Capture the Flag on Christoph Kemetmüller

SANS Holiday Hack Challenge 2017 Solution

Mon, 01 Jan 2018 01:23:27 +0000

Letters to Santa app contains a reference to a development system in a HTML comment section.

<!-- Development version -->
<a href="http://dev.northpolechristmastown.com" style="display: none;">Access Development Version</a>

The development interface is based on Apache struts. The utilized version is vulnerable to CVE 2017-9805. A respective script can be found on github.

Vulnhub - Breach 3 boot2root CTF walkthrough

Sun, 30 Apr 2017 20:21:59 +0000

The third boot2root system in the Breach series is an intermediate challenge. This time the VM will automatically acquire an IP address via DHCP.

First, let’s identify the target system. With netdiscover this is quite an easy task.

The target is at 10.0.2.9.

After identifying the target system at 10.0.2.9 a port scan to discover a potential attack vector for the breach. The SYN scan did not yield any results, all ports seem to be closed. The UDP scan shows that a service on port 161/udp is listening.

Vulnhub - Breach 2.1 boot2root CTF walkthrough

Wed, 08 Mar 2017 22:22:59 +0000

Breach 2.1 is meant to be beginner to intermediate boot2root/CTF challenge. The VM is configured with a static IP address (192.168.110.151) so you will need to configure your host-only adaptor to this subnet.

The VM is configured to the IP address 192.168.110.151. Let’s start by scanning the target via nmap.

Vulnhub - Breach 1 boot2root CTF walkthrough

Thu, 02 Mar 2017 10:46:59 +0000

Breach 1.0 is meant to be beginner to intermediate boot2root/CTF challenge. The VM is configured with a static IP address (192.168.110.140) so you will need to configure your host-only adaptor to this subnet.

The VM is configured to the IP address 192.168.110.140. Let’s start by scanning the target via nmap.

The 2015 SANS Holiday Hack Challenge - Solution

Tue, 05 Jan 2016 01:23:27 +0000

Which commands are sent across the Gnome’s command-and-control channel?
EXEC:iwconfig in packet 363
EXEC:cat /tmp/iwlistscan.txt in packet 573
What image appears in the photo the Gnome sent across the channel from the Dosis home?

A tidy children’s room is depicted in the photo. The photo includes something like legs that are probably attached to the camera. At the bottom is a label with “GnomeNet-NorthAmerica”.

What operating system and CPU type are used in the Gnome? What type of web framework is the Gnome web interface built in?
OpenWRT (r47650) on ARM
NodeJS with Mongodb
What kind of a database engine is used to support the Gnome web interface? What is the plaintext password stored in the Gnome database?
MongoDB
The following credentials are stored in the firmware image
admin : SittingOnAShelf
user : user
What are the IP addresses of the five SuperGnomes scattered around the world, as verified by Tom Hessman in the Dosis neighborhood?
SG-01 52.2.229.189 (United States, Ashburn)
SG-02 52.34.3.80 (United States, Boardman)
SG-03 52.64.191.71 (Australia, Sydney)
SG-04 52.192.152.132 (Japan, Tokyo)
SG-05 54.233.105.81 (Brazil)
Where is each SuperGnome located geographically?
Describe the vulnerabilities you discovered in the Gnome firmware.
Storage of clear text passwords in the MongoDB database.
Local file inclusion via directory traversal in routes/index.js:195

The code checks whether the requested file path contains a “.png”.
The file upload can be utilized to create a temporary folder with a suitable name.

Possible NoSQL injection for the login post in routes/index.js:109.

Might not possible as “extended = false” for the firmware as described in bodyParser is deprecated express 4

Possible server side javascript injection for file upload in routes/index.js:166

The user provided parameter: posproc is utilized in an unsanatized eval()

Stack based buffer overflow in sgnet_readn that is utilized in sgstatd.c:147:

The stack canary is static and can easily be repaired.
The stack canary includes a JMP ESP as a partial command. This assembly instruction is crucial for exploitation.

Describe the technique you used to gain access to each SuperGnome’s gnome.conf file.
SG-01: Administrative credentials from the firmware image provided full access.
SG-02: A path traversal vulnerability allowed to download arbitrary files in the context of a standard user.
SG-03: A NoSQL injection in the login form was exploited in order to login as admin user.
SG-04: The system was compromised via server side javascript injection in NodeJS.
SG-05: Weaponize remote exploit for sgstadt (4242/tcp) in order to a reverse shell.

