[null, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/hhq-menu.png", "src": "https://mike-boya.github.io/images/sans_2015/hhq-menu.png", "formatted_filename": "hhq menu"}, null, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/victory.png", "src": "https://mike-boya.github.io/images/sans_2015/victory.png", "formatted_filename": "victory"}, null, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/netwars.png", "src": "https://mike-boya.github.io/images/sans_2015/netwars.png", "formatted_filename": "netwars"}, null, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/dosis-room.jpg", "src": "https://mike-boya.github.io/images/sans_2015/dosis-room.jpg", "formatted_filename": "dosis room"}, null, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/josh-goodwork.png", "src": "https://mike-boya.github.io/images/sans_2015/josh-goodwork.png", "formatted_filename": "josh goodwork"}, null, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/jess-dosis.png", "src": "https://mike-boya.github.io/images/sans_2015/jess-dosis.png", "formatted_filename": "jess dosis"}, null, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/xpower.png", "src": "https://mike-boya.github.io/images/sans_2015/xpower.png", "formatted_filename": "xpower"}, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/shodan.png", "src": "https://mike-boya.github.io/images/sans_2015/shodan.png", "formatted_filename": "shodan"}, null, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/tom-verify.png", "src": "https://mike-boya.github.io/images/sans_2015/tom-verify.png", "formatted_filename": "tom verify"}, null, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/gnome-arch.jpg", "src": "https://mike-boya.github.io/images/sans_2015/gnome-arch.jpg", "formatted_filename": "gnome arch"}, null, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/tom-says-no.png", "src": "https://mike-boya.github.io/images/sans_2015/tom-says-no.png", "formatted_filename": "tom says no"}, null, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/clw-desk.png", "src": "https://mike-boya.github.io/images/sans_2015/clw-desk.png", "formatted_filename": "clw desk"}, null, {"document_url": "https://mike-boya.github.io/blog/2016/03/02/sans-holiday-challenge-2015-writeup/", "unformatted_src": "/images/sans_2015/ed.png", "src": "https://mike-boya.github.io/images/sans_2015/ed.png", "formatted_filename": "ed"}, null, null]


The SANS Holiday Hack challenge this year was fantastic and I wanted to make sure to document my solutions on my blog. I have participated in the Holiday Hack Challenges since 2012, but haven’t documented them with the exception of some informal notes – maybe I should change that! Anyway, enjoy my write-up and I encourage anyone who did not participate to give it a try before reading this post!

One other note: I finally finished writing this up. It’s about a month later than I expected, but life is busy.

Part 0: Dosis Neighborhood The first step I took was to explore the Dosis neighborhood aka Holiday Hack Quest and complete all 21 achievements. As Johnny Drama would say, “VICTORY!” This game was extremely fun and incredibly detailed, I was even able to drop by NetWars and say hello to Jeff McJunkin! This was a pretty cool component to the challenge, offering mazes, riddles, and some hints for the analysis. As a huge Zelda fan, I admit that I was already very impressed even before beginning any actual hacking. My write-up is focused on the technical portions of the challenge and does not include a detailed walk-through of the game.

Part 1: Curious Wireless Packets

Josh Dosis informed us that “That gnome is not what he seemed!” and has captured some WiFi traffic from the network the gnome was on. He provided us with that capture and this is where the real fun starts.

I completed this part of the challenge before the scapy helper scripts were provided, so I just used some command-line fu:

A few notes on this:

The output was:

This answers question #1 and alludes to the answer for #2:

1) Which commands are sent across the Gnome’s command-and-control channel?

The two commands sent across the C2 channel were:

Modifying my one-liners allowed me to grab the image sent across the channel.


The result answers question #2:

2) What image appears in the photo the Gnome sent across the channel from the Dosis home? Part 2: Firmware Analysis for Fun and Profit

I navigated over to Josh Dosis in the Dosis neighborhood and provided him with watermark from the image sent over the channel. He directed me to Jess Dosis, who provided me with a firmware image and the following instructions:

“I took the liberty of disassembling the Gnome and dumped the NAND storage using my Xeltek SuperPro 6100 to a file. Can you extract a password from this data dump?”

Now I play with packet captures all day, but firmware analysis?! I decided to do some additional research and see if I could learn some new skills.

Using binwalk, I extracted the files filed found in the firmware using the -e option.

