Sinisterly
Tutorial [TUT] ~ BlackBox Wargame | Level 1 | Challenge - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.li/Forum-Tutorials)
+--- Thread: Tutorial [TUT] ~ BlackBox Wargame | Level 1 | Challenge (/Thread-Tutorial-TUT-BlackBox-Wargame-Level-1-Challenge)

[TUT] ~ BlackBox Wargame | Level 1 | Challenge - Zayne - 03-24-2014

Blackbox is compromised of a variety of challenges, ranging from RE to standard vulnerability issues.
- Blackbox

Let's get started.
Connect to the wargame by using SSH.
Connect info is at the site.

However.
PHP Code:
ssh -l level1 blackbox.smashthestack.org -p 2225 level1

I now assume you're connected to the wargame, and you'll get this info as I displayed below. Note: It's a plus if you have extra experience with Reverse engineering, the CLI, GDB and ofcourse ASM knowledge Biggrin.
INFO:
Code:
Levels are in the /home dir. All code goes into /tmp. Levels 1-8 are working. Beat level 8 and you will gain level 9 privs and win. Tags are in /home/tags/. You can only tag at the level you are at. They can be seen online at the main page, http://blackbox.smashthestack.org:85/
So let's try some basic methods. We will see if the program itself are linked to
"etc/shadow" or etc/passwd.
etc/passwd is basically just a textdocument database, which stores credentials about users who might have logged in to the system itself.
Etc/shadow contains encrypted passwords.
Read more 'bout it here:
http://www.cyberciti.biz/faq/understanding-etcshadow-file/
So let's see if it's truly linked to etc/passwd or etc/shadow.
Execute the following command in the CLI.
Code:
./login2
Code:
level1 level1
That didn't work, and will just give us "invalid username or password", so let's try
Code:
level2 level2
Which didn't worked either, so now we can assume that the program itself am not linked to etc/passwd nor etc/shadow.
Code:
level1@blackbox:~$ file login2 login2: setuid ELF 32-bit LSB [u]executable[/u], Intel 80386, version 1 (SYSV), for GNU/Linux 2.4.1, statically linked, for GNU/Linux 2.4.1, not stripped level1@blackbox:~$
It's always easier to exploit something if we have the source in our hands, let's try to obtain the source and work out from there.
We gathered some information about the file above and as you can see the file looks like it's executable (Look at the under-lined word).
As I showed above it's a plus if you know how to use GDB and do reverse engineering, as we need to do some reverse engineering in order to figure out which/what string the program will use for the passwords and usernames.

So to debug the program using GDB do
Code:
gdb file
And we want to get through the login to get to next challenge (Challenge 2).
So in this case the file is called "login2", and as we mentioned above the file is probably executable, so it should go fine to run it as well but.
Let's debugg the program using
Code:
gdb login2
This will display the "dumb of the assembler code".
Code:
disass main
Code:
Dump of assembler code for function main: 0x0804827a <main+0>: lea 0x4(%esp),%ecx 0x0804827e <main+4>: and $0xffffff0,%esp 0x08048281 <main+7>: pushl 0xffffffc(%ecx) 0x08048284 <main+10>: push %ebp 0x08048285 <main+11>: mov %esp,%ebp 0x08048287 <main+13>: push %ebx 0x08048288 <main+14>: push %ecx 0x08048289 <main+15>: sub $0x30,%esp 0x0804828c <main+18>: lea 0xffffff4(%ebp),%eax 0x0804828f <main+21>: mov %eax,(%esp) 0x08048292 <main+24>: call 0x8072ec0 <_ZNSsC1Ev> 0x08048297 <main+29>: lea 0xffffff0(%ebp),%eax 0x0804829a <main+32>: mov %eax,(%esp) 0x0804829d <main+35>: call 0x8072ec0 <_ZNSsC1Ev> 0x080482a2 <main+40>: movl $0x80ffe48,0x4(%esp) 0x080482aa <main+48>: movl $0x8130f60,(%esp) 0x080482b1 <main+55>: call 0x806d8f0 <_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc> 0x080482b6 <main+60>: lea 0xffffff4(%ebp),%eax 0x080482b9 <main+63>: mov %eax,0x4(%esp) 0x080482bd <main+67>: movl $0x8130ec0,(%esp) 0x080482c4 <main+74>: call 0x806b2e0 <_ZSt7getlineIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RSbIS4_S5_T1_E>
This probably look confusing as fuck to you, but no worries. You'll solve this in a minute of work.
So if you know asm you will probably know what these functions does and how they work.
PHP Code:
<_ZNSsC1Ev>
PHP Code:
<_ZNSsC1Ev>
PHP Code:
<_ZSt7getlineIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RSbIS4_S5_T1_E>
So we have three for (call(s) which is what you're supposed to look for.
But as we can see it exist two of the same.
PHP Code:
<_ZNSsC1Ev>
PHP Code:
<_ZNSsC1Ev>
As it's two of these, I find it more likely to be the other one.

PHP Code:
<_ZSt7getlineIcSt11char_traitsIcESaIcEERSt13basic_istreamIT_T0_ES7_RSbIS4_S5_T1_E>
This function is printf. "Writes the C string pointed by format to the standard output (stdout). If format includes format specifiers (subsequences beginning with %), the additional arguments following format are formatted and inserted in the resulting string replacing their respective specifiers."
Source

PHP Code:
call 0x806d8f0 $1 = 134666480

PHP Code:
x/1s 0x080ffe48 0x80ffe48 <_IO_stdin_used+4>: "Username: "

PHP Code:
call 0x806b2e0 $2 = 134656736
PHP Code:
x/1s 0x080ffe5e 0x80ffe5e <_IO_stdin_used+26>: "level2"
PHP Code:
x/1s 0x080ffe65 0x80ffe65 <_IO_stdin_used+33>: "PassFor2" ./login2 username: ***** password: *****
[Image: D2whnm4.png]
Tutorial not fully done yet, but will write the last parts when I get timeWink.

RE: [TUT] ~ BlackBox Wargame | Level 1 | Challenge - rootaccess - 04-21-2014

dude thanks alot for this share.
i also love challenges like this
i learned alot from this thanks man !

RE: [TUT] ~ BlackBox Wargame | Level 1 | Challenge - Zayne - 04-21-2014

No problems , glad you liked it.Smile

RE: [TUT] ~ BlackBox Wargame | Level 1 | Challenge - rootaccess - 04-21-2014

(04-21-2014, 11:14 PM)Zayne Wrote: No problems , glad you liked it.Smile

dude sometimes on this one
you get resource errors :

i also found this one :

http://overthewire.org/wargames/

you might want to add that one to ur thread Biggrin