辅导案例-COMP2700 2019

  • May 15, 2020

COMP2700 2019 Semester 2 – ASSIGNMENT 1 1 COMP2700 2019 SEMESTER 2 – ASSIGNMENT 1 SUBMISSION DEADLINE: Sunday, September 29th, 2019 – 11:55pm AET. SUBMISSION PROCEDURE: See Wattle page for the course 1. OBJECTIVES: The main objective of this assignment is for the students to understand the security mechanisms in Unix-like operating systems and their interplay with software security, in particular: – to learn practical access control mechanisms in Unix operating system, such as files and folder permissions and SUID programs, and how application security is affected by them; – to learn how software vulnerabilities can be exploited to circumvent security mechanisms in both applications and operating systems. 2. PROBLEM DESCRIPTION: Note: an accompanying Q&A document is also provided to give further details not covered here. See the Wattle page for details. There are four problems in this assignment. To do this assignment, you will make use of an installation of Ubuntu Linux 18.04 (64 bit) in the Oracle VirtualBox virtual machine. The VirtualBox image of the Ubuntu installation is provided with this document and can be downloaded from the Wattle site for this course. The assessment of the solutions to the problems listed below will be entirely done inside this particular installation of Ubuntu. The Ubuntu installation for this assignment is similar to the Ubuntu image provided for the lab sessions. In particular, it has the following users: admin2700, alice, bob, charlie, dennis, eve and fong. User admin2700 has the administrative privilege over the system, i.e., it can escalate its privilege to the root user. SECRETS AND APPLICATION PASSWORDS In this assignment, we consider a scenario in which four users, alice, bob, charlie and admin2700, want to give access to certain ‘secrets’ to other users, but they want to control who can access the secrets and not relying solely on Linux file system permissions. So these secrets are stored in directories where only select users (alice, bob, charlie and admin2700) can access. Access to the secrets are controlled by using individual password files. These passwords are distinct from the account passwords of the Linux users, and we shall refer to them as application passwords. The secrets and the application passwords are located in /etc/comp2700 directory. There are four secrets that need to be protected; they are summarised in Table 1. The first column in the table shows the owner of the secret. The second column shows the application passwords needed to access the secrets given in the third column. COMP2700 2019 Semester 2 – ASSIGNMENT 1 2 Table 1. Locations of application passwords and secrets. Each password is stored in a file called ‘password’, and each secret is stored in a file called ‘secret’. Owner Application password location Secret file location alice /etc/comp2700/alice/password /etc/comp2700/alice/secret bob /etc/comp2700/bob/password /etc/comp2700/bob/secret charlie /etc/comp2700/charlie/password /etc/comp2700/charlie/secret admin2700 /etc/comp2700/admin2700/password /etc/comp2700/admin2700/secret The application passwords are strings of lower-case letters (‘a’ to ‘z’), of length between 1 to 14 characters. All the secrets have the form ‘flag{xx:xx:xx:xx:xx:xx:xx:xx}’, i.e., it is a sequence of 8 bytes presented in a hexadecimal notation, with colon ‘:’ separating the bytes, and the whole sequence is enclosed in ‘flag{ }’ tag. IMPORTANT NOTE: Appendix A provides the account passwords, the application passwords and the secrets for relevant users. All these passwords and secrets will be changed during the assessment of your solutions. So your solutions must not hardcode any of these passwords and secrets. SUID PROGRAMS The actual access control mechanisms for protecting the secrets are implemented using four SUID programs located in the Public directory in each user account. Each of these SUID programs allows a user to access a certain secret, when the right application password is provided. The source code of these programs is written in C and is located in the same directory as the SUID program. Some of these programs may call certain shell scripts in their execution. For your convenience, the source code of these programs and shell scripts are also included in Appendix B. All the C programs were compiled using the following command: gcc program.c -o program -fno-stack-protector -m32 where program.c and program refer to the source and the binary of the program, respectively. There are four SUID programs that a user can use to display a secret file. We give a brief