This will be my last something awesome for the semester, as our something awesome videos are due on Tuesday, which is in 3 days. Iâll be doing this one early so that I have time to create the video as well, averaging 6 posts over the last 6 weeks, completing an average of 1-2 challenges per week.
First up, I shall choose the challenge shellshock, with the description talking about bash and the shellshock news. We start it up as usual, sshing in and taking a look at what we got. We have the following files: bash, flag, shellshock and shellshock.c. This appears to have an extra bash file compared to the usual setup. But lets dive into the source code and have a look at it first:
This was a lot smaller than I expected, with it calling setresuid and setresgid, then calling the system function, which echos out shock_me. Interesting. Looking up setresuid and setresgid, I find out that they are used to set user and group id. The 3 arguments are real, saved and set ID respectively. Getegid returns the effective group id. It looks like we are setting all the user and group ids to the effective group id.Â
Since I get a bit stuck, I decide to look up shellshock and see what it was about in the news. I find that shellshock is actually a bug that allowed Bash to execute commands. Now things are starting to make a bit more sense, I probably need to use the vulnerability like shellshock. Reading about the vulnerability on the wikipedia page, we get env x=â() { :;}; echo vulnerableâ bash -c echo this is a test.Â
Let me see if that works in our terminal. Yep, it works exactly as stated in the wiki, in which case I just need to modify it slightly to get the flag and it should give me what I need! Iâm not sure what all the setting of uid and gid was actually for, but I guess I didnât need to worry about it in this challenge.
After testing a few different variations and reading up a bit more on how exactly the vulnerability works, I end up with env x='() { :; }; /bin/cat flag' ./shellshock, which works! This gives me the flag only if I knew CVE-2014-6271 ten years ago..!!
Onto the last challenge! I will be doing lotto, with the description talking about a lotto program. Sounds interesting. Setting it up the usual way with SSH, we get the following files: lotto.c, lotto and flag. Back to the usual setup. Lets get straight into it and look at the source code. The code was actually really long, so Iâll separate it into the important parts.
Basically, the code was a lotto game, with a main, play and help function. The main function acts as the main menu where we can choose from Play, Help or Exit as seen below:
This seemed clear enough. Next up was the help function, which describes the objective of the game and provides a link for more details which didnât really help since it looked like the rules for a lotto in Korea, so it was all written in English. I donât think I need it anyway.
Lastly and most importantly was the play function, where all the logic occurred. Basically, I had to input my 6 bytes and hoped that it matched the 6 lotto numbers, winning the game and printing out the flag. Lets start by analysing the code line by line as usual and seeing if we can spot any errors, as theres no got to be some vulnerability in this code that I can abuse.
Looking at this section, I noticed a couple of funny things. Firstly, lotto[6] is an unsigned char, which means that it will be a character and not an integer. Secondly, in the for loop we can see that the numbers have to be between 1 and 45 as explained. This means that it will only be a character with the ascii value between 1 and 45. Looking at the ascii table, we can only use the characters from 32-45 which are symbols such as !#$%.
The next part that is kinda weird, is that in order for us to win, we need match == 6. But if we look at this double for loop, we can see that we check each value of the lotto against all 6 values of submit. If the lotto was 123456 and we submitted 222222, it would compare 1 to all 6 2â˛s, then it would compare the 2 with all 6 2â˛s. This would result in matching increasing 6 times and hence finishing the challenge. This means that we just need to input 6 values the same that are between the char values of 32-45 and hope we match 1 of the 6 random generated ones. Guessing !!!!!! a few times and praying to RNGesus, we get the flag sorry mom... I FORGOT to check duplicate numbers... :(.