Operating Systems 2019W: Tutorial 9 - Revision history

Housedhorse: /* 3000log-write.c */

2019-04-03T11:41:57Z

3000log-write.c

2019-04-01T03:15:17Z

Other Tasks & Questions

← Older revision		Revision as of 03:15, 1 April 2019
Line 67:		Line 67:
	* Vary the delays in the 3000fast-swap. Do shorter delays make it easier or harder to win the race? What about longer delays?		* Vary the delays in the 3000fast-swap. Do shorter delays make it easier or harder to win the race? What about longer delays?
	* Can you make 3000fast-swap use hard links instead of symbolic links? Why or why not?		* Can you make 3000fast-swap use hard links instead of symbolic links? Why or why not?
			* Does the attack work if you append rather than just write to the file?
	* How does the system call profile of the system change when these attacks are run? Are there more system calls? More failed ones? What kind?		* How does the system call profile of the system change when these attacks are run? Are there more system calls? More failed ones? What kind?
	* Load your machine with heavy CPU and/or I/O bound tasks. Do these affect how quickly you can win the race?		* Load your machine with heavy CPU and/or I/O bound tasks. Do these affect how quickly you can win the race?

2019-04-01T03:08:54Z

Other Tasks & Questions

← Older revision		Revision as of 03:08, 1 April 2019
Line 68:		Line 68:
	* Can you make 3000fast-swap use hard links instead of symbolic links? Why or why not?		* Can you make 3000fast-swap use hard links instead of symbolic links? Why or why not?
	* How does the system call profile of the system change when these attacks are run? Are there more system calls? More failed ones? What kind?		* How does the system call profile of the system change when these attacks are run? Are there more system calls? More failed ones? What kind?
			* Load your machine with heavy CPU and/or I/O bound tasks. Do these affect how quickly you can win the race?
	* [HARD] Could 3000log-write.c tell that it had made a mistake and written to the wrong file?		* [HARD] Could 3000log-write.c tell that it had made a mistake and written to the wrong file?
	* Modify 3000log-write.c so it drops privileges temporarily while doing the write using <tt>seteuid</tt>. Is the modified version vulnerable to the same attack?		* Modify 3000log-write.c so it drops privileges temporarily while doing the write using <tt>seteuid</tt>. Is the modified version vulnerable to the same attack?
			* Do you think you could detect this attack by observing system call patterns? What about by observing patterns in the logs? (Could the attacker cover their tracks after they gained privileges?)

	==Code==		==Code==

2019-04-01T03:04:17Z

← Older revision		Revision as of 03:04, 1 April 2019
Line 1:		Line 1:
	~~'''This tutorial is not yet finalized.'''~~

	In this tutorial you'll attempt to exploit a simple TOCTTOU vulnerability in [https://homeostasis.scs.carleton.ca/~soma/os-2019w/code/3000log-write.c 3000log-write.c] using [https://homeostasis.scs.carleton.ca/~soma/os-2019w/code/3000fast-swap.c 3000fast-swap.c] and some bash shell commands.		In this tutorial you'll attempt to exploit a simple TOCTTOU vulnerability in [https://homeostasis.scs.carleton.ca/~soma/os-2019w/code/3000log-write.c 3000log-write.c] using [https://homeostasis.scs.carleton.ca/~soma/os-2019w/code/3000fast-swap.c 3000fast-swap.c] and some bash shell commands.

2019-04-01T03:00:50Z

Setting up the exploit environment

← Older revision		Revision as of 03:00, 1 April 2019
Line 38:		Line 38:

	Create the safefile (owned by student):		Create the safefile (owned by student):
	echo "This is the safe file" > /home/student/tmp		echo "This is the safe file" > /home/student/tmp/safefile

	Create the victimfile (owned by root):		Create the victimfile (owned by root):

2019-04-01T02:58:45Z

Exhancements

← Older revision		Revision as of 02:58, 1 April 2019
Line 64:		Line 64:
	When you are done, be sure to kill off 3000fast-swap!		When you are done, be sure to kill off 3000fast-swap!

	===~~Exhancements~~===		===Other Tasks & Questions===

	~~Try the following:~~
	* Add a timestamp to the log using <tt>ctime</tt> or equivalent.		* Add a timestamp to the log using <tt>ctime</tt> or equivalent.
	* Vary the delays in the 3000fast-swap. Do shorter delays make it easier or harder to win the race? What about longer delays?		* Vary the delays in the 3000fast-swap. Do shorter delays make it easier or harder to win the race? What about longer delays?
	* Can you make 3000fast-swap use hard links instead of symbolic links? Why or why not?		* Can you make 3000fast-swap use hard links instead of symbolic links? Why or why not?
	* How does the system call profile of the system change when these attacks are run? Are there more system calls? More failed ones? What kind?		* How does the system call profile of the system change when these attacks are run? Are there more system calls? More failed ones? What kind?
			* [HARD] Could 3000log-write.c tell that it had made a mistake and written to the wrong file?
			* Modify 3000log-write.c so it drops privileges temporarily while doing the write using <tt>seteuid</tt>. Is the modified version vulnerable to the same attack?

	==Code==		==Code==

2019-04-01T02:51:46Z

Exhancements

← Older revision		Revision as of 02:51, 1 April 2019
Line 70:		Line 70:
	* Vary the delays in the 3000fast-swap. Do shorter delays make it easier or harder to win the race? What about longer delays?		* Vary the delays in the 3000fast-swap. Do shorter delays make it easier or harder to win the race? What about longer delays?
	* Can you make 3000fast-swap use hard links instead of symbolic links? Why or why not?		* Can you make 3000fast-swap use hard links instead of symbolic links? Why or why not?
			* How does the system call profile of the system change when these attacks are run? Are there more system calls? More failed ones? What kind?

	==Code==		==Code==

2019-04-01T02:51:08Z

Running the exploit

← Older revision		Revision as of 02:51, 1 April 2019
Line 46:		Line 46:

	===Running the exploit===		===Running the exploit===

			First, get 3000fast-swap running in the background:
			3000fast-swap &

			If you run <tt>top</tt> you should see it consuming significant resources.

			Try viewing targetfile several times. You should see its contents changing between the victimfile and safefile.
			Note that sometimes targetfile may not exist while other times it does.
			for x in `seq 1 10`; do cat /home/student/tmp/targetfile; done

			Now try running 3000log-write many times and see whether the victimfile has changed:
			for x in `seq 1 10`; do ./3000log-write /home/student/tmp/targetfile payload; done
			cat /etc/victimfile

			Did victimfile change? If not, try running 3000log-write more times.

			When you are done, be sure to kill off 3000fast-swap!

	===Exhancements===		===Exhancements===

2019-04-01T02:41:34Z

Tasks

@@ Line 28: / Line 28: @@
 ===Setting up the exploit environment===
 ===Running the exploit===
 ==Code==

2019-04-01T02:26:46Z

Running 3000log-write

← Older revision		Revision as of 02:26, 1 April 2019
Line 21:		Line 21:

	Now, try running the following as a regular user:		Now, try running the following as a regular user:
	./3000log-write testfile "Kilroy was here~~!!!~~"		./3000log-write testfile "Kilroy was here"

	What shows up in <tt>testfile</tt>? Anything surprising about what is in the file now?		What shows up in <tt>testfile</tt>? Anything surprising about what is in the file now?