description of each program below. You are required to read the source code (both C code and shell scripts) and to try the programs yourself to find out more about how each program works. In the following, we assume the user ‘dennis’ has been given the application passwords and is accessing the secrets in a normal way. All examples illustrated below assume the passwords and secrets given in Appendix A. We repeat again here that these passwords and secrets will be changed during the assessment. • alice-secret: This program is located in /home/alice/Public/ and is used to access alice’s secret, i.e., the file /etc/comp2700/alice/secret. It takes one argument, which is an application password. If the input application password matches alice’s application password (located in /etc/comp2700/alice/password), then alice’s secret will be displayed. The following screenshot shows an example of the output of a normal run of this program. COMP2700 2019 Semester 2 – ASSIGNMENT 1 3 This example shows a first attempt with a wrong password (‘iforgot’), which results in an error being logged in a log file /home/alice/Public/error.log. The second attempt succeeds with the proper application password for alice (‘aliceone’), with the secret displayed (‘flag{be:2c:1b:c3:e5:ef:22:cd}’). • bob-secret: This program is located in /home/bob/Public/ and is used to access bob’s secret, i.e., the file /etc/comp2700/bob/secret. It takes three arguments: a choice of action to perform (‘1’ to display the secret and ‘2’ to backup the secret), a user name and a password. If the first argument is 1, and the provided password matches bob’s application password (located in /etc/comp2700/bob/password), then bob’s secret will be displayed. If the first argument is 2, then the program copies bob’s secret a backup folder. The following screenshot shows an example of the output of a normal run of this program. • charlie-secret: This program is located in /home/charlie/Public/ and is used to access charlie’s secret, i.e., the file /etc/comp2700/charlie/secret. It takes one argument, which is an application password. If the application password matches charlie’s application password (located in /etc/comp2700/charlie/password), then charlie’s secret will be displayed, otherwise, this failed attempt will be logged in a log file. The following screenshot shows an example of the output of a normal run of this program. • admin-secret: This program is located in /home/admin2700/Public and is used to access admin2700’s secret, i.e., the file /etc/comp2700/admin2700/secret. It takes one argument, which is an application password. If the application password matches admin2700’s application password (located in /etc/comp2700/admin2700/password), then admin2700’s secret will be displayed. The following screenshot shows an example of the output of a normal run of this program. COMP2700 2019 Semester 2 – ASSIGNMENT 1 4 EVE THE ATTACKER In this assignment, you will use eve’s account to find the secrets mentioned above. There are 4 (four) problems you need to solve for this assignment. For each problem, you are asked to write an attack program or script to find a secret. In the following, we assume all attack programs/scripts are located in /home/eve/. We assume that eve does not know any of the account/application passwords or secrets, so she needs to find weakness in the software or OS to access the secrets. Recall again that we will change all account passwords, all application passwords and all secrets during the assessment, so your solutions cannot rely on hardcoding the passwords given in Appendix A. We also assume that the attacker (‘eve’) has an almost identical copy of the system (OS and software), with the only difference being the (account and application) passwords and the secrets. This means that, as eve, you will be able to use the root account in your own copy of the system to explore how the access control is structured, where are the secrets and passwords stored, and other relevant aspects of the system that can be used to mount an attack on the real system. Pay particular attention to the SUID programs and their owners. There may be other files or directories relevant to the above SUID programs that you need to discover on your own to make your attacks work. PROBLEM 1: ALICE’S SECRET Your first task is to write an attack script or a program to display alice’s secret without knowing the password. If your program/script works correctly, it should display the secret that is stored in /etc/comp2700/alice/secret when run by eve. The following is a sample output of a successful attack: A