permissions, and
  the final permissions it has.
\end{tcolorbox}


\question{} Trusting \lstinline{whatsSoFunny}, run it.

\question{} If \lstinline{whatsSoFunny} is checking what you typed
  against some password(s) \emph{and} it does not use the network (it
  does not) where could that password be stored?

\begin{tcolorbox}[
  colback=magenta!5!white,
  colframe=magenta!75!black,
  title={\centering Include}]
  Think about this and include an answer.
\end{tcolorbox}

\question{} Assuming you did not guess the password right off (if you
  did, go to the next step), the program gave you a
  hint.

  You could look at the whole program using a tool
  like \lstinline{less}. But much of the program is not
  \emph{printable}. \lstinline{less} will show hex codes for bytes that do not
  have a printable representation.

  It would be nice not to go through 13 or so pages of bytes, hoping
  to spot a useful string. Finding a more focused tool would be nice.

  Rather than an on-line search engine, try the features
  of \lstinline{man}:

  \begin{itemize}
  \item \lstinline{-k} / \lstinline{--apropos} searches for
    \textbf{keywords} you provide in the short description of the
    manual pages.
  \item The apropos search can be limited to certain sections of the
    manual with the \lstinline{-s} (comes after the \lstinline{-k})
    switch which takes a number. Section 1 is where executables
    (tools, Linux programs) are documented (rather than,
    say, \lstinline{C/C++} functions or system calls).
  \end{itemize}

\begin{tcolorbox}[
  colback=magenta!5!white,
  colframe=magenta!75!black,
  title={\centering Include}]
  What commandline did you run to find a tool as suggested in the
  hint? What is the name of the tool.
\end{tcolorbox}

\question{} Assuming you found a candidate password,
  run \lstinline{whatsSoFunny} and try it. \lstinline{whatsSoFunny}
  does \lstinline{not} keep track of how many guesses have been made.

\begin{tcolorbox}[
  colback=magenta!5!white,
  colframe=magenta!75!black,
  title={\centering Include}]
  Include the commandline you ran to look
  inside \lstinline{whatsSoFunny}.

  What's so funny? Include the joke in your answer file.
\end{tcolorbox}
\end{questions}

\section*{Submit through Classroom Management System}
Submit your answer file through BrightSpace.

Note: there is only one version of this assignment across the
class. Please do not give away the joke (on the steps to get
there). You may help others in general.
\end{document}
%%% Local Variables:
%%% mode: latex
%%% TeX-master: t
%%% End:
