{"id":60,"date":"2022-07-17T22:05:09","date_gmt":"2022-07-17T22:05:09","guid":{"rendered":"http:\/\/moveax.me\/?p=60"},"modified":"2022-08-31T19:01:36","modified_gmt":"2022-08-31T19:01:36","slug":"nebula-level05-a-newbies-approach","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level05-a-newbies-approach\/","title":{"rendered":"Nebula Level05: A Newbie\u2019s Approach"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Contrary to&nbsp;<a href=\"nebula-level02\/\">previous exercises<\/a>, level05 is purely about weak permissions.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What you\u2019ll need to know\u2026<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Make an ssh connection<\/li><li>Use tar command<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Level05<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If you list the files under \/home\/flag05 folder, you\u2019ll notice two distinct hidden folders,&nbsp;<em>backup<\/em>&nbsp;and&nbsp;<em>ssh<\/em>. In order to see hidden folders, make sure you use the option&nbsp;<em>-a<\/em>&nbsp;of the&nbsp;<em>ls<\/em>&nbsp;command.&nbsp;<em>.ssh<\/em>&nbsp;folder holds information related to the connection, including keys. However, you don\u2019t have permissions to this folder, because it\u2019s owned by flag05 user.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/05\/files_view.png\" alt=\"Level05 File's\" class=\"wp-image-599\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">On the other hand, you have permissions to the&nbsp;<em>backup<\/em>&nbsp;folder and if you list the files in there, you can see a compressed file. Now, you can\u2019t extract the files in this tar to the same folder.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One thing we can try is to extract the files to another folder, one where we can write. Let\u2019s use \/home\/level05 folder and extract the files using&nbsp;<a href=\"https:\/\/linux.die.net\/man\/1\/tar\">tar<\/a>&nbsp;command to that location.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/05\/files.png\" alt=\"Files\" class=\"wp-image-601\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">If you now navigate to your level05 home directory, you will see three files inside the&nbsp;<em>.ssh<\/em>&nbsp;folder, and most importantly, all of them are owned by level05 user. These three files are the public&nbsp;<a href=\"https:\/\/en.wikipedia.org\/wiki\/RSA_(cryptosystem)\">RSA<\/a>&nbsp;key, the private RSA key and the authorized_keys.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">SSH is a protocol similar to Telnet, because it allows you to connect to a server, but in a more secure way when compared to Telnet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Maybe I can login in the flag05 account using the private key\u2026 For this I need to use the&nbsp;<a href=\"https:\/\/linux.die.net\/man\/1\/ssh\">ssh<\/a>&nbsp;command with options&nbsp;<em>-l<\/em>, to specify the name of the user and&nbsp;<em>-i<\/em>, to specify the file where the private key is located. Additionally, I need to provide the destination of the connection, which will be the current machine, localhost.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/05\/Solving_level05.png\" alt=\"Level05 Solution\" class=\"wp-image-602\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Once you\u2019re logged in, you can verify your identity (with&nbsp;<em>whoami<\/em>&nbsp;command) and proceed to collect the flag throughout the getflag command<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Challenges completed: 6\/20<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Mitigation<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Always double check permissions of your folders and files.<br>If .backup folder is a backup of ssh keys, at least, it should have the same permissions as .ssh folder. .backup folder and the backup file should have tight permission because of the sensitivity of its content.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Walkthrough<\/strong><\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Nebula Level 5-9\" width=\"500\" height=\"281\" src=\"https:\/\/www.youtube.com\/embed\/ICeUE6c7SoM?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Further Reading<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/support.suso.com\/supki\/SSH_Tutorial_for_Linux\">SSH Tutorial for Linux<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Contrary to&nbsp;previous exercises, level05 is purely about weak permissions. What you\u2019ll need to know\u2026 Make an ssh connection Use tar command Level05 If you list&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level05-a-newbies-approach\/\">Continue reading<span class=\"screen-reader-text\">Nebula Level05: A Newbie\u2019s Approach<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,1],"tags":[],"class_list":["post-60","post","type-post","status-publish","format-standard","hentry","category-nebula","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/60","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/comments?post=60"}],"version-history":[{"count":2,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/60\/revisions"}],"predecessor-version":[{"id":114,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/60\/revisions\/114"}],"wp:attachment":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/media?parent=60"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/categories?post=60"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/tags?post=60"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}