successful attack should simply display the secret and nothing else (this remark applies to all problems below as well). PROBLEM 2: BOB’S SECRET For this problem, you are asked to write an attack script/program to display bob’s secret. If your program/script works correctly, it should display the secret that is stored in /etc/comp2700/bob/secret when run by eve. The following is a sample output of a successful attack: PROBLEM 3: CHARLIE’S SECRET For Problem 3, you are asked to write a script/program to display charlie’s secret. If your program/script works correctly, it should display the secret that is stored in /etc/comp2700/charlie/secret when run by eve. The following is a sample output of a successful attack: COMP2700 2019 Semester 2 – ASSIGNMENT 1 5 PROBLEM 4: ADMIN’S SECRET For Problem 4, you are asked to write a script/program to display admin2700’s secret. If your program/script works correctly, it should display the secret that is stored in /etc/comp2700/admin2700/secret when run by eve. The following is a sample output of a successful attack: 3. WHAT PROGRAMMING LANGUAGE TO USE You can program your solutions using C, Python or bash shell script. All of the problems can be solved with very small programs. If you use C, please make sure that your code can be compiled from within the virtual machine using gcc. Similarly, if you use Python, please make sure the script can be run inside the provided virtual machine. The Python version installed in the provided virtual machine is version 3.6.7. The solutions are simple enough that each will fit in one C/Python/shell script file so you do not need to use complicated project-base code structures. 4. SUBMISSION REQUIREMENTS • What to submit: you must submit the following: 1. The source code for the attack script/program for each problem. Name the file as ‘attackX.c’ (if it is written in C) or ‘attackX.sh’ (if it is written in shell scripts) or ‘attackX.py’ (if it is written in Python, where X is the problem number. So you would need to submit four source files that correspond to the four attacks. 2. A report detailing an analysis of the vulnerabilities you discovered and how you exploit them to launch your attacks. Please use PDF format for the report and name the file ‘report.pdf’. To help us organize your submissions, please put all those files in one zip file, name it according to your last name and uid. For example, if your last name is Bond and your uid is u1234567 then put all the files above in a zip file called ‘Bond_u1234567.zip’. • Output of attack scripts: Each attack script must output only one line containing the secret in the format ‘flag{xx:xx:xx:xx:xx:xx:xx:xx}’ (see Section 2: Problem 1 – 4 for examples) and nothing else. Failure to comply with the above requirements may result in mark deduction up to 5% of possible marks of this assignment. COMP2700 2019 Semester 2 – ASSIGNMENT 1 6 5. WHERE TO SUBMIT Submissions of the solutions must be done through the Wattle site for this course. Unless explicitly approved by the lecturer, the only submission method that is allowed is through Wattle. In particular, unsolicited email submissions will be ignored. The submission site and the submission procedure will be provided separately on Wattle page of the course. 6. DEADLINE & PENALTY – The submission deadline is Sunday, September 29th, 2019 – 11:55pm (AET). – Multiple submissions are allowed. You can submit as many times as you want before the deadline. But only the latest submission will be graded. – No late submissions are allowed without a prior approval from the course convenor. – Failure to comply with submission requirements (Section 4) may result in mark deduction up to 5% of possible marks for this assignment. 7. ASSESSMENT The assessment is based on two components: 1. Attack code execution (40% of total marks): This is broken down to 5% for Problem 1, 10% for Problem 2, 10% for Problem 3 and 15% for Problem 4. The assessment of the correctness of your attack will be partially automated, so please make sure you follow the suggested output format as mentioned in the problem description above. Your solutions will be tested in the same virtual machine that is provided with this assignment, but with all password and secret values modified. So you should make sure that you do not hardcode any of the sample passwords/secrets, as they will not work in the assessment process. Each attack must be successfully executed within 2 (two) minute, when run in a standard desktop in CECS computer labs. This is really an over approximation; if you implement the attacks correctly, each attack should take only a few seconds at most to solve each problem. 