-
-
Notifications
You must be signed in to change notification settings - Fork 393
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'master' into experiment-bed
- Loading branch information
Showing
19 changed files
with
219 additions
and
18 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
127 changes: 127 additions & 0 deletions
127
src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge19.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,127 @@ | ||
| package org.owasp.wrongsecrets.challenges.docker; | ||
|
|
||
|
|
||
| import com.google.common.base.Strings; | ||
| import lombok.extern.slf4j.Slf4j; | ||
| import org.apache.commons.io.FileUtils; | ||
| import org.owasp.wrongsecrets.RuntimeEnvironment; | ||
| import org.owasp.wrongsecrets.ScoreCard; | ||
| import org.owasp.wrongsecrets.challenges.Challenge; | ||
| import org.owasp.wrongsecrets.challenges.Spoiler; | ||
| import org.springframework.core.annotation.Order; | ||
| import org.springframework.stereotype.Component; | ||
| import org.springframework.util.ResourceUtils; | ||
|
|
||
| import java.io.*; | ||
| import java.util.List; | ||
|
|
||
| import static org.owasp.wrongsecrets.RuntimeEnvironment.Environment.DOCKER; | ||
|
|
||
| @Component | ||
| @Order(19) | ||
| @Slf4j | ||
| public class Challenge19 extends Challenge { | ||
|
|
||
| public static String ERROR_EXECUTION = "Error with executing"; | ||
|
|
||
| public Challenge19(ScoreCard scoreCard) { | ||
| super(scoreCard); | ||
| } | ||
|
|
||
|
|
||
| @Override | ||
| public Spoiler spoiler() { | ||
| return new Spoiler(executeCommand("")); | ||
| } | ||
|
|
||
| @Override | ||
| public boolean answerCorrect(String answer) { | ||
| return executeCommand(answer).equals("This is correct! Congrats!"); | ||
| } | ||
|
|
||
| public List<RuntimeEnvironment.Environment> supportedRuntimeEnvironments() { | ||
| return List.of(DOCKER); | ||
| } | ||
|
|
||
|
|
||
| private boolean useX86() { | ||
| String systemARch = System.getProperty("os.arch"); | ||
| log.info("System arch detected: {}", systemARch); | ||
| return systemARch.contains("amd64") || systemARch.contains("x86"); | ||
| } | ||
|
|
||
| private boolean useLinux() { | ||
| String systemARch = System.getProperty("os.arch"); | ||
| log.info("System arch detected: {}", systemARch); | ||
| return systemARch.contains("amd64"); | ||
| } | ||
|
|
||
| private File retrieveFile(String location) { | ||
| try { | ||
| log.info("First looking at location:'classpath:executables/{}'", location); | ||
| return ResourceUtils.getFile("classpath:executables/" + location); | ||
| } catch (FileNotFoundException e) { | ||
| log.debug("exception finding file", e); | ||
| log.info("You might be running this in a docker container, trying alternative path: '/home/wrongsecrets/{}'", location); | ||
| return new File("/home/wrongsecrets/" + location); | ||
| } | ||
| } | ||
|
|
||
| private File createTempExecutable() throws IOException { | ||
| File challengeFile; | ||
| if (useX86()) { | ||
| challengeFile = retrieveFile("wrongsecrets-c"); | ||
| if (useLinux()) { | ||
| challengeFile = retrieveFile("wrongsecrets-c-linux"); | ||
| } | ||
| } else { | ||
| challengeFile = retrieveFile("wrongsecrets-c-arm"); | ||
| } | ||
| //prepare file to execute | ||
| File execFile = File.createTempFile("c-exec-challenge19", "sh"); | ||
| if (!execFile.setExecutable(true)) { | ||
| log.info("setting the file {} executable failed... rest can be ignored", execFile.getPath()); | ||
| } | ||
| OutputStream os = new FileOutputStream(execFile.getPath()); | ||
| ByteArrayInputStream is = new ByteArrayInputStream(FileUtils.readFileToByteArray(challengeFile)); | ||
| byte[] b = new byte[2048]; | ||
| int length; | ||
| while ((length = is.read(b)) != -1) { | ||
| os.write(b, 0, length); | ||
| } | ||
| is.close(); | ||
| os.close(); | ||
|
|
||
| return execFile; | ||
| } | ||
|
|
||
| private String executeCommand(File execFile, String argument) throws IOException, InterruptedException { | ||
| ProcessBuilder ps = new ProcessBuilder(execFile.getPath(), argument); | ||
| ps.redirectErrorStream(true); | ||
| Process pr = ps.start(); | ||
| BufferedReader in = new BufferedReader(new InputStreamReader(pr.getInputStream())); | ||
| String result = in.readLine(); | ||
| pr.waitFor(); | ||
| return result; | ||
| } | ||
|
|
||
|
|
||
| private String executeCommand(String guess) { | ||
| if (Strings.isNullOrEmpty((guess))) { | ||
| guess = "spoil"; | ||
| } | ||
| try { | ||
| File execFile = createTempExecutable(); | ||
| String result = executeCommand(execFile, guess); | ||
| if (!execFile.delete()) { | ||
| log.info("Deleting the file {} failed...", execFile.getPath()); | ||
| } | ||
| log.info("stdout challenge 19: {}", result); | ||
| return result; | ||
| } catch (IOException | NullPointerException | InterruptedException e) { | ||
| log.warn("Error executing:", e); | ||
| return ERROR_EXECUTION; | ||
| } | ||
|
|
||
| } | ||
| } |
Binary file not shown.