The packet capture includes mostly traffic on port 53/udp. A client system at 52.2.229.189 is querying the dns server at 10.42.0.18 for a TXT record. In packet 363 the server responds with a base64 encoded string EXEC:iwconfig. Subsequently, the client starts sending TXT responses with base64 encoded data to the server. The response starts with a start marker EXEC:START_STATE. The end of the exec output is marked by an encoded EXEC:STOP. In packet 573 another command is scheduled by the server: EXEC:cat /tmp/iwlistscan.txt. Finally, in packet 875 the server requests a file with FILE:/root/Pictures/snapshot_CURRENT.jpg.

Exploit Exercises - Protostar - Final levels

Sun, 02 Nov 2014 16:55:26 +0200

Exploit-Exercises: Protostar

For this level we have got a binary listening on port 2995.

Let’s find out what this binary is up to.

0x08049833 <main+0>: push %ebp
0x08049834 <main+1>: mov %esp,%ebp
0x08049836 <main+3>: and $0xfffffff0,%esp
0x08049839 <main+6>: sub $0x20,%esp
0x0804983c <main+9>: movl $0x0,0x8(%esp)
0x08049844 <main+17>: movl $0x0,0x4(%esp)
0x0804984c <main+25>: movl $0x8049c74,(%esp) ; "final0"
0x08049853 <main+32>: call 0x8048e58 <background_process>
0x08049858 <main+37>: movl $0xbb3,(%esp)
0x0804985f <main+44>: call 0x80492f5 <serve_forever>
0x08049864 <main+49>: mov %eax,0x18(%esp)
0x08049868 <main+53>: mov 0x18(%esp),%eax
0x0804986c <main+57>: mov %eax,(%esp)
0x0804986f <main+60>: call 0x80493d5 <set_io>
0x08049874 <main+65>: call 0x804975a <get_username>
0x08049879 <main+70>: mov %eax,0x1c(%esp)
0x0804987d <main+74>: mov $0x8049c7b,%eax ; "No such user %s\n"
0x08049882 <main+79>: mov 0x1c(%esp),%edx
0x08049886 <main+83>: mov %edx,0x4(%esp)
0x0804988a <main+87>: mov %eax,(%esp)
0x0804988d <main+90>: call 0x8048bac <printf@plt>

We have got a service waiting for our commands. The magic is happening in get_username().

Exploit Exercises - Protostar - Heap levels

Sat, 01 Nov 2014 11:52:17 +0200

Exploit-Exercises: Protostar

For this scenario we need to run the winner() function. To get a better idea about the binary a look at the assembly helps.

0x08048492 <main+6>: sub $0x20,%esp
0x08048495 <main+9>: movl $0x40,(%esp)
0x0804849c <main+16>: call 0x8048388 <malloc@plt> ; malloc(64)
0x080484a1 <main+21>: mov %eax,0x18(%esp) ; store address
0x080484a5 <main+25>: movl $0x4,(%esp)
0x080484ac <main+32>: call 0x8048388 <malloc@plt> ; malloc(4)
0x080484b1 <main+37>: mov %eax,0x1c(%esp) ; store address
0x080484b5 <main+41>: mov $0x8048478,%edx ; nowinner()
0x080484ba <main+46>: mov 0x1c(%esp),%eax
0x080484be <main+50>: mov %edx,(%eax)
0x080484c0 <main+52>: mov $0x80485f7,%eax ; "data is at %p, fp is at %p\n"
0x080484dd <main+81>: mov 0xc(%ebp),%eax
...
0x080484e0 <main+84>: add $0x4,%eax
0x080484e3 <main+87>: mov (%eax),%eax
0x080484e5 <main+89>: mov %eax,%edx
0x080484e7 <main+91>: mov 0x18(%esp),%eax
0x080484eb <main+95>: mov %edx,0x4(%esp)
0x080484ef <main+99>: mov %eax,(%esp)
0x080484f2 <main+102>: call 0x8048368 <strcpy@plt> ; vulnerable function
0x080484f7 <main+107>: mov 0x1c(%esp),%eax ; load pointer
0x080484fb <main+111>: mov (%eax),%eax ; follow pointer
0x080484fd <main+113>: call %eax ; execute function pointer

So, the binary allocates 64+4 bytes on the heap. Afterwards, the argument is copied into the first allocated memory part. As strcpy does not limit the length, we can write into the second variable. That variable contains a function pointer that is executed afterwards.