Interesting – a squashfs fileystsem, used mainly in tiny-sized and embedded Linux systems, which sounds like the gnomes. I installed squashfs-tools and used the tool unsquashfs to extract the data.

Great! We can simply look around now. Let’s run some quick commands to answer the questions:

To fully answer the second question, we need to collect some more information on the mongodb. Jess confirmed! That confirms the answers to the questions.

3) What operating system and CPU type are used in the Gnome? What type of web framework is the Gnome web interface built in?

The Gnome web interface is built in NodeJS(Express).

4) What kind of a database engine is used to support the Gnome web interface? What is the plaintext password stored in the Gnome database?

The database engine used to support the Gnome web interface is MongoDB. There are two plaintext passwords stored in the Gnome database - ‘user’ and ‘SittingOnAShelf’.

Part 3: Internet-Wide Scavenger Hunt

As we move into Part 3 the Dosis, children come to the shocking conclusion that the SuperGnomes must be scattered across the globe!

SANS also provided a great hint for this one:

This was how I located the SuperGnomes: Finally, I located Tom Hessman in the Dosis neighborhood and verified all five Super Gnome IPs. 

Even though Shodan provided me with the city and country I wanted to double-check them with ipinfo:

6) Where is each SuperGnome located geographically?

Part 4: Gnomage Pwnage

I did a quick nmap scan on each of the SuperGnomes and discovered that they each have a webserver on port 80.

7) Please describe the vulnerabilities you discovered in the Gnome firmware.


I will answer these questions below by describing my methodology to attack the SuperGnomes.


SG-01 was accessed by logging into the SuperGnome web interface on 22.214.171.124 using the admin credentials admin:SittingOnAShelf found in the mongo database in the gnome firmware. After logging in, I explored the available features and was able to download each of the files, including gnome.conf:

Vulnerability: Password Re-use
Gnome Serial Number: NCC1701 = [https://en.wikipedia.org/wiki/USS_Enterprise_(NCC-1701)]


I logged into SuperGnome-02 (126.96.36.199) with the same credentials, but when I tried to download the files was presented with an error specifying “Downloading disabled by Super-Gnome administrator.”

I quickly identified a section in /settings that was not available on SG-01 containing an upload function. This could be the attack vector we need, let’s consult the firmware to identify any vulnerabilities:

The code above was located in /www/routes/index.js. It appears that .png anywhere in the filename will satisfy the check.

I successfully uploaded a directory named “foo.png/”.

Then, I leveraged the LFI (local file inclusion) vulnerability to grab the gnome.conf.

SG-02 gnome.conf:

Vulnerability: LFI and Directory Traversal
Gnome Serial Number: XKCD988 = [https://xkcd.com/988/]


SuperGnome-03 really stumped me for awhile. I tried logging into the web portal with the same admin credentials but was denied. The user account did work, but did not have sufficient permissions. After talking to some of the individuals in Dosis neighborhood, I learned about NoSQL injection. Looking at the LOGIN POST section of the firmware confirmed my suspicions. I include that code below for reference, it was located in the /www/routes/index.js file.

The part that tripped me up was forging the Content-Type to “application/json” in order to use the $ne operator. Note: You can also use $gt here.

I constructed a POST in Burp in order to bypass the login:

After forwarding that post, I received:

Success! After logging in the web portal is similar to SG-01 and allows us to download the files we need.

SG-03 gnome.conf:

Vulnerability: NoSQL Injection
Gnome Serial Number: THX1138 = [https://en.wikipedia.org/wiki/THX_1138]


Moving on to SuperGnome-04, we are able to login with the admin:SittingOnAShelf credentials. A quick look around the menus reveals a new section under /files called “Upload New File”. It allows us to select a post-process option for the uploaded file.

Let’s look at the gnome firmware for any vulnerabilities:

There is one major problem with this section of code, that eval is very dangerous. Let’s see if we can leverage it to perform some Sever Side Javascript Injection (SSJS). Here is my input from Burp:

Replacing the “postproc” call with our readFileSync command allows us to read the contents of gnome.conf. Grabbing the pcap and image just required some encoding due to the larger file sizes.

SG-04 gnome.conf:

Vulnerability: SSJS - Server Side Javascript Injection
Gnome Serial Number: BU22_1729_2716057 = [https://en.wikipedia.org/wiki/Bender_(Futurama)]


This one got me. I knew that it involved the code provided on the other SuperGnomes, sgnet and sgstatd.

