Unix files system related puzzle [closed]

Question

There was a question in one of quiz conducted one year back. I was attempting to solve this question and got stuck. All the other were programming related but this one was a Unix file permissions related Stuff. Following is the scenario.

You will be given a login and a password to a SSH server. ssh your-username@server-addr

Your task is to look for a file named /home/abc/chekme and retrieve the contents.

When logged in to the ssh remote server doing an ls -l shows 0 files, which shows that the login given has no permissions but on doing ls -l for the above mentioned file it can be seen that Read permission is given to the root user and a group and the name of the group is chekme.

I can't read the file because I don't have the permission and am not a member of that group. On exploring the /etc/group file I found out that there is a group named chekme and only one user is added to that group. The user name is guest

From here I tried changing my guid to that of the group, adding myself to the group, doing a su as the user guest but none of it worked since the first two required root access and su to guest required the password of that user.

How do I proceed now ?

Actual question with login creds :

File : /home/hacker-weekly/abacus

So, you have to read the file '/home/hacker-weekly/abacus' and submit the file content here.

If you haven't got your login credentials, get it by clicking on the button 'Get Login Credential' below. Then you can login into the machine by running following command:

ssh "your-username"@"server-addr"

Hint: Think all about file permission in a UNIX-based system.

Login credentials Server: ec2-175-41-164-254.ap-southeast-1.compute.amazonaws.com Username: ashwinscongo Password: ab12d6H

The group name is abacus, the user in that group is guest. Tried /etc/passwrd, couldn't make out anything.

Answer 1

Approach:

$ ls -l /home/hacker-weekly/abacus
-r--r----- 1 root abacus 373 Nov 12  2012 /home/hacker-weekly/abacus
$ id
uid=1554(gilles) gid=1555(gilles) groups=1555(gilles)

So we need to either gain root permissions or gain abacus group permissions. But how?

Hint (step 1): _{How do you elevate privileges?}

Full solution (step 1):

Look for setuid or setgid executables that shouldn't be there:
    find / -xdev -perm /4000 -ls 2>/dev/null
There are two likely candidates: /usr/local/abacus and /usr/bin/hacker-weekly-abacus. Running the latter prints out an SSH private key.

Hint (step 2): _{The obvious way to use this file is to log into some other account. Which account?}

Full solution (step 2):

Look through /etc/passwd and see what accounts are present (other than the system accounts and the participants). Look in /etc/passwd and /etc/group to find members of the abacus group. There's just guest.
So copy the private key to ~/.ssh/id_rsa, set the permissions correctly, and ssh guest@localhost. Bingo.

---

<advertisement>

If you like this kind of stuff, we participate in capture-the-flag competitions as the sec.se (Security Stack Exchange) CTF team (see the meta post for organizational details). There's more web, reverse engineering and crypto involved than unix though.

Answer 2

The original problem statement is here, http://www.hackerearth.com/problem/algorithm/hack-unix/.

In looking at this problem, I do not believe there is any method for gaining access to the file via the permissions. After logging in:

$ cd /home/hacker-weekly/
$ ls -la
total 28
drwxr-xr-x   2 hacker-weekly hacker-weekly  4096 Nov 12  2012 .
drwxr-xr-x 556 root          root          20480 Sep 20 19:30 ..
-r--r-----   1 root          abacus          373 Nov 12  2012 abacus

From what I know of permissions (Unix) and filesystems there is no straightforward way to gain access to this file because of these permissions. The permissions are telling us that you either (1) have to gain access to root or (2) gain access to an account that has access to the group abacus.

Exploring the Group angle

In looking at this group I noticed to following in the /etc/passwd and /etc/group files:

/etc/passwd

$ grep -E "ashwinscongo|guest|abacus" /etc/passwd
guest:x:1001:1001::/home/guest:/bin/sh
.guest:x:1436:1437::/home/.guest:/bin/bash
ashwinscongo:x:1544:1545::/home/ashwinscongo:/bin/bash

/etc/group

$ grep -E "ashwinscongo|guest|abacus" /etc/group
guest:x:1001:
abacus:x:1004:guest
.guest:x:1437:
ashwinscongo:x:1545:

So it would seem that we need to gain access to the guest account.

sudo?

We have no sudo privileges.

$ sudo -l
[sudo] password for ashwinscongo: 
Sorry, user ashwinscongo may not run sudo on ip-10-144-3-172

Logging into guest

I can only conceive of a frontal assault at this point so I tried the top most 25 password from 2012, along with:

• guest
• abacus
• ab12d6H
• tseug
• Abacus

None of which worked.

Other angles?

1. Find an executable that has it's permissions such that it either (1) executes as root or (2) executes as guest (setuid/setgid files)!
2. Gain access to guest
3. Exploit a trust relationship of some sort for ssh? (ssh guest@localhost) angle?

Actual solution

It took a bit but I figured it out. My username is slmingol. Apparently Gilles figured it out too!

• http://www.hackerearth.com/users/slmingol/
• http://www.hackerearth.com/users/gilles/

If you poke around on the box looking for executables you'll find everything that you need. Now that I know how to do it it's best if you figure it out on your own.

The hint regarding permissions is relevant only in the sense that you need to gain privileges. The other clue you'll find if you google around is also apt about ssh'ing into the guest account. I encourage you to stick with it and don't cheat by looking at @Gilles clues/answer.

If you're really stuck I can give you some additional hints without spoiling it!