Gera's Insecure Programming by example review series: Prep

After going through the SANS SEC660 course, I wanted to keep on learning and cementing what I learned.  While there are many different sources to learn reverse engineering (e.g. OpenSecurityTraining Exploits1, Exploits2, Over the Wire, Smash the Stack), I heard about Gera's Insecure Programming by example site and wanted to dive back into Linux.  There will be instructions that should produce the same results that I provide in the post as these exercises are covered.

To do this series of posts, there are some basic assumptions about where we start.  The assumptions are:

1. You already have x86 knowledge

2. You have virtualization software installed on your machine as well as know how to set up a VM

3. Know how to use Linux

These exercises are going to use Ubuntu x86 14.04 LTS.  To get started:

1. Go to http://www.ubuntu.com/download

2. Click "Ubuntu Desktop"

3. Change the dropdown to 32-bit and click "Download"

4. Choose to donate or not and proceed to download the ISO of the OS

5. Set up a VM with network access to the Internet.  My VM for reference has 40GB HD, 2 CPU cores and 2GB of RAM.  You mileage may vary depending on what you give it, but it "shouldn't" need more for these exercises.  At this point, it is assumed that the VM has already been started, gone through the process to install the OS to the VM and we are at the point of a first real logon.  If not, this should help you get through as a similar process.

6. Log onto the system with the user you created in the install process

Once the VM is up and running, let's get the OS updated so we can get our environment for reverse engineering set up.

1. Click on the Ubuntu symbol at the top left of the screen to bring up the search function

2. Type in "Terminal"

3. This should give you a bunch of options, but we want "Terminal" which should be the first option.  Click on that.

4. You should see the command prompt/terminal type window show up on the left bar.  Right click on it and dock it to the launch bar.  We're going to use this a lot.  You can drag it to the top if you'd like so it's more readily seen.

5. In Terminal, type in:

sudo apt-get update

6. Enter in your password to the prompt

7. If you have successfully given your VM Internet access, it should be accessing update mirrors to pull down a list of things to update.

8. Now let's actually do some updating.  In Terminal, type in:

sudo apt-get upgrade

9. Press the Enter key to accept the updates and let it do it's update

10. Reboot if necessary

11. Log back into the VM and install the VMware or your virtualization software's VM tools.  Reboot if necessary.

12. In the not too distant future, we will use Capstone.  We won't really cover that right now, but let's install PIP and then get Capstone.  In Terminal, type:

sudo apt-get install python3-pip

13. Now let's get Capstone, in Terminal type:

sudo pip3 install capstone

14. For reverse engineering of Linux examples, we will use the venerable GDB.  But, we're going to make it better to work with for our purposes.  We're going to use Zach Riggle's PEDA to help us in our analysis.  Maybe this series will convert over to his pwndbg toolset in the future, but for now, we will use PEDA.  First, we need to make sure we have a Git client so we can pull down the latest version.  In Terminal, type:

sudo apt-get install git

15. Let's get PEDA.  In Terminal, type:

git clone https://github.com/zachriggle/peda.git ~/peda

16. Now type in:

echo "source ~/peda/peda.py" >> ~/.gdbinit

17. We should now have PEDA configured to run and work for us.  Let's try it out!  In Terminal, type:

gdb

18. This should launch the colorful and more helpful PEDA version of GDB.  We may have some warnings, but that's fine for now.  Let's exit the app as this should be good to go.  In gdb, type:

q

GDB has many commands, cheatsheets (print this out) and features for us to use.  For example, in the above, we typed in "q" which is short for "quit".  While Mavis Beacon would be proud that we can fully type out "info breakpoint 3" without looking at the keyboard, we can shorthand that to "i b 3".  In many examples, the full name of the command will be typed out, but then shortened in later sections.

This wraps it up for this preparatory post, but it'll set us up for future posts as we dig deep into these challenges!

SANS SEC660: Day 6 review: CTF and NetWars

If you're on the fence of what training to attend that will maximize your time and money, SANS SEC 660 at a large SANS event would be a great choice.  While I'm not paid nor endorsed by SANS to continually promote the value and excellence of this class, it's a natural byproduct of the experience.  With that said and as the title of the post implies, this post will cover the last day and both NetWars events.