I looked at the source code and determined that there was an extra port open on SG-05.

I probed it with netcat:

Interesting. I explored each of the menu options, but did not detect anything that would assist with exploitation. Let’s take a look at the source code:

Hm, the switch statement contains an extra case. The other case values appear to refer to the decimal value of the character (1=49, 2=50, 51=3). A quick look at an ASCII chart tells us that 88 = ‘X’.

Let’s see if we can trigger the hidden menu item:

Looking at the source code, we see some interesting items:

I fired up Kali and setup a nice test lab to develop my code to exploit the buffer overflow. I grabbed the compiled version of the binary from the firmware image extract.

I like using pattern_create.rb for interacting with buffers instead of trying to guesstimate:

Let’s take a look at the sgstatd function in gdb:

It appears that the canary is a static value 0xe4ffffe4. “It’s a bold strategy, Cotton. Let’s see if it pays off for ‘em.”

First step was loading some configuration options into gdb to disable the alarm and follow the fork. I’ve included them for reference:

While testing the message “Canary not repaired.” was firing, I was able to pinpoint the canary location at 105 characters. After setting my canary value, I ran into my next challenge: ASLR. I ended up using a common bypass technique by tracking down a “jmp esp” gadget using the tool ROPgadget.py:

I fired up metasploit to craft my payload. Important note: I modified my output to remove the IP of my server. I don’t need any copy and paste “mistakes” occurring :) !

Here is my final exploit:

I started up a netcat listener on my server to catch the connection:

Nice! Next, I setup some netcat tunnels and exfiled the data located in /gnome/www/files/.

SG-05 gnome.conf:

Vulnerability: Buffer Overflow
Gnome Serial Number: 4CKL3R43V4 = [http://www.sou.edu/cs/lynnackler.html]

Just in case anyone was curious, I mentioned earlier that I did not finish SG-05 before the submission deadline. I was close, but finding the JMP ESP to bypass ASLR did not happen until after I submitted my report and finished the Netflix series. (Ha!)

I love the detail and thought put into every little part of this challenge, even the gnome serial numbers had significance.

Part 5: Sinister Plot and Attribution

Packet Capture Evidence

I obtained these packet capture from each of the SuperGnomes. I opened each one in wireshark and ‘Followed the TCP stream’ to reveal a number of emails. It is also worth noting that we were able to collect Cindy’s password from this pcap:

22.214.171.124 is the IP she connects to… Maybe next time!

Image Evidence

I collected up each of the staticky images from the SuperGnomes and used the tool Stegsolve.jar to xor the images and reveal the final image: 9) Based on evidence you recover from the SuperGnomes’ packet capture ZIP files and any staticky images you find, what is the nefarious plot of ATNAS Corporation?

After reviewing all of the evidence in the packet captures and images, we discover the nefarious plot of the ATNAS corp. Cindy Lou Who was traumatized by the witnessing the actions of the Grinch on that Christmas night. She has grown to hate Christmas and believes she can improve on the Grinch’s plan. Her plot is to distribute gnomes to as many homes as possible by Dec. 24.

The gnomes purpose is to gather information about the households, specifically the belongings in the homes. This information gathering includes taking still snapshots of the rooms they are placed in and sniffing network traffic for specific terms (outlined in sniffer_hit_list.txt). All of this info is sent to the associated SuperGnomes where it will be reviewed by ATNAS. ATNAS will use this information to organize and deploy burglars, dressed as Santa, to the homes to steal specific presents. These items will be sold and the profits will be split 50⁄50 between the ATNAS corp and the burglars.

The summary of the plan is revealed very eloquently by Cindy:

10) Who is the villain behind the nefarious plot.

As we can see in the email and photo evidence, Cindy Lou Who, President and CEO of ATNAS Corporation, is the mastermind behind the nefarious plot.


What a great challenge and amazing learning experience. I would like to blame Netflix and “Making a Murderer” for sabotaging and preventing me from solving SG-05 before the submission deadline. :)

In all seriousness, I would like to thank all the folks over at SANS and CounterHack for their amazing work! I cannot wait to see what they have in store for next year! Had to include a final picture with one of my favorite people and birthday-sharer, Ed Skoudis.


 
© 2016 Mike Boya . Powered by Hugo