wargames

Exploit Exercises - Protostar Stack 3

2 minute read Dec 15, 2011 Comments

This challenge starts getting a little bit more involved than the previous ones. Instead of just providing a new value for the “modified” variable, we need to make the code jump to a method, changing the execution. #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h> void win() { printf("code flow successfully changed\n"); } int main(int argc, char **argv) { volatile int (*fp)(); char buffer[64]; fp = 0; gets(buffer); if(fp) { printf("calling function pointer, jumping to 0x%08x\n", fp); fp(); } } This means that first of all, we need to find the address of where the “win()” function is located in the program.

Read more wargames Protostar linux exploit-exercises hacking

Exploit Exercises - Protostar Stack 2

1 minute read Dec 14, 2011 Comments

This challenge is pretty much the same as the previous challenge, except that the buffer comes from an environmental variable. #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h> int main(int argc, char **argv) { volatile int modified; char buffer[64]; char *variable; variable = getenv("GREENIE"); if(variable == NULL) { errx(1, "please set the GREENIE environment variable\n"); } modified = 0; strcpy(buffer, variable); if(modified == 0x0d0a0d0a) { printf("you have correctly modified the variable\n"); } else { printf("Try again, you got 0x%08x\n", modified); } } This problem can simply be solved by running these commands:

Read more wargames Protostar linux exploit-exercises hacking

Exploit Exercises - Protostar Stack 1

1 minute read Dec 13, 2011 Comments

This challenge is very similar to the previous one. The main difference is that instead of just validating that the “modified” value was changed, it validates that it was changed to a specific value, 0x61626364, or “dcba” in ASCII. #include <stdlib.h> #include <unistd.h> #include <stdio.h> #include <string.h> int main(int argc, char **argv) { volatile int modified; char buffer[64]; if(argc == 1) { errx(1, "please specify an argument\n"); } modified = 0; strcpy(buffer, argv[1]); if(modified == 0x61626364) { printf("you have correctly got the variable to the right value\n"); } else { printf("Try again, you got 0x%08x\n", modified); } } To complete this, we simply run:

Read more wargames Protostar linux exploit-exercises hacking

Exploit Exercises - Protostar Stack 0

2 minute read Dec 12, 2011 Comments

I’m still working on the Nebula chain of challenges, however, I’ve been stuck on Nebula 11 for a bit now, as well as busy outside work. In the meantime, I still have other challenges that can be solved while I learn how to do more advanced ones. Protostar is another challenge made by Exploit-Exercises, the same people who brought you Nebula. Protostar Stack 0 is a very easy challenge. After doing a bunch of these challenges, and seeing nobody else doing them, I finally found someone, Mito125.

Read more wargames Protostar linux exploit-exercises hacking

Exploit Exercises - Nebula 10

4 minute read Dec 11, 2011 Comments

Challenge 10 is another nostalgic one for me. Back when I was first starting with linux, I remember reading about overflows and race conditions. This challenge is the latter, a race condition. We’re given a C/C++ app to exploit: #include <stdlib.h> #include <unistd.h> #include <sys/types.h> #include <stdio.h> #include <fcntl.h> #include <errno.h> #include <sys/socket.h> #include <netinet/in.h> #include <string.h> int main(int argc, char **argv) { char *file; char *host; if(argc < 3) { printf("%s file host\n\tsends file to host if you have access to it\n", argv[0]); exit(1); } file = argv[1]; host = argv[2]; if(access(argv[1], R_OK) == 0) { int fd; int ffd; int rc; struct sockaddr_in sin; char buffer[4096]; printf("Connecting to %s:18211 .

Read more Nebula wargames linux exploit-exercises hacking

Exploit Exercises - Nebula 09

4 minute read Dec 10, 2011 Comments

Challenge 09 gave me the most issues out of any other challenge so far. This may just be because I haven’t touched PHP since version 3 was just coming out. However, it is based on a dangerous function, known as preg_replace(). There are several more dangerous functions, some of which can be seen here. The challenge starts by giving us the source code of the program we will be exploiting.

Read more Nebula wargames linux exploit-exercises suid injection hacking

Exploit Exercises - Nebula 08

2 minute read Dec 9, 2011 Comments

Challenge 08 is more of a real-world challenge than some of the others have been. It’s also very dear to my heart, getting back to my networking roots. You are instructed simply to check out what the level08 user has been up to. This is fairly easy, since when you login as level08, you see a “capture.pcap” file in their home folder. A pcap file is a standard packet capture file format.

Read more Nebula wargames linux exploit-exercises hacking

Exploit Exercises - Nebula 07

3 minute read Dec 8, 2011 Comments

This next challenge is a little bit more tricky than some of the previous ones. There’s a lot more code involved, but it’s not too bad. In the flag07 home directory, you’ll find the configuration for a simple http server, thttpd.conf. Inside, you’ll find that it’s running an HTTP server on port 7007 as the flag07 user. This is where the perl script that is provided comes in. #!/usr/bin/perl use CGI qw{param}; print "Content-type: text/html\n\n"; sub ping { $host = $_[0]; print("<html><head><title>Ping results</title></head><body><pre>"); @output = `ping -c 3 $host 2>&1`; foreach $line (@output) { print "$line"; } print("</pre></body></html>"); } # check if Host set.

Read more Nebula wargames linux exploit-exercises suid hacking

Exploit Exercises - Nebula 06

2 minute read Dec 7, 2011 Comments

Nebula 06 is a retro challenge. The description of the problem says “The flag06 account credentials came from a legacy unix system.” This instantly made me think to check out the password file, /etc/passwd. Back in “the old days”, unix systems stored their passwords in /etc/passwd. But due to having the passwords where everyone could see them, they ended up moving towards password shadowing, where they stored the actual passwords in /etc/shadow, but kept the same user data in /etc/passwd.

Read more Nebula wargames linux exploit-exercises hacking

Exploit Exercises - Nebula 05

2 minute read Dec 6, 2011 Comments

So going forward to the Nebula 05, we now have to find some sort of weak permissions somewhere to escalate from level05 to flag05. In searching through the flag05 home directory, I saw a “.backup” folder containing a copy of the user’s old ssh keys. I extracted the archive to the level05 user’s directory, so they could be used. level05@nebula:/home/flag05$ cd .backup level05@nebula:/home/flag05/.backup$ tar -xzvf backup-19072011.tgz -C /home/level05 .ssh/ .ssh/id_rsa.pub .