Hello all and welcome to the first posting here at Technolution.<\/p>\n
While this blog is supposed to be about computers, networking, security, and all that fun stuff, I feel like a good place to start posting would be with a wargame dissection. \u00a0For those unfamiliar with wargames, they are basically computers set up for practicing real-world computer security in a controlled and legal environment. \u00a0This provides hands on experience with the type of situations in which security researchers and hackers have found and exploited computer security vulnerabilities. \u00a0There are many types of wargames, from web interface based games to linux command-line based games, and anything in between.<\/p>\n
Today we will start off with the first level of a linux command-line based game called IO<\/a>, from the good folks over at SmashTheStack.org<\/a>.<\/p>\n Reading the IO page, it states that one should use an ssh client to connect to port 2224 of io.smashthestack.org using the login “level1” and the password “level1”. \u00a0For linux users the command is provided (and hopefully you don’t need it),\u00a0ssh -p2224 level1@io.smashthestack.org. \u00a0Windows users I suggest downloading and using PuTTy for your SSH work.<\/p>\n Quick directory listing (ls) gives a bunch of README files. \u00a0Reading through the README in our language, we learn the programs to exploit to reach the next level are in \/levels \u00a0So, we change directories to \/levels (cd \/levels) and get a listing (ls). \u00a0There are lots of files, named level01 – level29, mostly executables and some source files. \u00a0Most importantly however, we found the file level01. \u00a0Running ls -la level01 we can see two things.<\/p>\n level1@io:\/levels$ ls -la level01 One is that the file is owned by user level2 and is set to run as that user, even when someone else runs it (SUID, the “s” in the permissions listing -r-sr-x—). \u00a0Second is that the group for the file is our current group, level1. \u00a0This means that we can execute the file since the file permissions grant group reading and executing (the 5,6,7 column in the permissions string, r-x). \u00a0Excellent! \u00a0Now we just need to exploit the file!<\/p>\n First we want to see what the file does, so try to run it.<\/p>\n level1@io:\/levels$ .\/level01 Ok. \u00a0We believe the program takes one argument, a password. \u00a0It also probably checks the input-password being equal to something (how else would it know if we input the correct thing?) \u00a0So the first thing we want to do is see if the program stores any constant strings. \u00a0Luckily in linux, there is a tool to do this and we don’t have to binarily dissect the file ourselves. \u00a0The tool provided is called, dun dun dun, strings. \u00a0It’s use is straight forward, strings <filename>. \u00a0So lets see what happens when we run our level01 program through strings, looking for hard-coded, constant strings.<\/p>\n level1@io:\/levels$ strings level01 We see what we’d expect, a few hard-coded strings for libraries and for function names from libs. \u00a0But further down, towards the end, we see the strings “omgpassword” “Usage: %s <password>” “Win.” “\/bin\/sh” and “Fail.” \u00a0We’ve already seen the program use the Usage string and the Fail. string. \u00a0Obviously we probably want to see the program use the Win string and execute the \/bin\/sh string. \u00a0Now, it’s probably obvious we want to try all the strings as possible passwords, through the real password is jumping out at us (I think?). \u00a0So let’s try it, omgpassword:<\/p>\n level1@io:\/levels$ .\/level01 omgpassword Bam. \u00a0Shell as level02.<\/p>\n Moral of the story? \u00a0Hard-coded strings are readable if the file is readable. \u00a0Doesn’t matter if you have to use strings <filename> or dissect the binary data of the file, reading each sequence of bytes as chars, or anything else. \u00a0Plain text is plain text. \u00a0Constant, hard-coded strings are stored in plain text. \u00a0Thus, it’s not secure. \u00a0It may be a deterrent, but it’s not secure.<\/p>\n Well that does it for Level 1 of IO, and the first post here at Technolution. \u00a0Remember to always ask why and how something works, and if no one wants to talk about it, there’s probably a problem with it! \u00a0Also, if anyone is making new wargames, or has something fresh to approach, please leave a comment!<\/p>\n","protected":false},"excerpt":{"rendered":" Hello all and welcome to the first posting here at Technolution. While this blog is supposed to be about computers, networking, security, and all that fun stuff, I feel like a good place to start posting would be with a … Continue reading
\n-r-sr-x— 1 level2 level1 7500 Nov 16 2007 level01<\/p><\/blockquote>\n
\nUsage: .\/level01 <password>
\nlevel1@io:\/levels$ .\/level01 somepassword
\nFail.<\/p><\/blockquote>\n
\n\/lib\/ld-linux.so.2
\n__gmon_start__
\nlibc.so.6
\nprintf
\nexecl
\nputs
\nstrncmp
\n_IO_stdin_used
\n__libc_start_main
\nGLIBC_2.0
\nPTRh
\n0Y_]
\n[^_]
\n[^_]
\nomgpassword
\nUsage: %s <password>
\nWin.
\n\/bin\/sh
\nFail.<\/p><\/blockquote>\n
\nWin.
\nsh-4.1$ id
\nuid=1001(level1) gid=1001(level1) euid=1002(level2) groups=1002(level2),1001(level1),1029(nosu)
\nsh-4.1$<\/p><\/blockquote>\n