The last day of the class is a capture the flag event/Jeopardy style event.  There were four categories (one was Linux and another was Windows) that had four challenges with point values of 100, 200, 300 and 400.  We broke off into self formed teams to start solving challenges which seemed to cover mostly the last two days of material.  Many challenges had straight forward questions to solve that were explained, demo'ed or labs from the prior days.

It wouldn't be much fun to give away more of the questions, but the advice I can give is to do all of the bootcamp exercises and additional material if applicable.  While it may not necessarily be the same techniques to solve the challenges, it'll help you out regardless in many ways.  It also helped our team to divide and conquer based on what we felt we were strong at.  At the start, one person focused on the Linux challenges, I focused on the Windows challenges and another focused on another category.  But, it's also helpful (as we did) to switch it up and dig into another category.  Most people in the room were tired from the long week and staring at a problem for a relatively long time can get you lost in the weeds.

We ended the CTF about 2:30p and then reviewed the various challenges.  Of course, when you see the answers, it's all obvious what you should and shouldn't have done.  It was still a great learning experience that helps reinforce that the more you do it (like many things in life), the better you get at it.  Of course if you only did this, that and the other thing, you'd have solved that challenge in 5 minutes just like Stephen did to pick up a cool 400 points.  As an aside, I pretty much can't go through this entire review series and not mention "Ram Bro".  I never heard of it before this class, but I'm pretty much a better person for experiencing it.  You should check it out.

It's good to see that the knowledge you gain from the class is expected to be applied to other situations at SANS.  The classic example is through their NetWars challenges held at many SANS events.  In our case, we had the opportunity to play for three nights for the Core NetWars challenge and one night for the CyberCity NetWars challenge.  Prior to the event and from peers, I knew a little bit about the events, but had no real detail of what it was like.  The first day of the SANS class, the instructors kept on promoting the events and told us that it was free to us since we had the 6 day course.  There was nothing to lose and there would be free drinks and appetizers as well as a fun challenge to compete in.  Many people signed up during the first break and I'm pretty glad I did.

The first night felt like being the new kid in class in the Core NetWars challenge room.  They opened up two classrooms to make it a giant room for people to compete.  Not only were there students from all of the classes, but people specifically came to this event to just play NetWars.  There are five levels to progress through with varying categories of challenges.  This is to help it to be accessible to all students in the SANS courses so it doesn't feel like an upper level classes only event.  With it being accessible to all students, that also means it has challenges across all of the classes.

The first two levels were played with a supplied Linux image to solve the questions.  Thankfully, you could attempt up to two tries for an answer.  If you didn't answer the question right the second time, it was negative points.  While they said that there would be cake... no, wait.  While they said that there would be clues to help you, I didn't really find this on the Core challenges in levels 1 thru 3 (I only got up to level 3).  There were clues in the CyberCity challenge that were available to help you and your team out.  Being that the questions could be solved with a Linux VM, all of the questions in those challenges centered around a Linux environment.  It certainly showed the versatility of the questions to help students from the various courses (e.g. Forensics, Pen Testing) use their new knowledge to solve the questions.  

There were giant screens being projected with the current rankings of the first 35 people or so which made it more competitive.  While I didn't offhand know the answers to all of the questions, I certainly learned as fast as I could to help figure it out!  If you go through this class material and the prep material I list in the previous posts, it'd help you answer a fair set of questions for the first few levels.  I didn't get to the last two levels, but from what people said and what the SANS instructors hint at, it'd be a lot of fun!  There's always the option to do the continuos NetWars challenge to get months of access and that could return a lot of value to you as well.  It would be fun to go back through the challenge and see what I could do with more time.  While it was a competitive event, it was a relaxed atmosphere that promoted learning and having fun with other people in the room.  The free drinks and appetizers may have also been a factor and it was certainly a nice addition.

There was definitely a different feel for the Core NetWars versus the CyberCity NetWars.  It was a nice break to have a night off from the Core NetWars to throw in the CyberCity challenge.  The basic premise of CyberCity is that you're trying to control various "sections" of a fictitious city.  For instance, there's a residential area, a water treatment area, airport/military district and others.  We used the same big room as with the Core NetWars, but we were then sectioned off into various starting areas.  Our section was the water treatment section which had us start with a specific selection of questions.  Once our general area was sectioned off, it was about every two rows of tables were then set up to be a team.  That made it an interesting twist to work with people you may not necessarily know and try to work together as a team.  Our team did pretty good and we were able to solve all of our first area challenges to then move onto the rest of the area challenges.  Overall we did good and placed either second or third as a team.  It was fun and further helped me learn more about various topics I had read about and/or only had a little bit of hands-on exposure.

