Back in 1986 - User
Morris Worm - fingerd Stack Buffer Overflow and Cron Job misconfiguration
Last updated
Morris Worm - fingerd Stack Buffer Overflow and Cron Job misconfiguration
Last updated
tcp://tasks.yauzactf.com:79
Falling asleep on a strange bus in summer, young CTF lover Vasya wakes up in 1986... without money and documents, but with the valuable information about the future and the Kali Linux VM on his laptop. Now he works for KGB and his task is to hack into networks of ""Strategic Defense Initiative Organization"" and ultimately change the history of the USSR. Can he deal with old UNIX systems possessing all the knowledge of modern Linux security and binary exploitation?
We're only given port 79. With some initial testing, we can confirm that this is the Finger service.
There are a lot of old exploits for this service, and based on the challenge description, this instance is probably vulnerable to one of those old exploits. Furthermore, the name of the root user is "Charlie Root", which is only seen in BSD 4.2, which is the version vulnerable to a remote buffer overflow.
Luckily, there is a Metasploit module for this exploit, which was used by the Morris Worm back in the 1980s.
Once we're in, we notice under /usr/guest that there are three users: sam, mckusick and karels (user directories used to be in /usr before the /home directory was used). We could dump the /etc/passwd file and crack the hashes (password shadowing was not yet a thing on BSD 4.2):
Using the sam:raygun credentials, we can su to the sam user.
If we look at the crontab.local file, we see that a Cron job is run as the karels user every minute.
The cronwatch.sh file is in the sam user's directory, so we can control the commands that are run.
After a minute, we are able to read the user_flag.txt file.