{"id":56,"date":"2022-07-17T22:04:36","date_gmt":"2022-07-17T22:04:36","guid":{"rendered":"http:\/\/moveax.me\/?p=56"},"modified":"2022-08-31T19:01:40","modified_gmt":"2022-08-31T19:01:40","slug":"nebula-level03-a-newbies-approach","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level03-a-newbies-approach\/","title":{"rendered":"Nebula Level03: A Newbie\u2019s Approach"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Level03 is no longer about SUID vulnerable programs like&nbsp;<a href=\"nebula-level00\/\">previous<\/a>&nbsp;exercises, but about permissions. Because I just learn about SUID programs in the last challenges, I\u2019ll create my own in order to solve this exercise.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What you\u2019ll need to know\u2026<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Cron jobs<\/li><li>C\/Bash programming<\/li><li>Basic Unix command<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Level03<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In this challenge, we are given the information that there is a cron running every couple minutes. If you navigate to flag03 folder, you\u2019ll notice a file,&nbsp;<em>writable.sh<\/em>, which has some interesting code.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I find the code pretty straightforward, except the&nbsp;<a href=\"https:\/\/linux.die.net\/man\/3\/ulimit\"><em>ulimit<\/em><\/a>&nbsp;and&nbsp;<a href=\"https:\/\/linux.die.net\/man\/1\/bash\"><em>bash -x<\/em><\/a>&nbsp;commands. Basically,&nbsp;<em>ulimit<\/em>&nbsp;will assign the processor to this process for 5 seconds.&nbsp;<em>Bash<\/em>&nbsp;command will execute every single file\/program which is in the writable.d folder. After this, all the content of this folder is erased. One thing very important, is that all the files inside writable.d folder will be ran as flag03 user account.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, the first thing that comes to my mind, is to place there a script which will give me a shell.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So I wrote a simple script in order to get a shell.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/05\/script.png\" alt=\"script\" class=\"wp-image-576\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">In this script I\u2019m basically creating a C program, the one responsible for giving me a shell, and after that I just give full permissions to the file, compile it and set the SUID bit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Notice that I could have written the C program in a different file, avoiding this long and confusing script. But this way I get to practice my shell scripting skills (practice makes perfect, right? \ud83d\ude42 ).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After you write your script, just copy it to the writable.d folder and the cron job will execute it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now you just need to wait a \u201ccouple of minutes\u201d and then, you\u2019ll see the writable.d folder empty and a new file at \/home\/flag03.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/05\/solution-1.png\" alt=\"Solution of Level03\" class=\"wp-image-577\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Notice that&nbsp;<em>moveaxme<\/em>&nbsp;is a SUID program. Now let\u2019s execute it and see the final result.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/05\/solved-1.png\" alt=\"result\" class=\"wp-image-578\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Challenges completed: 4\/20<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Mitigation<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Running everything in a folder blindly??? C\u2019mon\u2026<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Walkthrough<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">https:\/\/youtube.com\/watch?v=hxjN-xASoaw%3Fstart%3D230%26feature%3Doembed<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Further Reading<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/crontab.guru\/\">crontab.guru<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Level03 is no longer about SUID vulnerable programs like&nbsp;previous&nbsp;exercises, but about permissions. Because I just learn about SUID programs in the last challenges, I\u2019ll create&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level03-a-newbies-approach\/\">Continue reading<span class=\"screen-reader-text\">Nebula Level03: A Newbie\u2019s Approach<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,1],"tags":[],"class_list":["post-56","post","type-post","status-publish","format-standard","hentry","category-nebula","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/56","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/comments?post=56"}],"version-history":[{"count":2,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/56\/revisions"}],"predecessor-version":[{"id":115,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/56\/revisions\/115"}],"wp:attachment":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/media?parent=56"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/categories?post=56"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/tags?post=56"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}