The bonus sessions offered by SANS are worth attending and can provide you value in many ways.  While it was nice to attend various SANS bonus sessions offered by teachers on specialized subjects, participating in the NetWars challenges was a lot of fun.  You can certainly do whatever you want after the class is over and it can be hard to do more learning/challenges at night.  Some sessions may or may not be applicable and/or interesting to you.  I would recommend that if NetWars is available, you should try it out for a night, especially since it could be free.  It may not click for you, but at least you tried it and gave it a shot.  But, it could open your eyes to a whole new set of interests and experiences you may not have had the time to explore.

SANS SEC660: Day 5 review: Exploiting Windows for Penetration Testers

The course and experience of going to the SANS SEC660 course has been amazing.  I previously attended a SANS course, but did it remotely through their online offering.  While it was simultaneously done as the in-person class, I felt a deep disconnect to the experience there.  I have done other online courses for various IT things and the SANS online course felt a lot like those.  Disconnected.  I couldn't really connect with the other classmates.  I didn't feel like if I had questions I would as easily understand it as if I was there in class.  

Being at the SANS course in-person was a completely different experience.  Sure I could have done the class remotely as well as the bonus sessions like NetWars.  However, it just feels like a great time being around all of the other folks hacking away at the NetWars challenges in a giant room.  It was a great time meeting people, working with them on challenges, learning alongside them and having fun.  That is what it felt like being there at the conference.  Having fun.

The previous day and night were pretty stellar events.  The previous day was a crash course in Linux exploitation and stretching my mind to quickly understand a lot of new concepts and ideas.  At night, it was a special NetWars as SANS brought out their CyberCity challenge.  Previous NetWars nights were the Core NetWars challenge where you challenged everyone.  The CyberCity NetWars challenge was a random grouping of people to work on challenges together.  That was a pretty fun learning experience as well as fun in general.  But, more on that in another post!  Day 4 was a great day and night to be at the conference.  Let's get on with the Day 5 review.

Here are the events from the SANS website of the contents of this day:

- The state of Windows OS protections on Windows 7, 8, 10, Server 2008 and 2012
- Understanding common Windows constructs
- Stack exploitation on Windows
- Defeating OS protections added to Windows
- Creating a MetaSploit module
- Advanced stack-smashing on Windows
- Using ROP
- Building ROP chains to defeat DEP and bypass ASLR
- Windows 7 and Windows 8 exploitation
- Porting MetaSploit modules
- Client-side exploitation
- Windows Shellcode

The list above was a tall order of material to fit into one day.  We certainly felt the weight of the materials by the end of it.  Going through the previous day's materials did help prepare us for today and the techniques necessary to exploit Windows.  It was time to dig into Windows and learn more about the internals of Windows!

The day started with the internals of Windows covering memory layout in the OS, PE file structure and linking.  It was a good refresher and it was good to dive a bit deeper in other parts as Steve relayed various tidbits of information through various rabbit holes.  We covered Windows debuggers such as OllyDBG (briefly) and Immunity Debugger.  Immunity was the main debugger we used throughout the day for various exercises such as going through a random binary to examine various sections of a PE.  Going through materials like Ange Albertini's examinations of PE files (here and here) would be pretty helpful to pick up this module faster.  Each module has an additional reading/resource section as well to better learn the covered material, so it was good to see those things.  It was a crash course through the Windows Internals books to get us ready to exploit Windows.

We covered the various methods Windows uses to protect Windows and how those methods evolved over the versions of Windows to today.  It is interesting to see the methods that Windows borrowed and improved upon for their protection methods.  Steve gave a talk about EMET and the various Windows mechanisms that were implemented over the years across Operating Systems.  There's certainly been no lack of trying, although it is seemingly hard how to balance usability versus security.  You can certainly completely STIG and/or turn EMET to full protection lockdown, but then the OS isn't as useable as before.  Balancing that with system and business requirements to the best possible protection is hard.  But, that's not our story for today, but how to exploit them!  As a quick note, Steve did do a "preview" for the class talking about these things above in this webcast.  It was pretty good!

