If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)

Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Security Challenge IV (Experimental)

h57xiucj2z946q · 2011-05-29 10:52:51

Ok as the title says, this is just an experimental challenge I quickly threw together last night. It may not work too well, or may not work at all, so don't be too disappointed. But this challenge steers away from the other web apps kind of challenges here to try something different, which in turn I hope is pretty fun for…

Options

Comments

Options
#32 02-06-2011 2:19pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

900913 wrote: »

On the main login/create account page I tried use the name root as my account.

I think it created a user root in the home directory "/home/root", but it wouldn't let me login to ssh.

I later patched that. Original root account wouldn't be over written anyway.

0
Options
#33 02-06-2011 2:27pm
Sigtran

Closed Accounts Posts: 14 ✭

Join Date: July 2010

Posts: 14

Thanks for the challenge :pac: Damo! Hope to see more of the linux type challenges ^;;^

0
Options
#34 03-06-2011 3:13pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

Sigtran wrote: »

Thanks for the challenge :pac: Damo! Hope to see more of the linux type challenges ^;;^

Maybe Solaris/FreeBSD/NetBSB/OpenBSD.

0
Options
#35 03-06-2011 4:11pm
Sigtran

Closed Accounts Posts: 14 ✭

Join Date: July 2010

Posts: 14

it might be harder to find something in a BSD, as its default is to not give access to anything... you might find yourself having to make a custom hole in the system... this would be more of a misconfiguration, leading to an attack, then an actual vulnerability based on the mainstream libs /etc (i dono much of BSD, as it is not my system of choice, so i could be wrong here)

0
Options
#36 03-06-2011 5:13pm
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Gobbles disagrees

0
Advertisement
Options
#37 09-06-2011 5:19pm
syklops

Closed Accounts Posts: 18,966 ✭✭✭✭

Join Date: September 2004

Posts: 18753

f**k f**kity f**k f**k!

This sort of challenge I would have done well in and I missed it.

Sad Panda now.

0
Options
#38 18-08-2011 10:56am
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

Might revive this one again with some added security :-P

0
Options
#39 18-08-2011 11:45am
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

I've an idea for a challenge also Damo. Just need to code it.

0
Options
#40 18-08-2011 1:57pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

dlofnep wrote: »

I've an idea for a challenge also Damo. Just need to code it.

Cool, what area are you thinking of?

0
Options
#41 18-08-2011 2:13pm
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Eleanor Flabby Trespasser wrote: »

Cool, what area are you thinking of?

Writing a flawed application that selected people would have to exploit. I could give GCC & GDB access via a shell.

0
Advertisement
Options
#42 18-08-2011 2:18pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

dlofnep wrote: »

Writing a flawed application that selected people would have to exploit. I could give GCC & GDB access via a shell.

Or let them download the binary?

0
Options
#43 18-08-2011 2:26pm
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Eleanor Flabby Trespasser wrote: »

Or let them download the binary?

That could be an option too!

0
Options
#44 18-08-2011 2:30pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

I did something like that for windows 2k a few years back
http://www.boards.ie/vbulletin/showthread.php?p=56624243

Its pretty good fun.

0
Options
#45 18-08-2011 2:45pm
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Do you fancy hosting that challenge again? I'd be interested!

0
Options
#46 18-08-2011 2:58pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

I could look into it. Conceited hosted it last time as he was running some war games on win2k.

0
Options
#47 18-08-2011 4:34pm
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Do you still have the binary? I'd be interested in just writing an exploit for it for the craic anyway, if you can't find someone to host it. You could just evaluate the code. It should be pretty evident if it works or not.

0
Options
#48 18-08-2011 4:40pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

Yeah its posted in this thread:

http://www.boards.ie/vbulletin/showpost.php?p=56619597&postcount=169

It should be exploitable on Win 2k SP0-SP4, Win XP SP0-SP3, although DEP on XP SP3 will make it a greater challenge. Not sure about Vista SP0.

0
Options
#49 18-08-2011 6:11pm
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Eleanor Flabby Trespasser wrote: »

Yeah its posted in this thread:

http://www.boards.ie/vbulletin/showpost.php?p=56619597&postcount=169

It should be exploitable on Win 2k SP0-SP4, Win XP SP0-SP3, although DEP on XP SP3 will make it a greater challenge. Not sure about Vista SP0.

I only have a windows XP VM. I'll install it on that and have a toy with it. I wouldn't worry about DEP.

0
Options
#50 18-08-2011 6:20pm
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Just to make sure - When I run the server, it terminates before it allows me to input a name. Is that normal?

0
Options
#51 18-08-2011 6:45pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

No, it should terminate after.

0
Advertisement
Options
#52 18-08-2011 6:48pm
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Hm... Keeps terminating beforehand here. At least with putty. I tried with telnet, and it terminates after a single character. I'm guessing that the buffer is larger than 1 byte.

0
Options
#53 18-08-2011 6:52pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

dlofnep wrote: »

Hm... Keeps terminating beforehand here. At least with putty. I tried with telnet, and it terminates after a single character. I'm guessing that the buffer is larger than 1 byte.

It is yeah. Try connecting with raw in putty. Seems fine with windows telnet also.

0
Options
#54 18-08-2011 6:53pm
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Ah yeah - works fine raw I'm on the case now.

0
Options
#55 19-08-2011 4:04pm
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Exploit coded for XP SP3. Pretty straight forward. Do you want me to send you on the code?

0
Options
#56 19-08-2011 4:32pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

You can yeah, but maybe in PM, as you will see why below. You handled DEP also or disabled it?

I was thinking of hosting this again (well would re-write the server again as I no longer have the code, but its only small, like a handful of lines of code.), and the attacker could use various tools out there to assist is building an exploit.

0
Options
#57 19-08-2011 4:39pm
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

I didn't do anything with DEP. Default XP SP3 install. Will send it on in a PM.

0
Options
#58 19-08-2011 4:42pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

dlofnep wrote: »

I didn't do anything with DEP. Default XP SP3 install. Will send it on in a PM.

Strange, normally DEP prevents basic attacks, even in SP2.

0
Options
#59 19-08-2011 5:02pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

At first I thought your virtual machine wasn't supporting hard DEP through the NX bit (you can test with: http://user.cs.tu-berlin.de/~normanb/), but I have read more into it and it seems OptIn is the default configuration for Win XP, so this will only apply to some system binaries and services (in a challenge, this exe would be launched as a service, so I dunno if it applies to system services or custom ones?).

I think I will re-do this server, maybe change things around so the user will have to do more than a basic overflow with further tasks/thinking needed. That is, if there is interest for it.

0
Options
#60 19-08-2011 5:06pm
dlofnep

Closed Accounts Posts: 20,759 ✭✭✭✭

Join Date: January 2004

Posts: 19674

Always interest in a security challenge Just keep the challenge so that it's do-able. I know alot of people might not have experience with buffer overflows.. so maybe start with a new one first, and then add a second part to it at a later date? That way, you can wean people into the challenges.

Just a thought.

0
Advertisement
Options
#61 25-08-2011 2:30pm
h57xiucj2z946q

Closed Accounts Posts: 2,267 ✭✭✭

Join Date: September 2006

Posts: 2097

Setup and testing is all done. Part 5 should be up this evening all going well.

0