Login notifications, pam_exec scripting

If you like monitoring, you might want to receive notifications at every (or only root) login, in addition to logs.

/etc/profile, bashrc, etc.

One can first think of a script in /etc/profile - I saw that solution on many websites - but it is wrong because the user can connect with ssh /bin/sh and it will not run any login script. Also, this kind of login does not appear in last/wtmp but only in auth.log by sshd (because it's not considered as an "interactive login").

Exec race condition exploitations

I recently learned a cool technique for exploiting exec race conditions. It was mentioned in a comment by Julien Tinnes about the 2009 pulseaudio vulnerability in Linux, and more recently by Tavis Ormandy (@taviso) about the GNU C library dynamic linker expanding $ORIGIN in setuid library search path vulnerability. I am sure that many people know this for ages, but still it was new to me and I thought it was worth a small post on it.

Hack.lu CTF - Challenge 19 "magicwall" writeup, double strcpy

I did not solve challenge 19 "magicwall" during the CTF - my friend Ivanlef0u (@Ivanlef0u) did - but since Fluxfingers (@fluxfingers) kept the CTF online, I had the chance to pwn it too! Just like challenge 20 "sscat", it was binary exploitation.

Hellman (@hellman1908) already made a very good writeup, I just wanted to share my different method.

Hack.lu CTF - Challenge 9 "bottle" writeup, extracting data from an iodine DNS tunnel

Challenge #9 entitled "bottle" was original and worth its 500 points. We were given the following network capture and instructed to find a message.

Opening the capture in Wireshark reveals a lot of DNS traffic (and 4 ARP requests): it definitely looks like a DNS tunnel.

Hack.lu CTF - sscat writeup

Last week was hack.lu 2010 security conference as well a high quality CTF organized by fluxfingers CTF team. Again I played with Nibbles and we ended 2nd as you can see on the final scoreboard and my usual graphs (made possible thanks to fluxfingers).

Challenge 20 was a very nice exploitation level. We were given an SSH with a setuid binary called sscat (standing for Serious Substition Cipher Analysis Tool) - with source. We had to exploit the program in order to read the flag file.

CSAW CTF - Forensics Write-up

The forensics challenge given at CSAW CTF weren't exactly what I was expecting, but still we achieved to solve most of it. Here are my write-ups for the 4 challenges.

Challenges were made by Efstratios Gavas (@xtrat), Director of cyber security labs at NYU Poly! Awesome :)

CSAW Exploit 3 Write-up - FreeBSD local root

For exploit3, we were given the following instructions:

Get Root. Get the key. If only I can jump over the mountain without being normal
ssh://128.238.66.100:40010
chal3:$+1zX*(
2048 51:41:94:32:cf:b1:3f:d9:74:c1:d2:08:aa:e3:49:2b /etc/ssh/ssh_host_rsa_key.pub (RSA)
1024 22:7f:72:93:93:7e:9a:3d:01:b9:58:ea:74:1a:c5:af /etc/ssh/ssh_host_dsa_key.pub (DSA)

Vulnerable FreeBSD kernel

We ssh and notice an old FreeBSD kernel. We can try to use @kingcope's freebsd sendfile cache local root. Sadly it does not work out of the box because we do not have /tmp writable: we have to customize a bit the shellcode to use a different one. Also, we can remove the 64-bit part since we are on 32-bit.

CSAW Exploit 1 Write-up - FreeBSD remote stack based buffer overflow

A few weeks ago was held Leet More CTF where Nibbles ended 1st! Didn't have the time to put some write-ups, but you can find some on nibbles blog or by sh4ka, auntitled and hellman.

Last week-end was held the well-known CSAW CTF (quals) by NYU-Poly. Last year and this year winners are none but our awesome friends PPP! We took 2nd place just behind them, see top15 graph.

They gave us interesting exploit challenges and I had the opportunity to look at exploit1: a remote stack based buffer overflow under FreeBSD 8.0.

Free secondary DNS services

If you run an authoritative DNS server and serve your own zones you may know about the need to have decent secondary DNS servers, or "slaves", to back you up. I recently changed mine, followed recommendations by Frankb's page and found new ones.

August 2019 update: so far these are great, so passing the word.

• puck.nether.net: simple, IPv4+IPv6, supports DNSSEC, 1 location; fairly quick to update usually, but had troubles recently (2019-08) so I removed it
• freedns.afraid.org: simple, IPv4, supports DNSSEC, 1 location; a bit slow to update, sometimes times out, but otherwise stable for years
• BuddyNS: fancy, but DNSSEC support is not free, so no
• 1984hosting: simple, IPv4+IPv6, supports DNSSEC, 3 NS; new one I'm trying, so far so good, fast to update

Process list with /proc -r

You may already have encountered this small issue, you are on a system and want to list processes but /proc has no read permission so you cannot list entries. Does it stop us? No, obviously we can iterate all possible pids and check for /proc/<pid>/ directory.

In shell we can get a simple process list with:

$ for P in $(seq 1 32168); do
  [ -d "/proc/$P" ] || continue
  echo "$P: $(cat /proc/$P/cmdline 2>/dev/null |sed 's/\x00/ /g')"
done
1: init [2]
1423: -bash
[...]

But what if we want more information, just like ps from procps gives us?