2. Report (60% of total marks): There is no definitive structure of the report, but here are some guidelines of what we would expect from the report: • As a general guideline we expect a division into four parts, corresponding to the division of the problems, unless you manage to find a single attack that solves all problems, in which case, it is sufficient to explain the general attack that solves all problems. • We expect a detailed analysis of what are the vulnerabilities and how you exploit them. It is not enough, for example, to say that you do a ‘buffer overflow’ attack. You’d need to explain, e.g., the memory layout, what is the effect of the overflow, how do you subvert the control flow of the program, etc. Similarly, where the problem/solution concerns Unix security mechanism, we expect you to articulate clearly the aspects of the access control mechanism that cause the vulnerability, and how you exploit them. An example is provided in the accompanying Q&A document. Note even if your attack code fails to execute, you may still receive marks for your report if you correctly identify the vulnerabilities and explain your attack strategies. COMP2700 2019 Semester 2 – ASSIGNMENT 1 7 HINTS • Problem 2: Some understanding of the C functions rand and srand will be helpful in solving this problem. You can consult the manual for rand using the following command: man 3 rand • Problem 3: The following article from Mitre’s CWE (Common Weakness Vulnerability) database may be helpful: https://cwe.mitre.org/data/definitions/377.html • Problem 4: You may find the command hexdump useful to examine unprintable ASCII characters. The command hexdump treats its input (file) as a stream of bytes and can output different formats for the byte stream. By default it represents each byte using hex notation. For example, piping the output of ‘echo’ to ‘hexdump’ gives you the hex values of the characters output by ‘echo’: COMP2700 2019 Semester 2 – ASSIGNMENT 1 8 APPENDIX A: PASSWORDS AND SECRETS IMPORTANT NOTE: These passwords and secrets are provided for your convenience, to help you test your solutions. During the assessment, these passwords and secrets will be changed. Please make sure you do not hardcode the passwords and secrets in your solution. User account and passwords to access the virtual machine: User Account Account password Admin2700 admin123 alice alice123 bob bob123 charlie charlie123 dennis dennis123 eve eve123 fong fong123 Application passwords and secrets: Owner Application password Secret alice aliceone flag{be:2c:1b:c3:e5:ef:22:cd} bob bobtwo flag{f5:10:38:67:a3:3b:ae:cc} charlie charliethree flag{a0:57:ee:84:54:93:a1:f7} admin2700 adminfour flag{db:73:1f:db:1f:70:65:5e} COMP2700 2019 Semester 2 – ASSIGNMENT 1 9 APPENDIX B: SOURCE CODE SOURCE CODE FOR PROBLEM 1 File: alice-secret.c #include #include #include #include // Execute any shell command void execute(char *cmd) { execl(“/bin/bash”, “bash”, “-p”, “-c”, cmd, NULL); } void sanitise(char *password) { int i,j; char tmp[15]; // remove non-alphabet characters from passwords j=0; for(i=0; i < 15; ++i) if(password[i] >= ‘a’ && password[i] <= 'z') { tmp[j]=password[i]; ++j; } else break; tmp[j] = '\0'; strcpy(password, tmp); } int authenticate(char *str) { char stored_password[15]=""; char pass[15]; char path[128] = "/etc/comp2700/alice/password"; int i; FILE *fpp; int auth=0; fpp = fopen(path, "r"); if(fpp == NULL) { printf("Password file %s not found\n", path); exit(1); } fgets(stored_password, 15, fpp); sanitise(stored_password); strcpy(pass, str); sanitise(pass); if(strcmp(stored_password,pass) == 0) auth=1; else { auth=0; } fclose(fpp); return auth; } COMP2700 2019 Semester 2 - ASSIGNMENT 1 10 int main(int argc, char* argv[], char *envp[]) { char error[256] = "/home/alice/Public/error.sh $USER "; char pass[15]; if(argc < 2) { printf("Usage: %s password\n", argv[0]); return 0; } // copy only 15 characters from user input, to prevent stack smashing strncpy(pass, argv[1], 15); pass[14]='\0'; if(!authenticate(pass)) { // Log all failed attempts printf("Wrong password. This incident has been logged.\n"); strcat(error, pass); execute(error); // Execute script to log events return 0; } // Display secret execute("cat /etc/comp2700/alice/secret"); return 0; } File: error.sh #!