Rainfall is an iso challenge slightly more complex than SnowCrash. We will have to dive deep into reverse engineering, learn to reconstruct a code, and understand it to detect faults.
user: level0
password: level0
lscpu
cat /proc/cpuinfoFind a way to read the .pass file of the levelX user (X = number of the next level). .pass located at the home /home/user/levelX/.pass.
Exploit vulnerabilities in the binary of the current level to gain access to the next level. Binary are owned by the next user and have the s permission exection (set uid of owner for execution).
checksec --kernel
sysctl kernel.randomize_va_space
cat /proc/sys/kernel/randomize_va_spaceOutput (given at login):
GCC stack protector support: Enabled
Strict user copy checks: Disabled
Restrict /dev/mem access: Enabled
Restrict /dev/kmem access: Enabled
grsecurity / PaX: No GRKERNSEC
Kernel Heap Hardening: No KERNHEAP
System-wide ASLR (kernel.randomize_va_space): Off (Setting: 0)- Stack protector: Protects against stack buffer overflows (work by placing a canary)
- User copy checks: Protects against user-space memory corruption (prevent copying data between user-space and kernel-space)
- Restrict /dev/mem access: Prevents direct access to physical memory
- Restrict /dev/kmem access: Prevents direct access to kernel memory
- PaX (Patchset for X): Is an extensive security enhancement to the Linux kernel that defends against memory corruption-based exploit and other.
- Kernel Heap Hardening: Protects against heap corruption
- ASLR (Address Space Layout Randomization): Randomizes the memory addresses of the stack, heap, and libraries to make it harder for attackers to predict the location of code or data in memory.
checksec --dir .Output (given at login for level0):
RELRO STACK CANARY NX PIE RPATH RUNPATH FILE
No RELRO No canary found NX enabled No PIE No RPATH No RUNPATH level0-
RELRO (RELocation Read-Only) marks the GOT (Global Offset Table) as read-only, preventing an attacker from overwriting function pointers.
- No RELRO: The GOT is not read-only.
- Partial RELRO: The GOT is read-only, but the dynamic linker's symbol table is not.
- Full RELRO: Both the GOT and the dynamic linker's symbol table are read-only.
The GOT is a table of pointers that point to functions or variables in shared libraries. It is used to resolve addresses of functions or variables at runtime. The PLT (Procedure Linkage Table) perfoms the linking between the code and GOT.
-
Canaries helps prevent buffer overflow attacks. They are values placed on the stack that are checked before a function returns to ensure that they have not been modified by a buffer overflow.
-
NX (No eXecute) marks certain areas of memory as non-executable.
-
PIE (Position Independent Executable) means the program can load dependencies at different memory locations each time it's executed, preventing hardcoded addresses (But the offsets between parts of the program remain the same - relative addresses).
-
RPATH and RUNPATH are used to specify the directories in which the dynamic linker should search for shared libraries. (Set to for standard locations)
See how PIE, ASLR, Relro GOT and PLT works together and how it is exploitable in this article.
readelf: Displays information about ELF files, including headers, sections, and segments.objdump: Provides detailed information about object files, including disassembly of executable code.nm: Lists symbols from object files.ldd: Prints shared library dependencies of an ELF executable.strace: Tracks system calls and signals.ltrace: Tracks library calls.gdb: The GNU Debugger.checksec: A script to check the security properties of an ELF binary.strings: Prints the printable strings in an object file.file: Determines the type of an object file.hexdump: Displays the contents of an object file in hexadecimal format.xxd: A hexdump utility that can output hexdumps in a variety of formats.pwntools: A CTF framework and exploit development library.
See ROP (Return Oriented Programing) sush as Ret2Libc