{"id":82,"date":"2022-07-17T22:10:26","date_gmt":"2022-07-17T22:10:26","guid":{"rendered":"http:\/\/moveax.me\/?p=82"},"modified":"2022-07-17T22:15:24","modified_gmt":"2022-07-17T22:15:24","slug":"nebula-level13-a-newbies-approach","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level13-a-newbies-approach\/","title":{"rendered":"NEBULA LEVEL13: A NEWBIE\u2019S APPROACH"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">I sure miss radare2, it\u2019s a fact! So, when I looked at the level13 code and realized that it hidden some token, radare2 was the first thing that came to my mind. But being honest, this will most likely be a trivial task using radare2, and I\u2019m most interested in learning something new, getting out of my comfort zone. So I went to check what others did and I found something new and fun.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What you\u2019ll need to know\u2026<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>My previous Radare2 teachings&nbsp;<img decoding=\"async\" alt=\"\ud83d\ude42\" src=\"https:\/\/s.w.org\/images\/core\/emoji\/11\/svg\/1f642.svg\"><\/li><li>Dynamic linking<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Level13<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As Lua in the&nbsp;<a href=\"nebula-level12\">previous challenge<\/a>, shared libraries on unix systems have been on my TODO list for some time now, although closer to the top :). This seems the perfect time to learn how to manipulate them.<br>The dynamic linker is what loads and links the shared libraries that some executable in runtime may need. This shared library can be manipulated through the environment variable LD_PRELOAD, which will force a specific .so file (shared library) to be loaded before every other. We can do plenty of tricks with this, including writing custom functions, as we\u2019ll do.<br>Because the problem in level13 is the getuid function, let\u2019s first create our own.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/custom_getuid.png\" alt=\"custom_getuid\" class=\"wp-image-741\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">After this, we compile the library using the command&nbsp;<em>gcc -shared -fPIC custom_getuid.c -o custom_getuid.so<\/em>&nbsp;and then we create the environment variable LD_PRELOAD using the command&nbsp;<em>export LD_PRELOAD=\/home\/level13\/custom_getuid.so<\/em>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If we go ahead and try to run the flag13 we\u2019ll still fail. One thing that the dynamic linker won\u2019t do (for security reasons) is bind shared libraries to processes\/programs with different user real IDs than ours.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/fail.png\" alt=\"fail\" class=\"wp-image-742\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">So, because the token is hard coded in the flag13 we can copy the program to level13 folder in order it be owned by us, and enabling us to link it to our library.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/files-1.png\" alt=\"Files level13 folder\" class=\"wp-image-743\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s try to run it again.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/result_level13.png\" alt=\"token\" class=\"wp-image-744\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Now, it\u2019s just a matter of login into the flag13 account using this token as a password.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/solved.png\" alt=\"Result level13\" class=\"wp-image-745\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Done!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Well, I can\u2019t resist. Let\u2019s use radare2!<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">We fire up radare2 and the first thing we need to check is the functions present.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/functions.png\" alt=\"afll\" class=\"wp-image-747\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><br>After this, we seek to the main function and change to Visual mode. In here, we can see the getuid function being called. We can also see the eax register being compared to 1000. So let\u2019s put a breakpoint there and force the result of the comparison yield true.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/dr_eax.png\" alt=\"dr eax\" class=\"wp-image-748\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><br>Now we put another breakpoint on the instruction before the print of the message \u201cyour token\u2026\u201d (0x080485d0) and run the dc command. In here, we can see eax has the string \u201cyour token\u2026\u201d so edx will have our token.<br>We can confirm this by reading the first 36 bytes of edx.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/px_edx.png\" alt=\"Solution level13\" class=\"wp-image-749\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><br>There we have it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If we check all strings, we will notice this one&nbsp;<em>8mjomjh8wml;bwnh8jwbbnnwi;&gt;;88?o;9ob<\/em>, which has the same size as our token. Also, between the instructions 0x08048595 and 0x080485c1 we can see every byte being XORed with 0x5a (90 in decimal) in instruction 0x080485a2. So the hard coded token was \u201cencrypted\u201d by a XOR\u2026<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/06\/xor.png\" alt=\"XOR\" class=\"wp-image-750\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Challenges completed: 14\/20<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Mitigation<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Use strong crypto libraries? Don\u2019t hard code passwords?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Walkthrough<\/strong><\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-4-3 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"Nebula Level 10-14\" width=\"500\" height=\"375\" src=\"https:\/\/www.youtube.com\/embed\/xGOqq_6blPo?start=385&#038;feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Further Reading<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"http:\/\/www.goldsborough.me\/c\/low-level\/kernel\/2016\/08\/29\/16-48-53-the_-ld_preload-_trick\/\">The LD_PRELOAD trick<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>I sure miss radare2, it\u2019s a fact! So, when I looked at the level13 code and realized that it hidden some token, radare2 was the&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level13-a-newbies-approach\/\">Continue reading<span class=\"screen-reader-text\">NEBULA LEVEL13: A NEWBIE\u2019S APPROACH<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,5,1],"tags":[],"class_list":["post-82","post","type-post","status-publish","format-standard","hentry","category-nebula","category-radare2","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/82","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/comments?post=82"}],"version-history":[{"count":1,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/82\/revisions"}],"predecessor-version":[{"id":83,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/82\/revisions\/83"}],"wp:attachment":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/media?parent=82"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/categories?post=82"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/tags?post=82"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}