{"id":78,"date":"2022-07-17T22:09:23","date_gmt":"2022-07-17T22:09:23","guid":{"rendered":"http:\/\/moveax.me\/?p=78"},"modified":"2022-07-17T22:14:55","modified_gmt":"2022-07-17T22:14:55","slug":"nebula-level15-a-newbies-approach","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level15-a-newbies-approach\/","title":{"rendered":"Nebula Level15: A Newbie\u2019s Approach"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Until now, level15 was the challenge that took me more time to solve. I was really stuck, because there was a lot of subjects new for me and it took me a little bit to get comfortablewith them. Level15 is the next level of&nbsp;<a href=\"nebula-level13\/\">level13<\/a>&nbsp;challenge.<br>Now, I\u2019m ready to write about this exercise, so let\u2019s dig in.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What you\u2019ll need to know\u2026<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>C language<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Level15<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When we strace the flag15, as suggested in the&nbsp;<a href=\"\">main page<\/a>&nbsp;of the exercise, we are able to see that flag15 program tries to locate and access a libc.so.6 file.<br>We can also use the objdump command, which will show us information related to the object file flag15.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/objdump_rpath.png\" alt=\"objdump_rpath\" class=\"wp-image-780\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><br>From this output, we can conclude that our program requires&nbsp;<em>libc.so.6<\/em>&nbsp;and will try to load this library from the directory present in the&nbsp;<a href=\"https:\/\/en.wikipedia.org\/wiki\/Rpath\">RPATH<\/a>, \/var\/tmp\/flag15. Fortunately, we can write to this folder, so let\u2019s keep this in mind. Also, if we go to this directory, we\u2019ll find that it\u2019s empty.<br>Now, if we\u2019re going to write our own libc.so.6 shared library we need to know the functions that the program flag15 will use.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/objdump.png\" alt=\"objdump_functions\" class=\"wp-image-781\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">I\u2019ll create a C file, where I\u2019ll include two of this functions.&nbsp;<em>libc_start_main<\/em>&nbsp;will contain the core code to exploit the level15 challenge. Originally,&nbsp;<em>libc_start_main<\/em>&nbsp;is a function that belongs to&nbsp;<em>libc.so.6<\/em>, responsible for setting up the environment for our process and, after that, call main function.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/exploitc.png\" alt=\"exploit.c\" class=\"wp-image-782\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><br>We\u2019ll also need to provide a version file.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/version.png\" alt=\"version\" class=\"wp-image-783\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><br>To compile our malicious library, just run the command&nbsp;<em>gcc -fPIC -shared -static-libgcc -Wl,\u2013version-script=version,-Bstatic -o libc.so.6 exploit.c<\/em>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If we run the flag15 program, and as we saw in the strace output, it should go look for the libc.so.6 shared library in the \/var\/tmp\/flag15 folder, and when it does, it\u2019ll find our malicious library.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s now run the flag15 program and see what happens.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/solution_level15.png\" alt=\"Solution level15\" class=\"wp-image-784\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Solved!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Challenges completed: 16\/20<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Mitigation<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">First thing, and as stated before, be very careful with SUID programs. Second, there is the possibility of using a secure loader. Finally, I found&nbsp;<a href=\"https:\/\/blogs.oracle.com\/solaris\/changing-elf-runpaths-code-included-v2\">this<\/a>&nbsp;solution that can also reveal useful.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Walkthrough<\/strong><\/h2>\n","protected":false},"excerpt":{"rendered":"<p>Until now, level15 was the challenge that took me more time to solve. I was really stuck, because there was a lot of subjects new&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level15-a-newbies-approach\/\">Continue reading<span class=\"screen-reader-text\">Nebula Level15: A Newbie\u2019s Approach<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,1],"tags":[],"class_list":["post-78","post","type-post","status-publish","format-standard","hentry","category-nebula","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/78","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/comments?post=78"}],"version-history":[{"count":2,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/78\/revisions"}],"predecessor-version":[{"id":92,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/78\/revisions\/92"}],"wp:attachment":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/media?parent=78"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/categories?post=78"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/tags?post=78"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}