Skip to content

Latest commit

 

History

History
67 lines (49 loc) · 1.85 KB

Day13-CoalforChristmas.md

File metadata and controls

67 lines (49 loc) · 1.85 KB

Day 13 - Coal for Christmas

Date: 13, December, 2020

Author: Dhilip Sanjay S

Kernel Exploits

  • Dirty COW (Copy-On-Write) - CVE-2016-5195
    • A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings.
    • An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system.
  • Dirty COW - C code
    • To get password input using C: getpass("<Prompt message>") in <unistd.h> header.

Solutions

What old, deprecated protocol and service is running?

  • Answer: Telnet

What credential was left for you?

  • Answer: clauschristmas
  • Steps to Reproduce: telnet <MACHINE_IP> <PORT_FROM_NMAP_SCAN>

What distribution of Linux and version number is this server running?

  • Answer: Ubuntu 12.04
  • Steps to Reproduce: cat /etc/*release

Who got here first?

  • Answer: grinch
  • Steps to Reproduce: cat cookies_and_milk.txt

What is the verbatim syntax you can use to compile, taken from the real C source code comments?

  • Answer: gcc -pthread dirty.c -o dirty -lcrypt

What "new" username was created, with the default operations of the real C source code?

  • Answer: firefart

What is the MD5 hash output?

  • Answer: 8b16f00dd3b51efadb02c1df7f8427cc
  • Steps to Reproduce: 
    firefart@christmas:/home/santa# cd /root
firefart@christmas:~# touch coal
firefart@christmas:~# tree
.
|-- christmas.sh
|-- coal
`-- message_from_the_grinch.txt

0 directories, 3 files
firefart@christmas:~# tree | md5sum
8b16f00dd3b51efadb02c1df7f8427cc