3

There was a question in one of quiz conducted one year back. I was attempting to solve this question and got stuck. All the other were programming related but this one was a Unix file permissions related Stuff. Following is the scenario.

You will be given a login and a password to a SSH server. ssh your-username@server-addr

Your task is to look for a file named /home/abc/chekme and retrieve the contents.

When logged in to the ssh remote server doing an ls -l shows 0 files, which shows that the login given has no permissions but on doing ls -l for the above mentioned file it can be seen that Read permission is given to the root user and a group and the name of the group is chekme.

I can't read the file because I don't have the permission and am not a member of that group. On exploring the /etc/group file I found out that there is a group named chekme and only one user is added to that group. The user name is guest

From here I tried changing my guid to that of the group, adding myself to the group, doing a su as the user guest but none of it worked since the first two required root access and su to guest required the password of that user.

How do I proceed now ?

Actual question with login creds :

File : /home/hacker-weekly/abacus

So, you have to read the file '/home/hacker-weekly/abacus' and submit the file content here.

If you haven't got your login credentials, get it by clicking on the button 'Get Login Credential' below. Then you can login into the machine by running following command:

ssh "your-username"@"server-addr"

Hint: Think all about file permission in a UNIX-based system.

Login credentials Server: ec2-175-41-164-254.ap-southeast-1.compute.amazonaws.com Username: ashwinscongo Password: ab12d6H

The group name is abacus, the user in that group is guest. Tried /etc/passwrd, couldn't make out anything.

closed as too broad by slm, Anthon, bahamat, rahmu, manatwork Sep 26 '13 at 8:35

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Obviously i do not have sudo or root access. – AshwinKumarS Sep 20 '13 at 17:47
  • User guest's password is often guest or blank. Did you try that? – terdon Sep 20 '13 at 17:48
  • yup. Its neither blank nor guest. My another doubt is is it the useual guest user or could it be a user created with the name of guest ? – AshwinKumarS Sep 20 '13 at 17:50
  • 1
    @Tobu If the sticky and directory bits aren't relevant, and the file is not executable, I can only think of the special setuid and setgid bits. Are they relevant to the puzzle? Here, someone said they solved it by logging into guest, "a tricky part", and "not really relevant to the above discussion about permissions". – raehik Sep 20 '13 at 20:17
  • 2
    Meta discussion: Is solving a CTF too localized? Solving this exercise isn't directly about file permissions. This question isn't useful except to someone solving this CTF. – Gilles Sep 21 '13 at 0:05
6

Approach:

$ ls -l /home/hacker-weekly/abacus
-r--r----- 1 root abacus 373 Nov 12  2012 /home/hacker-weekly/abacus
$ id
uid=1554(gilles) gid=1555(gilles) groups=1555(gilles)

So we need to either gain root permissions or gain abacus group permissions. But how?

Hint (step 1): How do you elevate privileges?

Full solution (step 1):

Look for setuid or setgid executables that shouldn't be there:
    find / -xdev -perm /4000 -ls 2>/dev/null
There are two likely candidates: /usr/local/abacus and /usr/bin/hacker-weekly-abacus. Running the latter prints out an SSH private key.

Hint (step 2): The obvious way to use this file is to log into some other account. Which account?

Full solution (step 2):

Look through /etc/passwd and see what accounts are present (other than the system accounts and the participants). Look in /etc/passwd and /etc/group to find members of the abacus group. There's just guest.
So copy the private key to ~/.ssh/id_rsa, set the permissions correctly, and ssh guest@localhost. Bingo.


<advertisement>

If you like this kind of stuff, we participate in capture-the-flag competitions as the sec.se (Security Stack Exchange) CTF team (see the meta post for organizational details). There's more web, reverse engineering and crypto involved than unix though.

  • Nice Gilles, I figured it out too! – slm Sep 21 '13 at 0:13
  • @Gilles I did not see your solution until i did it. Thanks for keeping it on mouse over :) Nice. And i guess i cant join your group. I lack reputations :) will grow up someday ;) and i like more of crypto stuff too. Ever laid hands on stego ?? – AshwinKumarS Sep 21 '13 at 6:32
2

The original problem statement is here, http://www.hackerearth.com/problem/algorithm/hack-unix/.

In looking at this problem, I do not believe there is any method for gaining access to the file via the permissions. After logging in:

$ cd /home/hacker-weekly/
$ ls -la
total 28
drwxr-xr-x   2 hacker-weekly hacker-weekly  4096 Nov 12  2012 .
drwxr-xr-x 556 root          root          20480 Sep 20 19:30 ..
-r--r-----   1 root          abacus          373 Nov 12  2012 abacus

From what I know of permissions (Unix) and filesystems there is no straightforward way to gain access to this file because of these permissions. The permissions are telling us that you either (1) have to gain access to root or (2) gain access to an account that has access to the group abacus.

Exploring the Group angle

In looking at this group I noticed to following in the /etc/passwd and /etc/group files:

/etc/passwd

$ grep -E "ashwinscongo|guest|abacus" /etc/passwd
guest:x:1001:1001::/home/guest:/bin/sh
.guest:x:1436:1437::/home/.guest:/bin/bash
ashwinscongo:x:1544:1545::/home/ashwinscongo:/bin/bash

/etc/group

$ grep -E "ashwinscongo|guest|abacus" /etc/group
guest:x:1001:
abacus:x:1004:guest
.guest:x:1437:
ashwinscongo:x:1545:

So it would seem that we need to gain access to the guest account.

sudo?

We have no sudo privileges.

$ sudo -l
[sudo] password for ashwinscongo: 
Sorry, user ashwinscongo may not run sudo on ip-10-144-3-172

Logging into guest

I can only conceive of a frontal assault at this point so I tried the top most 25 password from 2012, along with:

  • guest
  • abacus
  • ab12d6H
  • tseug
  • Abacus

None of which worked.

Other angles?

  1. Find an executable that has it's permissions such that it either (1) executes as root or (2) executes as guest (setuid/setgid files)!
  2. Gain access to guest
  3. Exploit a trust relationship of some sort for ssh? (ssh guest@localhost) angle?

Actual solution

It took a bit but I figured it out. My username is slmingol. Apparently Gilles figured it out too!

If you poke around on the box looking for executables you'll find everything that you need. Now that I know how to do it it's best if you figure it out on your own.

The hint regarding permissions is relevant only in the sense that you need to gain privileges. The other clue you'll find if you google around is also apt about ssh'ing into the guest account. I encourage you to stick with it and don't cheat by looking at @Gilles clues/answer.

If you're really stuck I can give you some additional hints without spoiling it!

  • @slim thanks for the hints. I appreciate it that the answers werent given away. Hints are good enough :) I ll try not to look into giles's solution and go ahead myself – AshwinKumarS Sep 21 '13 at 4:51
  • @0v3rc10ck3d - Good luck and don't give up. Let me know if you'd like an additional hint. – slm Sep 21 '13 at 4:54
  • @slim : Sure :) I googled around a bit about ssh into guest accounts. I knew about the RSA keys with ssh. will try to exploit that. – AshwinKumarS Sep 21 '13 at 4:55
  • @0v3rc10ck3d - continue to focus on the files on the system. – slm Sep 21 '13 at 5:03
  • @slim : here is what i did. explored all the files in /usr/bin. Most of the executables were linux commands theere was one which wasnt. On running that file i got a RSA private key. I copied that private key and replaced mine with it in my .ssh folder. I tried using -i option with SSH to use the modified private key and log into guest. again asks for password. Kinda stuck now :| just wondering abt the public key. – AshwinKumarS Sep 21 '13 at 6:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.