This is a copy of the original article for archival purposes: https://blog.fox-it.com/2020/11/11/decrypting-openssh-sessions-for-fun-and-profit/
A while ago we had a forensics case in which a Linux server was compromised and a modified OpenSSH binary was loaded into the memory of a webserver. The modified OpenSSH binary was used as a backdoor to the system for the attackers. The customer had pcaps and a hypervisor snapshot of the system on the moment it was compromised. We started wondering if it was possible to decrypt the SSH session and gain knowledge of it by recovering key material from the memory snapshot. In this blogpost I will cover the research I have done into OpenSSH and release some tools to dump OpenSSH session keys from memory and decrypt and parse sessions in combinarion with pcaps. I have also submitted my research to the 2020 Volatility framework plugin contest.
Continue reading →
Finally, the last level! Level 5 is a “simple number manager”. It is similar to the note manager as it allows to store up to 10 numbers. That’s… really useful.. 😛
Level 5, simple number manager
Continue reading →
Level4, time for some crypto and reverse engineering.. Level 4 is a binary which decrypts encrypted files with a password, and of course an example binary and password are given. Putting some random data in a file and trying to decrypt that results in a message that the file is invalid or corrupt. This suggests that the binary has some kind of checksum algorithm to detect if the file is valid. Let’s take a closer look at the binary.. Continue reading →
Level 3, one of my favorites! As with the previous level, we started a binary on the vm with socat. This time we find a random number game.. As usual we start fuzzing..(string format, buffer overflow etc.) but after some time we haven’t found anything. Time to look closer at the binary.. Continue reading →
So! We got passed level1 and now have a basic shell. Whats next?! In the home directory of level1 we find two files: level2 and level2_readme.txt. The readme files tells us to run level2 with the command “socat TCP4-listen:53121,reuseaddr,fork EXEC:./level2” and connect to it using something like netcat. When connecting to it, we discover it’s some kind of note manager. We can store up to 10 notes and have some commands available to create/ write/ read and delete a note. Continue reading →
After c0ne build the vulnerable binary for the knock-knock challenge, he now made a complete boot2root VM with 5 levels: Pandora’s Box! I had the pleasure of being one of the testers for the vulnurable binaries, so I got a sneak peek for level 2 and 3 (after which level 2 changed quite a bit). I’l be splitting up the writeup per level and I’l only describe the final levels that ended up in the VM. Continue reading →
Knock knock.. who’s there? Time for a new exploit challenge! This time the challenge is a VM created by zer0w1re on VulnHub. I got a tip from a friend who actually build the vulnerable binary in the VM so I gave it a go 😀 .
After mounting the VM and doing an initial nmap scan to locate the VM I fired up a second nmap scan to get an indication what is running on the box. Nmap returned one port: 1337!
After connecting to the service on port 1337 we get three seemingly random numbers. Let’s start knocking! Continue reading →
So.. My first CTF writeup! I participated with a few others in the Pwnium capture-the-flag. One of the challenges I looked at was the Reverse Engineering challenge “Kernel Land”. The challenge gave a link to a binary with the tip: “The third Tick gives you the answer ;)”. After a first peek it appeared to be a linux binary:
root@kalipwn:~/Downloads# file kernel Continue reading →
kernel: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, not stripped