It's interesting how different people and tutorials approach Windows debugging and user land exploitation.  In some cases like in the SANS training, Immunity Debugger was used.  In the OpenSecurity and Windows Exploit Dev course, they use WinDBG.  The Corelan tutorial uses mainly WinDBG with some Immunity Debugger.  It is advantageous though to be familiar with both debuggers for Windows.  For the purposes of this class, knowing how to work in the various windows and menus in Immunity will help you out.  It's not necessarily an issue with the main screen, but knowing how to run mona.py, see that output to then go back to the main screen can be confusing at first.  The usage of Immunity is kept to the basics to help get the student familiar with the product and not bury them in various sub-screens that Immunity provides.

We covered a lot of technical discussion on DEP, ASLR and using ROP gadgets.  It felt like most of the afternoon was spent working with ROP based exploitation techniques against our vulnerable software.  There were different exercises on using ROP gadgets which helped to absorb the information we were given.  Stephen would talk about the exploit technique, do a demo and then have us do the demos on our own.  If you're new to Windows exploitation, it would be a bit challenging to go through all of the exercises in time.  Luckily you can bring it all home to work on later.  You can of course copy and paste the answers from the book to proceed through the labs, but it may not help you fully understand what's going on without trying without it.

The MetaSploit module section was interesting and has applicability to pen testers and/or modifying exploits to fit your needs.  Many times, there's exploits in MetaSploit that target a specific patch level and system architecture.  But, there are opportunities to take that "shell", tweak it to your specific needs based on understanding how that exploit works, figuring out the offsets for your target and then repackaging up the exploit.  Rather than being a user of MetaSploit, you can go beyond that by taking what other's have started for you and go further.  You would need to spend more time working with the class material to tweak exploits to your situation, but this class helps to get you going in that direction.  It was an overall short module, but a good example of how to use this class to suit your needs back in the world.

The last module before the bootcamp (where you refine your knowledge with more exercises) was Windows Shellcode.  I was looking pretty forward to this class as it's been a fun topic to learn more about.  Stephen has been a great teacher and explaining everything with deep technical detail.  With that, going over shellcode and multi-stage shellcode were easier pills to swallow.  There were good labs and lots of links for further reading to know/learn more.  There's not enough time in a single day to cover all of this material so it was good to see that they didn't leave it at only their materials to learn more from.  A lot of the topics (especially Day 4 and Day 5) had research links/books to learn from that had been where these techniques in the book came from in some cases.

Going into this day had been a bit tough from the week's activities.  There had been three nights of NetWars and other sessions at night.  But, it had been a lot of fun and challenging.  We still had one more day left, but it was a most of the day challenge.  Steven went through the categories of the challenge and it was set up in a Jeopardy style challenge.  It was similar to the NetWars challenges where you enter a md5 hash of the answer into an answer text box.  The class CTF looked like it would be a lot of fun and the coin for SEC660 is pretty neat which would be awarded to the winning team.  Stay tuned for the closing review post!

Day 5 prep:
- OpenSecurity Training: Exploits 2
- Windows Exploit Development Course
- Corelan Exploit Tutorial series
- Immunity Tutorials:  First, Second

SANS SEC660: Day 4 review: Exploiting Linux for Penetration Testers

One of the main reasons I wanted to attend the SANS SEC660 course was to better learn Linux and Windows exploitation.  I had done work on my own, but sometimes an issue would come up, or I would get curious about a subject, follow some rabbit holes and get to a point where I had to stop for the time being (e.g. sleep).  Going to a training event like this was very exciting as not only would I learn more about Linux/Windows exploitation and various methods to accomplish that, but I would also learn more about fuzzing and being at a SANS event for NetWars.  As expected based on the course so far, these two days would be the biggest and most intense.  Both subjects have their own nuances and ways of going about exploitation to privilege escalation.