Binary file not shown.
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| === Obfuscating part 1 the C binary | ||
|
|
||
| We need to put a secret in a mobile app! Nobody will notice the secret in our compiled code! | ||
| This is a misbelief we have often encountered when presenting on mobile security topics. | ||
|
|
||
| Let's debunk this myth for C: can you find the secret in https://github.com/commjoen/wrongsecrets/tree/master/src/main/resources/executables/wrongsecrets-c[wrongsecrets-c] (or https://github.com/commjoen/wrongsecrets/tree/master/src/main/resources/executables/wrongsecrets-c-arm[wrongsecrets-c-arm], https://github.com/commjoen/wrongsecrets/tree/master/src/main/resources/executables/wrongsecrets-c-linux[wrongsecrets-c-linux])? |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| This challenge is specifically looking at a secret in a C binary | ||
|
|
||
| You can solve this challenge using the following steps: | ||
|
|
||
| 1. Find the secrets with https://ghidra-sre.org/[Ghidra]. | ||
| - Install https://ghidra-sre.org/[Ghidra]. | ||
| - Start it whit `ghidraRun`. | ||
| - Load the application `wrongsecrets-c` into ghidra by choosing a new project, then import the file and then doubleclick on it. | ||
| - Allow the Ghidra to analyze the application. | ||
| - Search for the secret: Go to `Functions` on the left-hand side, select `_secret` . Now on the screen on the right-hand side you can see the secret. This is a string in C. | ||
| - Search for the secret, which is "hidden" as a char array: Go to `Functions` on the left-hand side, select `_secret2`. See that this returns a label on your right-hand side. Now open `Labels` on the left-hand side, select the label returned by `_secret2` (`_secret2.label`) and find the answer in the center. This is a Char array in C. | ||
| 2. Find the secrets with https://www.radare.org[radare2]. | ||
| - Install https://www.radare.org[radare2] with either `brew install radare2` on Mac or follow these steps: `git clone https://github.com/radareorg/radare2; cd radare2 ; sys/install.sh` | ||
| - Launch r2 analysis with `$ r2 -A wrongsecrets-c` | ||
| - Filter functions by term `secret` using afl: `afl~secret`, get the list of functions | ||
| - Use command `pdf @ sym._secret` to see disassembled output of function which returns secret | ||
| - Use command `pdf @ sym._secret2` to see disassembled output of function which returns secret2 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| *Why Using binaries to hide a secret will only delay an attacker.* | ||
|
|
||
| With beautiful free Reverse engineering applications as Ghidra, not a lot of things remain safe. Anyone who can load the executable in Ghidra or Radare2 can easily start doing a reconnaissance and find secrets within your binary. | ||
|
|
||
| Encrypting the secret with a key embedded in the binary, and other funny puzzles do delay an attacker and just make it fun finding the secret. Be aware that, if the secret needs to be used by the executable, it eventually needs to be in memory ready to be executed. | ||
|
|
||
| Still need to have a secret in the binary? Make sure it can only be retrieved remotely after authenticating against a server. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
25 changes: 25 additions & 0 deletions
25
src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge19Test.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| package org.owasp.wrongsecrets.challenges.docker; | ||
|
|
||
| import org.assertj.core.api.Assertions; | ||
| import org.junit.jupiter.api.Test; | ||
| import org.junit.jupiter.api.extension.ExtendWith; | ||
| import org.mockito.Mock; | ||
| import org.mockito.Mockito; | ||
| import org.mockito.junit.jupiter.MockitoExtension; | ||
| import org.owasp.wrongsecrets.ScoreCard; | ||
| import org.owasp.wrongsecrets.challenges.Spoiler; | ||
|
|
||
| @ExtendWith(MockitoExtension.class) | ||
| class Challenge19Test { | ||
|
|
||
| @Mock | ||
| private ScoreCard scoreCard; | ||
|
|
||
| @Test | ||
| void spoilerShouldNotCrash() { | ||
| var challenge = new Challenge19(scoreCard); | ||
|
|
||
| Assertions.assertThat(challenge.spoiler()).isNotEqualTo(new Spoiler(Challenge19.ERROR_EXECUTION)); | ||
| } | ||
|
|
||
| } |