CSC347 Introduction to Information Security Assignment 1

• All exploits are to take place under the RH7.2 assignment 1 Virtual Machine.
• You can find the assignment image under /virtual/assignment1/RH72LabImage_A1.zip on dh2020pc01 in the lab, with md5sum ed47adedc60aa4e43ebfc84384669402 RH72LabImage_A1_2016.zip.
• You can use the following script to download it to your lab machine.
• Select 'I MOVED IT'.
• Unless specified in the Q and A section below, all official code for this assignment is on the VM. Although you have been given the source code, you should assume that your exploit involves us running our unmodified, compiled copy of the code under the rh7.2 assignment image with your inputs.

1. [10 Marks] Solve v3.c questions 1 and 2 as it appears in the hackers account.
2. [15 Marks] In the RH72LabImage_A1_2016 you can find functionPointers in the hackers account. This has a few vulnerabilities.
   • Figure out an input which will cause hacked() to be executed, without overrunning the stack (not modifying the ebp, nor return address). Can you do this so that the program continues to run normally after that?
   • Read about the format string vulnerability and determine an input which will cause the secretPassword to be printed to the screen. The program should continue normally after that (or terminate normally). No buffer overrun here.
   • (OMIT!! This is much more difficult that I expected. gets is a problem, in the way it handles stdin.) Determine an input which will cause a shell to be launched on return from g(). If it can't be done, explain why.
   • Fix the code so that it has none of the vulnerabilities above. (EDIT: You should fix the gets problem as well.)
3. [25 Marks] Your assignment VM has code installed in /vulnerable. Your can find this question in account.c. Your task for this question is to identify vulnerabilities (mark them in the code), demonstrate exploits and explain the exploits impact. See for example, cert.org vulnerability notes. You do not have to exploit buffer overrun vulnerabilities for this part of the assignment, just identify vulnerable code and explain the potential impact. Write a report (see REPORT.txt) listing each vulnerability, a collection of exploits for the vulnerability (code, inputs, scripts etc. we can run to see the exploit in action), the impact of the vulnerability, and identify a category (CIA) for the impact (see the list below). Include inputs, scripts, code etc. demonstrating each exploit.

   To think about this question, think about the following: Secure properties (CIA)

   • Confidentiality
   • Integrity
   • Availability
   Vulnerabilities to look for include, buffer overruns, integer overflows, canonical naming, directory traversals,... Once you find a vulnerability, demonstrate associated exploits (code/inputs). Then describe the impact of the exploit. Impacts include things like denial of service, authentication issues, accountability issues, priviledge escalation (see principle of least priviledge), ... Finally identify the impact as a violation of Confidentiality, Integrity or Availability. Hint: Thinking in terms of the above list is a good way to start thinking about potential exploits.

   Finally fix the code, explaining how you fixed the vulnerabilities and prevented the exploit and restored CIA.

4. [10 Marks] xinetd is the internet super server, it can turn any unix program that reads stdin and writes stdout into a 'web service'. Take a look at /etc/xinetd.d in the assignment VM to see a collection of programs that are running under xinetd on your RH7.2 VM. One of these is palindrome.c, please take a look at /etc/xinetd.d/palindrome to see how this service is run (which port etc). For convenience, I am having it run out of /root/a1 where you can find the source code as well. Simply recompiling /root/a1/palindrome.c will cause the online service to update. If you want to restart xinetd you should execute /etc/rc.d/init.d/xinetd restart.

   You will investigate this service, show how a user from outside the RH7.2 VM (ie on the host machine) can gain unauthorized access to the VM. You might want to take a look at tcpclient.pl. Use ifconfig to determine the ip address of the VM.

   1. Submit a modified tcpclient.pl (called tcpclientA.pl) which obtains a root shell on the remote server running palindrome. The console user running tcpclientA.pl should be able to interactively enter commands and see the result. Note: Entering commands may not be as smooth as running a real console, this is ok. At the very least, a user should be able to execute ls a couple of times.
   2. Fix the palindrome service so that it can handle larger inputs and is no longer vulnerable. Submit the modified code as well as a discussion of any other changes you feel are necessary to make the palindrome service more secure.

Questions and Answers

Question:

What are the accounts on the vm?

Answer:

root/password and hacker/password

Question:

I destroyed my makeShellCode.pl

Answer:

here is another copy.

Question:

Is there some problem with account.c as it appears in the virtual machine?

Answer:

Yes, there was an issue with the system command. This is now fixed in this new account.c. You can either:

1. Download a new copy of the VM with the new account.c installed. You can use the updated a1download bash script.
2. Copy the new version (account.c) into the old VM, replacing the old /vulnerable/account.c with this one. You can do this by scp-ing the new one over the old one from your host account. You should then re-run the setup script (bash /vulnerable/setup.bash) as root.

Question:

Does question 4 actually work? Any hints?

Answer:

You should learn about the code by modifying it and running it as an xinetd service. Remember, the location on the stack matters, especially in the codes natural state, not under gdb etc.

Question:

Do we have to provide exploits for question3?

Answer:

Yes, provide scripts, code etc. so we can run your exploits on the original code.

Question:

Do we submit one time for each member of the team?

Answer:

No, just one submit. Please put members in the report as outlined in the submission checklist (a1/README.txt).