Exploit Exercises - Protostar - Network levels

Thu, 18 Sep 2014 13:21:27 +0200

Exploit-Exercises: Protostar

For this exercise we have got a service listening on port 2999. Let’s connect and see what it does.

user@protostar:/opt/protostar/bin$ telnet 127.0.0.1 2999
Connected to 127.0.0.1.
Please send '12992273' as a little endian 32bit int
AAAA
I'm sorry, you sent 1094795585 instead

The challenge changes for every run. So we have to write a script that extracts the challenge. Subsequently, we have to calculate the correct response.

Exploit Exercises - Protostar - Format String levels

Tue, 16 Sep 2014 13:21:27 +0200

Exploit-Exercises: Protostar

First of all, we take a look at the disassembly.

...
0x08048431 <main+6>: sub $0x10,%esp
0x08048434 <main+9>: mov 0xc(%ebp),%eax ; load pointer to the address of first argument
0x08048437 <main+12>: add $0x4,%eax ; increment to get to the pointer of the second argument
0x0804843a <main+15>: mov (%eax),%eax ; resolve pointer-pointer
0x0804843c <main+17>: mov %eax,(%esp) ; store at address of esp
0x0804843f <main+20>: call 0x80483f4 <vuln>
...
0x080483fa <vuln+6>: movl $0x0,-0xc(%ebp)
0x08048401 <vuln+13>: mov 0x8(%ebp),%eax
0x08048404 <vuln+16>: mov %eax,0x4(%esp)
0x08048408 <vuln+20>: lea -0x4c(%ebp),%eax ; load address of target buffer
0x0804840b <vuln+23>: mov %eax,(%esp) ; load address of second argument
0x0804840e <vuln+26>: call 0x8048300 <sprintf@plt>
0x08048413 <vuln+31>: mov -0xc(%ebp),%eax
0x08048416 <vuln+34>: cmp $0xdeadbeef,%eax
0x0804841b <vuln+39>: jne 0x8048429 <vuln+53>
0x0804841d <vuln+41>: movl $0x8048510,(%esp)
0x08048424 <vuln+48>: call 0x8048330 <puts@plt>
...

So this program takes a startup argument. This input is then utilized in the sprintf at 0x0804840e. So to exploit this sample we have to perform a format string attack. The format string variable is located at EBP-0x4c. The variable for the challenge relevant comparison is located at EBP-0xc. So we need to write 64 bytes to align the payload of 0xdeadbeef. To write 64 bytes the format string expression %64x will suffice. Finally, we can complete the level with the following command.

Exploit Exercises - Protostar - Stack levels

Sun, 31 Aug 2014 16:07:14 +0200

Exploit-Exercises: Protostar

For this scenario we need to overwrite the stack variable $modified. To get a better idea about the binary a look at the assembly helps.

0x080483f4 <main+0>: push %ebp
0x080483f5 <main+1>: mov %esp,%ebp
0x080483f7 <main+3>: and $0xfffffff0,%esp
0x080483fa <main+6>: sub $0x60,%esp
0x080483fd <main+9>: movl $0x0,0x5c(%esp)
0x08048405 <main+17>: lea 0x1c(%esp),%eax ;load $buffer address into EAX
0x08048409 <main+21>: mov %eax,(%esp) ;set ESP
0x0804840c <main+24>: call 0x804830c <gets@plt> ;vulnerable funtion
0x08048411 <main+29>: mov 0x5c(%esp),%eax ;load $modified into EAX
0x08048415 <main+33>: test %eax,%eax ;Sets ZF
0x08048417 <main+35>: je 0x8048427 <main+51> ;$modified was not modified
0x08048419 <main+37>: movl $0x8048500,(%esp)
0x08048420 <main+44>: call 0x804832c <puts@plt>
0x08048425 <main+49>: jmp 0x8048433 <main+63>
0x08048427 <main+51>: movl $0x8048529,(%esp) ;target for main+35
0x0804842e <main+58>: call 0x804832c <puts@plt>
0x08048433 <main+63>: leave 
0x08048434 <main+64>: ret

In order to overwrite the $modified variable the following command is sufficient to do the task.