{"id":54,"date":"2022-07-17T22:04:19","date_gmt":"2022-07-17T22:04:19","guid":{"rendered":"http:\/\/moveax.me\/?p=54"},"modified":"2022-08-31T19:01:45","modified_gmt":"2022-08-31T19:01:45","slug":"nebula-level02-a-newbies-approach","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level02-a-newbies-approach\/","title":{"rendered":"Nebula Level02: A Newbie\u2019s Approach"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">I see level02 as a combination of the previous two exercises,&nbsp;<a href=\"nebula-level00\/\">level00<\/a>&nbsp;and&nbsp;<a href=\"nebula-level01\/\">level01<\/a>. Let\u2019s dig in and work through the solution.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What you\u2019ll need to know\u2026<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Basic Unix commands<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Level02<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">First, we can see that flag02 program in the \/home\/flag02 directory has the SUID bit set, which means that this program will run under the flag02 user.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">By taking a quick look at the original&nbsp;<a href=\"\">code<\/a>&nbsp;of flag02, it\u2019s very easy to identify what is most likely the vulnerability, the system function. Actually, the vulnerability is the input validation, because the environment variable USER should be sanitized in order to remove all the&nbsp;punctuation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can also notice the program is trying to read the environment variable \u201cUSER\u201d through the&nbsp;<a href=\"https:\/\/linux.die.net\/man\/3\/getenv\">gentenv<\/a>&nbsp;function so, from this simple code, we can infer that the program will output \u201c*name of user* is cool\u201d. Let\u2019s confirm.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/05\/run_level03.png\" alt=\"Run level03\" class=\"wp-image-568\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Simple. Now, imagine that instead of the user\u2019s name, USER variable had a command! This is not that straightforward.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As you are probably thinking, we can change the variable USER to something useful, but the problem is that we still have an echo command before and some text after.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So the solution for this level02 is to use chaining operators, so that USER can have multiple commands. In this case, we\u2019ll feed garbage to the echo command, insert a useful command and comment the rest.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s what I\u2019m thinking.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/05\/solution_level02.png\" alt=\"Solution of level02\" class=\"wp-image-569\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">It\u2019s crucial that you understand that the command being executed will be \u201c<em>about to call system(\/bin\/echo MOVEAXME;\/bin\/bash # is cool)<\/em>\u201c.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s see what happen when we execute flag02.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/05\/solved.png\" alt=\"level02 solved\" class=\"wp-image-570\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">We got a shell under flag02 user. Now, if you use the command getflag, you\u2019ll solve the challenge.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Of course that instead of \/bin\/bash, you could have passed the getflag command, solving the challenge right away, but I always prefer to get the shell \ud83d\ude09<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Challenges completed: 3\/20<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Mitigation<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Same advice as&nbsp;<a href=\"nebula-level00\/\">level00<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Walkthrough<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">https:\/\/youtube.com\/watch?v=hxjN-xASoaw%3Fstart%3D157%26feature%3Doembed<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Further Reading<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/www.tecmint.com\/chaining-operators-in-linux-with-practical-examples\/\">10 Useful Chaining Operators in Linux with Practical Examples<\/a><\/li><li><a href=\"https:\/\/www.owasp.org\/index.php\/Command_Injection\">Command Injection<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>I see level02 as a combination of the previous two exercises,&nbsp;level00&nbsp;and&nbsp;level01. Let\u2019s dig in and work through the solution. What you\u2019ll need to know\u2026 Basic&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level02-a-newbies-approach\/\">Continue reading<span class=\"screen-reader-text\">Nebula Level02: A Newbie\u2019s Approach<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,1],"tags":[],"class_list":["post-54","post","type-post","status-publish","format-standard","hentry","category-nebula","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/54","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/comments?post=54"}],"version-history":[{"count":2,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/54\/revisions"}],"predecessor-version":[{"id":116,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/54\/revisions\/116"}],"wp:attachment":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/media?parent=54"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/categories?post=54"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/tags?post=54"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}