Hack in the Box Amsterdam 2011 CTF

May 19th-20th was Hack in the Box Amsterdam 2011 security conference in the Netherlands, also holding a CTF. To participate, you had to qualify to one of the two qualification rounds that involved web security and reverse engineering.

We passed qualifications with team CoP so I went there with teammate sh4ka to play, and we were lucky enough to end in the first place. Congrats to all teams, it was intense! In addition to a nice HITBSecNews jacket, staff generously awarded us two training and conference tickets to HITB Kuala-Lumpur (Malaysia) 2011. So, see you there :)

final scoreboard

Ubuntu 10.10->11.04 encrypted LVM fail, rebuilding initramfs, rdinit

One of my workstations was an Ubuntu 10.10 on an encrypted LVM. I decided to upgrade to 11.04 and was unable to boot, falling back to initramfs busybox shell.

If you are not familiar with this kind of setup, it basically works with:

• a non-encrypted /boot with kernel and initramfs
• initramfs contains required modules (aes, lvm, etc.) and a few scripts to mount the filesystem: in this case, a script to ask for the password, decrypt the LVM and mount the root filesystem

From file tampering to local root

Ubuntu Security Notice USN-959-1 (CVE-2010-0832) reports that Denis Excoffier discovered a serious flaw in PAM MOTD module in Ubuntu: it does not correctly handle path permissions when creating user file stamps. For more details, just have a look at the diff.

The exploit made by Kristian Erik Hermansen allows tampering any file. From that, we can get root for example by adding a user with uid 0. We don't want an empty password because the SSH server sshd has default PermitEmptyPasswords to no. Also, we don't want to prompt the user for his password at SSH connection, so we could create a temporary SSH key and add it to authorized_keys. Also, we want to be sure we backup any file we modify. Finally, we want to remove the rogue user and restore files we modified.