Matt Andreko

Exploit Exercises - Protostar Stack 1

1 minute read Dec 13, 2011 Comments

This challenge is very similar to the previous one. The main difference is that instead of just validating that the “modified” value was changed, it validates that it was changed to a specific value, 0x61626364, or “dcba” in ASCII. #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h> int main(int argc, char **argv) { volatile int modified; char buffer[64]; if(argc == 1) { errx(1, "please specify an argument\n"); } modified = 0; strcpy(buffer, argv[1]); if(modified == 0x61626364) { printf("you have correctly got the variable to the right value\n"); } else { printf("Try again, you got 0x%08x\n", modified); } } To complete this, we simply run:

Read more wargames Protostar linux exploit-exercises hacking

Exploit Exercises - Protostar Stack 0

2 minute read Dec 12, 2011 Comments

I’m still working on the Nebula chain of challenges, however, I’ve been stuck on Nebula 11 for a bit now, as well as busy outside work. In the meantime, I still have other challenges that can be solved while I learn how to do more advanced ones. Protostar is another challenge made by Exploit-Exercises, the same people who brought you Nebula. Protostar Stack 0 is a very easy challenge. After doing a bunch of these challenges, and seeing nobody else doing them, I finally found someone, Mito125.

Read more wargames Protostar linux exploit-exercises hacking

Exploit Exercises - Nebula 10

4 minute read Dec 11, 2011 Comments

Challenge 10 is another nostalgic one for me. Back when I was first starting with linux, I remember reading about overflows and race conditions. This challenge is the latter, a race condition. We’re given a C/C++ app to exploit: #include <stdlib.h> #include <unistd.h> #include <sys/types.h> #include <stdio.h> #include <fcntl.h> #include <errno.h> #include <sys/socket.h> #include <netinet/in.h> #include <string.h> int main(int argc, char **argv) { char *file; char *host; if(argc < 3) { printf("%s file host\n\tsends file to host if you have access to it\n", argv[0]); exit(1); } file = argv[1]; host = argv[2]; if(access(argv[1], R_OK) == 0) { int fd; int ffd; int rc; struct sockaddr_in sin; char buffer[4096]; printf("Connecting to %s:18211 .

Read more Nebula wargames linux exploit-exercises hacking

Exploit Exercises - Nebula 09

4 minute read Dec 10, 2011 Comments

Challenge 09 gave me the most issues out of any other challenge so far. This may just be because I haven’t touched PHP since version 3 was just coming out. However, it is based on a dangerous function, known as preg_replace(). There are several more dangerous functions, some of which can be seen here. The challenge starts by giving us the source code of the program we will be exploiting.

Read more Nebula wargames linux exploit-exercises suid injection hacking

Exploit Exercises - Nebula 08

2 minute read Dec 9, 2011 Comments

Challenge 08 is more of a real-world challenge than some of the others have been. It’s also very dear to my heart, getting back to my networking roots. You are instructed simply to check out what the level08 user has been up to. This is fairly easy, since when you login as level08, you see a “capture.pcap” file in their home folder. A pcap file is a standard packet capture file format.

Read more Nebula wargames linux exploit-exercises hacking

Exploit Exercises - Nebula 07

3 minute read Dec 8, 2011 Comments

This next challenge is a little bit more tricky than some of the previous ones. There’s a lot more code involved, but it’s not too bad. In the flag07 home directory, you’ll find the configuration for a simple http server, thttpd.conf. Inside, you’ll find that it’s running an HTTP server on port 7007 as the flag07 user. This is where the perl script that is provided comes in. #!/usr/bin/perl use CGI qw{param}; print "Content-type: text/html\n\n"; sub ping { $host = $_[0]; print("<html><head><title>Ping results</title></head><body><pre>"); @output = `ping -c 3 $host 2>&1`; foreach $line (@output) { print "$line"; } print("</pre></body></html>"); } # check if Host set.

Read more Nebula wargames linux exploit-exercises suid hacking

Exploit Exercises - Nebula 06

2 minute read Dec 7, 2011 Comments

Nebula 06 is a retro challenge. The description of the problem says “The flag06 account credentials came from a legacy unix system.” This instantly made me think to check out the password file, /etc/passwd. Back in “the old days”, unix systems stored their passwords in /etc/passwd. But due to having the passwords where everyone could see them, they ended up moving towards password shadowing, where they stored the actual passwords in /etc/shadow, but kept the same user data in /etc/passwd.

Read more Nebula wargames linux exploit-exercises hacking

Exploit Exercises - Nebula 05

2 minute read Dec 6, 2011 Comments

So going forward to the Nebula 05, we now have to find some sort of weak permissions somewhere to escalate from level05 to flag05. In searching through the flag05 home directory, I saw a “.backup” folder containing a copy of the user’s old ssh keys. I extracted the archive to the level05 user’s directory, so they could be used. level05@nebula:/home/flag05$ cd .backup level05@nebula:/home/flag05/.backup$ tar -xzvf backup-19072011.tgz -C /home/level05 .ssh/ .ssh/id_rsa.pub .

Read more Nebula wargames linux exploit-exercises hacking

Exploit Exercises - Nebula 04

2 minute read Dec 5, 2011 Comments

I really like Nebula 04, because it is really easy, but still a commonly missed thing in programming. The object of this challenge is to find a vulnerability and exploit this C++ program. #include <stdlib.h> #include <unistd.h> #include <string.h> #include <sys/types.h> #include <stdio.h> #include <fcntl.h> int main(int argc, char **argv, char **envp) { char buf[1024]; int fd, rc; if(argc == 1) { printf("%s [file to read]\n", argv[0]); exit(EXIT_FAILURE); } if(strstr(argv[1], "token") !

Read more Nebula wargames linux exploit-exercises hacking

Exploit Exercises - Nebula 03

2 minute read Dec 4, 2011 Comments

In this challenge, we can see that there’s no code for us to exploit, it’s something in the system. I log in to the system, and look in the /home/flag03 folder, as all the other challenges have started. I see there’s a writable.sh script, which I was guessing was the script getting called on a crontab every couple minutes. It contained: #!/bin/sh for i in /home/flag03/writable.d/* ; do (ulimit -t 5; bash -x "$i") rm -f "$i" done So this script looks like it will execute anything in the writable.