As we have done previously, let's list and go through the day's agenda from the course's page:

- Stack and dynamic memory management and allocation on the Linux OS
- Disassembling a binary and analyzing x86 assembly code
- Performing symbol resolution on the Linux OS
- Identifying vulnerable programs
- Code execution redirection and memory leaks
- Identifying and analyzing stack-based overflows on the Linux OS
- Performing return-to-libc (ret2libc) attacks on the stack
- Return-oriented programming
- Defeating stack protection on the Linux OS
- Defeating ASLR on the Linux OS

The class started off with an introduction to memory layout and registers.  It was a quick introduction to the topic though and while I had already been familiar with these concepts, the fast pace could potentially leave some students behind.  Going through basic x86 assembly was good as well, but that also went fast.  Prior to the class, I went through the Intro to x86 course and didn't have any issues with the content, but I have no idea about the other people.  Some knew what was going on, but it seemed that there were others who were being exposed to subjects like a function prologue and epilogue sequence.  Definitely having exposure to x86 like in the class above would greatly help you pick up the topics first introduced today.  Not knowing what the EIP was and it's importance, to suddenly being introduced to the topic and keeping track of EIP, ESP, EBP, ECX and everything else could potentially be confusing if you've never really dug into it.

I would have been even better prepared for the class had I have done the Intro to Software Exploits class as well.  The topics of stack smashing, format strings exploiting, bypassing ASLR, defeating stack canaries can be daunting at first, especially when you're going fast.  I'm not trying to imply that we moved too fast to understand the material, but we only had so much time allocated to the material and labs where we had to continue moving on.  Steve did stop a bit to take questions, make sure we understood what was going on, but again, there's more content than time.

Even if you didn't go through the Intro to Software Exploits class, this course was still good and prepared you for the exploit techniques you would immediately begin practicing after learning.  There definitely is value though of doing the prep work as above and still going to this class.  Steve went into a lot of detail and rabbit holes about various low level topics relevant to the material.  Again, having exposure to that prior to the class, a person could better appreciate the material and information and use it to better their understanding.  Hearing about the TLB and random information about it without knowing anything about it can make it a bit harder to understand before knowing what it even means.

If you're going to talk about Linux exploitation, you'll probably run into the GNU debugger at some point in time.  Many people prefer to look at information in a GUI rather than staring at a command line.  If you are in that camp and never really got into gdb, WinDBG, etc it could be a little bit daunting when you fire up gdb for the first few times.  GDB is a great and free Linux debugger that is a staple for many people when they take apart code.  While there are many great extensions to gdb (e.g. Zach Riggle's PEDA regular PEDA, gef) to make it more friendly/useable for exploitation, we just stuck to the basic gdb version.  There was some hand-holding, but not much time was spent in one place for too long before moving on.  Along with working with gdb, you may also use objdump to check out ELF files.

Based on other resources on the same subject, smashing the stack, going over return-orientated programming (ROP) and performing return-to-libc attacks are common courseware topics.  If you haven't had much hands-on experience, it may be a little intimidating at first especially as you need to quickly pick up certain concepts.  Steve and the courseware go into good detail of the how and why, but there isn't much time given to digest and fully absorb the material.  You move from one topic to the next and build upon the topics to more elaborate exploitation scenarios.  Steve went through the progression of stack protection mechanisms and how they continued to adapt such as with stack canaries.  Evading stack canaries was covered and we had the opportunity to put that knowledge of exploitation into practice with labs.

We were receiving a lot of awesome information, but it was a torrential downpour of information.  Last, but not least, we talked about ASLR on Linux and how to defeat it.  A lot of topics that we covered in Linux also have similar mechanisms on Windows.  Learning how to defeat ASLR on Linux also helped us for the next day when we talked about it in the Windows day.  Without going into too much more detail of how it was presented and how we better cemented the knowledge into our brains, I will say that it was well done.  Regardless of how much (or little) time we had, it never felt like we moved on from a point where we were lost.  It felt like everyone got to a "good enough" state where they grasped the concept.  We could implement the exploit given to us and comprehend the lesson behind the lab.  While we weren't experts at fully knowing completely why certain things worked as they did, it was meant to get you headed in the right direction.

This day was certainly packed full of information and it was also the last night for the Core NetWars.  Many topics covered today though had applicability to the next day with Windows, so it wouldn't be another day full of new topics.  Going full steam for four days for around 9 to 10 hours of class, doing bonus sessions/NetWars at night, talking with the family, staying up beyond that with reading/learning more while working on the NetWars challenges was starting to wear down on me.  There were still two days to go, but it was a good feeling knowing that I was definitely learning and growing rapidly with all of this new knowledge.  While I mention in this article and others of resources outside of SANS, there still is a lot of great value in still doing those other resources and going to this class.  I think that by doing the prep work mentioned and other resources you may find will help you have a greater foundation to build upon for this class.

Day 4 prep:
- Intro to x86
- Intro to Software Exploits
- ELF