NEW ROOTING CHALLENGE!

Hey guys! I joined recently and beat all the rooting challenges. I HUNGER FOR MORE! Because of this, and Mr_Cheese's thought on the shoutbox, I've decided to make another. I've never done a real rooting attack, so my knowledge as to what it would be are limited to the challenges I've beaten. If anyone can devise a story/plot, pm it to me or post it here (no spoilers here please). I heard you can root via IRC, thats an idea…

varreon wrote: my knowledge as to what it would be are limited to the challenges I've beaten.

Then, you're going to produce something that's already been done. Please don't.

Also, rooting by IRC? What the fuck are you on?

Easy Basic Rule Of Life #54390182: If you don't know how to do it, then don't try to teach it.

No really! Googling for rooting challenges came up with http://www.criticalsecurity.net/index.php?showtopic=22577&mode=threaded Double check before flaming. Any positive ideas?

varreon wrote: No really! Googling for rooting challenges came up with http://www.criticalsecurity.net/index.php?showtopic=22577&mode=threaded Double check before flaming. Any positive ideas?

No really! If it's already been done, then nobody wants to do it again. Simulated "challenges" are not comparable to what's out there in the wild. Double check before posting garbage and ignoring sound advice.

Which is why im asking if anyone has an idea to be made into a challenge.

How about a simulated buffer overflow?

Or, something where you'd have to monitor traffic to and from a computer on the local network using command-line utilities, and then manipulate some packets to exploit a particular vulnerability in its networking configuration?

lesserlightsofheaven wrote: How about a simulated buffer overflow?

Or, something where you'd have to monitor traffic to and from a computer on the local network using command-line utilities, and then manipulate some packets to exploit a particular vulnerability in its networking configuration?

yeah do the second one, it sounds great

I think both :)

Also, rooting by IRC? What the fuck are you on?

Does that sound unrealistic to you? ;)

netfish wrote: Does that sound unrealistic to you? ;)

The IRC protocol is pretty much what you write is what you send, but I don't get why would you use IRC ?

Arto_8000 wrote: [quote]netfish wrote: Does that sound unrealistic to you? ;)

The IRC protocol is pretty much what you write is what you send, but I don't get why would you use IRC ?[/quote]

If you can send trojans through it, use ruby, perl, python and other scripting languages, why is it unfathomable?

To be honest, I would think a buffer overflow would be a good one, but a real root would be best.

-Bl4ckC4t

bl4ckc4t wrote: If you can send trojans through it, use ruby, perl, python and other scripting languages, why is it unfathomable?

To be honest, I would think a buffer overflow would be a good one, but a real root would be best.

-Bl4ckC4t

Do you know what the IRC protocol is ? Do you know what you are talking about ?

netfish wrote: Does that sound unrealistic to you? ;)

A tad, though perhaps I was quick to jump to conclusions.

What I will maintain, is that we need something NEW and ORIGINAL rather then a remake of a pre-existing idea.

i like the buffer overflow concept.

maybe mission runs something like this:

there is a company that writes software for some purpose, web server or something.

SuperServer! Host files with this free, open source file client!

on their site, you can download the webserver.c file.

#includes....
main(){ 
... //lots of code
filetoserver = string[200]; //vulnerable line
... //lots more code
}
} //i havent worked in c++ for a long time, forgive the syntax

then exploit it on some site running the server.

i dont know something like that, doesnt have to be a web server, whatever works.

[edit] irc rooting? huh crazy. that would be fun. [/edit]

DigitalFire wrote: there is a company that writes software for some purpose, web server or something.

(…)

on their site, you can download the webserver.c file.

So you can find the vulnerability by looking in the source code? That's a quite original idea :) could also be done as a patching challenge ^^

Uber0n wrote: So you can find the vulnerability by looking in the source code? That's a quite original idea :)

No it's not. RTB did that (on the box that was there during their new-server-getting thing, if you know what I mean)

Honestly, if someone is making a new chall is should be someone who can actually root, not some lame-ass punk who thinks he's leet because he learned to cat a file.

To OT: I think Fritzo said enough about this matter.

spyware wrote: Honestly, if someone is making a new chall is should be someone who can actually root, not some lame-ass punk who thinks he's leet because he learned to cat a file.

I agree, and this is why we only have three rooting challenges. :p

i really like rooting challenges, i did all 3 without problems. i think that i have ability to code some rooting challenge in c++, then pack it or encrypt it so people cant read the strings, or add some protection for lames (when you have running disassembler or debugger, program will not run, but i know, everything is crackable) BUT I HAVENT IDEA! :@

dancuc wrote: i really like rooting challenges, i did all 3 without problems. i think that i have ability to code some rooting challenge in c++, then pack it or encrypt it so people cant read the strings, or add some protection for lames (when you have running disassembler or debugger, program will not run, but i know, everything is crackable) BUT I HAVENT IDEA! :@

Dude, I don't think you actually know rooting. Exploiting services, BoF's, do you know that stuff? Rooting doesn't stop with CAT.

