Incorporate two backdoors into the system.

[keyctl]

According to the assignment, two backdoors have to be included in the system for other teams to find them.

You must build two backdoors into your system. Both backdoors should allow remote access to the system(s) and compromise its purpose. The reviewers of your system will later have to search for these backdoors. Design and implement a first backdoor so that it will be nontrivial but likely for the reviewers to find it. Give your best effort when it comes to the second backdoor! Try to hide it so well that the reviewers will not find it. Do not forget to hide your traces in the end (e.g., shell history).

[keyctl]

What's the current state on this? Have we agreed on two backdoors yet?

[RequestForCoffee]

It's a pending action item for me. One backdoor is the nginx off-by-slash with some sort of debugging binary/sensitive config file that the directory traversal can use to gain admin access. The other is still an active question.

[Miro-H]

It's a pending action item for me. One backdoor is the nginx off-by-slash with some sort of debugging binary/sensitive config file that the directory traversal can use to gain admin access. The other is still an active question.

Another option is maybe, that we leak the private key with the path traversal attack, don't know if that is enough to "compromise the purpose of the system" though. You could impersonate the server, steal passwords and then request new certificates.

[Liblor]

@RequestForCoffee I added an example for inotify (b9a6e18), I think we could nicely hide the executable if we obfuscate it by using symbols (i.e. function names etc.) that look like they come from dotnet.

[RequestForCoffee]

@Liblor looks cool, just to clarify - would this binary be running as a background service?

[Liblor]

@RequestForCoffee yes, it would

[Liblor]

Maybe, we can hide the running process. ps looks at /proc/, so perhaps it's possible to use apparmor to restrict ps access to /proc 🤔

Edit: This looks interesting: https://sysdig.com/blog/hiding-linux-processes-for-fun-and-profit/

[RequestForCoffee]

Unfortunately, the nginx off-by-slash vuln can only traverse one parent directory up (watched OrangeTsai's DEFCON talk recording to confirm). To make it work, I got the config server's SSH key in ~/.ssh/id_rsa and got nginx to serve static content from ~/static/ (refer to 779bf4a). I'm not exactly happy with how "hacky" this looks, but without access to ansible scripts that do this (we are not sharing those, are we?), figuring out a way to get the key might be a little tricky.

I'd appreciate any ideas or input on this or on what to do for a second backdoor.

[Liblor]

No, the ansible config is available, because we have to backup the config files. We argue in the report that we don't have to backup the config files of each machine, because we keep the ansible configs that generate the config files...

[RequestForCoffee]

In that case the second bit of blatantly installing the SSH key has to go, back to square one :(

[Liblor]

Ah, and don't you think running a inotify binary in the background is less suspicious? Also we could simply not share the "backdoored" ansible script, that would work. The backdoor could be planted afterwards anyway.