/bin/bash -p # Get date and time dt=$(/bin/date '+%d/%m/%Y %H:%M:%S') # Add new entry to log /bin/echo "[$dt] Wrong password attempt by $1: $2" >> /home/alice/Public/error.log SOURCE CODE FOR PROBLEM 2 File: bob-secret.c #include #include #include #include #include // Execute any shell command void execute(char *cmd) { execl(“/bin/bash”, “bash”, “-p”, “-c”, cmd, NULL); } void sanitise(char *password) { int i,j; char tmp[15]; // remove non-alphabet characters from passwords COMP2700 2019 Semester 2 – ASSIGNMENT 1 11 j=0; for(i=0; i < 15; ++i) if(password[i] >= ‘a’ && password[i] <= 'z') { tmp[j]=password[i]; ++j; } else break; tmp[j] = '\0'; strcpy(password, tmp); } int authenticate(char *str) { char stored_password[15]=""; char pass[15]; char path[128] = "/etc/comp2700/bob/password"; int i; FILE *fpp; int auth=0; fpp = fopen(path, "r"); if(fpp == NULL) { printf("Password file %s not found\n", path); exit(1); } fgets(stored_password, 15, fpp); sanitise(pass); strcpy(pass, str); sanitise(pass); if(strcmp(stored_password,pass) == 0) auth=1; else { auth=0; } fclose(fpp); return auth; } int main(int argc, char* argv[], char *envp[]) { unsigned int seed=time(0); // use current time as the seed for the random number generator char user[16]; int r; char command[128]; int choice=0; if(argc < 4) { printf("Usage: %s choice user password\n", argv[0]); printf("To display the secret, use choice=1, e.g. \n\n %s 1 bob password\n\n", argv[0]); printf("To backup the secret, use choice=2, e.g., \n\n %s 2 bob password\n\n", argv[0]); return 0; } strcpy(user, argv[2]); printf("Welcome, %s!\n", user); srand(seed); // change the seed for random number generator r = rand(); // generate a random number choice = atoi(argv[1]); if(choice == 1) { if(!authenticate(argv[3])) { printf("Wrong password.\n"); COMP2700 2019 Semester 2 - ASSIGNMENT 1 12 return 0; } execute("/bin/cat /etc/comp2700/bob/secret"); } else if(choice == 2) { // invoke the backup.sh script to copy the secret to the backup folder. // the filename is randomly generated sprintf(command, "/home/bob/Public/backup.sh f%d", r); execute(command); } else printf("Wrong choice.\n"); return 0; } File: backup.sh #!/bin/bash -p /bin/echo "Copying secret..." /bin/cat /etc/comp2700/bob/secret > /home/bob/Public/backup/$1 SOURCE CODE FOR PROBLEM 3 File: charlie-secret.c #include #include #include #include // Execute any shell command void execute(char *cmd) { execl(“/bin/bash”, “bash”, “-p”, “-c”, cmd, NULL); } void sanitise(char *password) { int i,j; char tmp[15]; // remove non-alphabet characters from passwords j=0; for(i=0; i < 15; ++i) if(password[i] >= ‘a’ && password[i] <= 'z') { tmp[j]=password[i]; ++j; } else break; tmp[j] = '\0'; strcpy(password, tmp); } int authenticate(char *str) { char stored_password[15]=""; char pass[15]; char path[128] = "/etc/comp2700/charlie/password"; int i; COMP2700 2019 Semester 2 - ASSIGNMENT 1 13 FILE *fpp; int auth=0; fpp = fopen(path, "r"); if(fpp == NULL) { printf("Password file %s not found\n", path); exit(1); } fgets(stored_password, 15, fpp); sanitise(stored_password); strcpy(pass, str); sanitise(pass); if(strcmp(stored_password,pass) == 0) auth=1; else { auth=0; } fclose(fpp); return auth; } int main(int argc, char* argv[], char *envp[]) { if(argc < 2) { printf("Usage: %s password\n", argv[0]); return 0; } if(!authenticate(argv[1])) { // Log all failed attempts printf("Wrong password. This incident has been logged.\n"); execute("/home/charlie/Public/error.sh"); return 0; } execute("cat /etc/comp2700/charlie/secret"); return 0; } File: error.sh #!/bin/bash -p # Directory name; uses current user's name as suffix tmpdir=/var/tmp/session-log-$USER # create directory for charlie in /var/tmp /bin/mkdir -p $tmpdir # Get date and time dt=$(/bin/date '+%d/%m/%Y %H:%M:%S') # Get date -- use this for log file name dd=$(/bin/date '+%d-%m-%Y') /bin/echo "Wrong password attempt by $USER at $dt" > $tmpdir/$dd.log COMP2700 2019 Semester 2 – ASSIGNMENT 1 14 SOURCE CODE FOR PROBLEM 4 File: admin-secret.c #include #include char password[15]=””; int authenticate(char * pass) { int length = 15; int result = 0; char x[15]; strncpy(x, pass, length); result = strncmp(password, x, length); if(result) { printf(“Wrong password: %s\n”, x); return 0; } return 1; } int main(int argc, char* argv[]) { FILE *fps; FILE *fpp; char secret[512] = “”; if(argc < 2) { printf("Usage: %s password\n", argv[0]); return 0; } fps = fopen("/etc/comp2700/admin2700/secret", "r"); if(fps == NULL) { printf("Secret file not found\n"); return 1; } fpp = fopen("/etc/comp2700/admin2700/password", "r"); if(fpp == NULL) { printf("Password file not found\n"); fclose(fps); return 1; } fgets(password, 15, fpp); fgets(secret, 512, fps); if(authenticate(argv[1])) printf("%s\n", secret); fclose(fpp); fclose(fps); return 0; }

LATEST POSTS
MOST POPULAR

ezAce多年来为广大留学生提供定制写作、留学文书定制、语法润色以及网课代修等服务,超过200位指导老师为您提供24小时不间断地服务。