Fritzo wrote: At HBH it does xD

Then I am afraid our knowledge casts a shadow of despair that dresses HBH in the black night of mindless zombies.

i never said that i know rooting. i know that rooting doesnt ends with cat ;) i only said that i have ability to code a rooting challenge, but i need some idea. i am not the pro c++ programmer, but i think that i can do a rooting challenge. thats all.

dancuc wrote: i never said that i know rooting. i know that rooting doesnt ends with cat ;) i only said that i have ability to code a rooting challenge, but i need some idea. i am not the pro c++ programmer, but i think that i can do a rooting challenge. thats all.

A good carpenter always knows what he's building. While the how is sufficient, the why makes the world tick.

yes yes, i am only afraid that there are only 3 rooting challenges, because i like rooting. i think that admins of HBH received in last month at least 1 challenge. but they disapproved it, probably it was crap, or something else. i agree with this. better 3 good challenges than 10 bad. but i think there are lots of able peoples with ability of programming and with knowledge of rooting. by the way, HBH have more than 15k users, and there are really active less than… 700? i cant say exact number.

Almost no one on HBH knows how to root, I don't know how to do it either.

ahem… wargames? intruded.net :)

mr noob wrote: ahem… wargames? intruded.net :)

Have you actually participated in this?

the wargame? as a matter of fact i have :)

mr noob wrote: the wargame? as a matter of fact i have :)

Cool, and? Little story please? :)

lol here we go then:

intruded has a load of different wargames: ciphering and encryption ones, web hacking ones, enumerating ones, and rooting ones with two different architectures, all varying in difficulty, with the difficulty rating displayed next to the wargame link.. the first one(cant remember the name) is hbh difficulty level rooting, using basic linux command knowledge. it moves from there to available source code BoF, then to rev. engineering BoF and format string, and thats as far as i got ^^

the web based ones are ok, but why go to a wargaming site for that :P

mr noob wrote: lol here we go then:

intruded has a load of different wargames: ciphering and encryption ones, web hacking ones, enumerating ones, and rooting ones with two different architectures, all varying in difficulty, with the difficulty rating displayed next to the wargame link.. the first one(cant remember the name) is hbh difficulty level rooting, using basic linux command knowledge. it moves from there to available source code BoF, then to rev. engineering BoF and format string, and thats as far as i got ^^

the web based ones are ok, but why go to a wargaming site for that :P

Ah okay. I thought you meant you participated in a competition :P. Still thanks for the info though, I will check it out!

lol nah im not good enough to do competitions, can only just audit code and write an exploit for it :P

mr noob wrote: lol nah im not good enough to do competitions, can only just audit code and write an exploit for it :P

Yeah, I've done that on RTB too. It's fun but still it doesn't feel like I can root, if you get what I mean. You basically skip the getting pass & connecting part, which is the hard part (for me).

when you say root a box, do you mean you want a challenge where you actually have to find vulnerable ports, bypass the firewall, bypass the IDS, and input exploitable code, or just gain admin access for further processing?

or are you looking for more of how to install a rootkit on the server?

well the trick to getting access is either getting in through web hacking, googling for a service exploit, or if its open source auditing the source code and writing a BoF/format string for it :)

Find a box, scan for services. Exploit a service so you can "tap" into the box. Then exploit the OS (by exploiting code) so you can exec commands on root level.

-Fin

Or do I miss something?

its usually the exploiting the service bit thats hard lol

ok, i will finish a few articles about the subject later tonight then, i have a few that i have been working on, on the basics of rooting, i'm almost done so i will send them out tonight

is this articles on decent rooting ie BoF or bullshit rooting ie hbh challs? :P

Well, I don't interpret it as completely bullshit, you've seen that there are just three root challenges, the way I see it, root 1 and 2 (especially 2), are just little "prototypes" for rooting, maybe rooting 3 didn't "develop" the elder, but, if you're talkin about that those challenges are "over-idiotish", you'd be right. And yes, logical challenges too, are very very (again very) basic), but if so…? The field is opened, for you, for others - to code more challenges. I defend people who made the first challenges; You won't start your hacking site with the hardest rooting challenge as level one!

Or what do you think?

its still a bit of an offence to the name rooting, i meant bullshit challs in the way that youll never root a server using those techniques, but the ideas do give you some kind of mild background… sort of… maybe?

Im busy atm but if i get round to it il try coding a rooting chall and see what people think.