{"id":309,"date":"2015-12-28T11:33:24","date_gmt":"2015-12-28T11:33:24","guid":{"rendered":"http:\/\/www.herbiez.com\/?p=309"},"modified":"2015-12-28T14:12:55","modified_gmt":"2015-12-28T14:12:55","slug":"sans-holiday-hack-challenge-part-ii","status":"publish","type":"post","link":"https:\/\/www.herbiez.com\/?p=309","title":{"rendered":"SANS Holiday Hack Challenge \u2013 Part II"},"content":{"rendered":"

So continuing from my original post<\/a> about the SANS 2015 Hack Challenge, here is my quick write up about exercise two.<\/p>\n

Exercise 2
\n==========
\n> What operating system and CPU type are used in the Gnome? What type of web framework is the Gnome web interface built in?
\n– System<\/p>\n

– DISTRIB_ID=’OpenWrt’
\n– DISTRIB_RELEASE=’Bleeding Edge’
\n– DISTRIB_REVISION=’r47650′
\n– DISTRIB_CODENAME=’designated_driver’
\n– DISTRIB_TARGET=’realview\/generic’
\n– DISTRIB_DESCRIPTION=’OpenWrt Designated Driver r47650′
\n– DISTRIB_TAINTS=”<\/p>\n

– CPU:\u00a0ARM version 1 (SYSV)
\n– Gnome web framework:\u00a0Looks to be node.js<\/p>\n

> What kind of a database engine is used to support the Gnome web interface? What is the plaintext password stored in the Gnome database?<\/p>\n

– MongoDB since there is a mongodb.conf file that points to dbPath: \/opt\/mongodb\/
\n– Username and Password was found using strings against the gnome.0 file
\n– username admin \/ password SittingOnAShelf<\/p>\n

Notes
\n=====
\n– Extracted bin file via 7Zip. Started to look around at files\/dirs.
\n– Looking through the filesystem, came across the following files that give info about the OS<\/p>\n

> \/etc\/openwrt_release and \/etc\/openwrt_version<\/p>\n

– Grepped for ‘shadow’ and saw the path – C:\\Users\\Administrator\\Desktop\\Working\\giyh-firmware-dump\\bin\\login.sh<\/p>\n

> I could never find a shadow file though<\/p>\n

– To verify that there was no massive difference between just uncompressing the bin file via 7Zip, I also used BinWalk and DD (which based on what I am seeing, there is a difference)<\/p>\n

> sudo binwalk ~\/Desktop\/giyh-firmware-dump.bin
\n> dd if=giyh-firmware-dump.bin of=filesys.squash skip=168803 bs=1
\n> sudo binwalk ~\/Desktop\/filesystem.squash<\/p>\n

– Running the Binwalk utility gave me the processor type<\/p>\n

> ELF, 32-bit LSB shared object, ARM, version 1 (SYSV)
\n> This was also verified by using “binwalk -A” (-A used for common opcode signatures) as it returned nothing but pointers for “ARM instrutions, function prologue”<\/p>\n

– Managed to get the filesystem (SquashFS) extracted using the squashfs-tools<\/p>\n

> unsquashfs – Both of the above commands (unsquashfs and dd) extract an image from the BIN file, with some differences between them (just not sure what)<\/p>\n

\"Differences<\/a>

Differences in folders – One on my SIFT system extracted via DD and the other from my Windows VM using 7Zip<\/p><\/div>\n

– Saw a service for MongoDB so most likely MongoDB is supporting the web framework<\/p>\n

> In the \/etc folder there is a mongod.conf file that points to the DB path (\/opt\/mongodb)
\n> Googled for what files would be in a Mongo DB instance, noticed that there was the gnome.0 and gnome.ns
\n> Ran strings on the gnome.0 file and could see the username\/password combo there<\/p>\n

– Only users on this system:<\/p>\n

> root:x:0:0:root:\/root:\/bin\/ash
\n> daemon:*:1:1:daemon:\/var:\/bin\/false
\n> ftp:*:55:55:ftp:\/home\/ftp:\/bin\/false
\n> network:*:101:101:network:\/var:\/bin\/false
\n> nobody:*:65534:65534:nobody:\/var:\/bin\/false<\/p>\n

– In the \/etc \/init.d folder could also see a nodejs file<\/p>\n

> This is most likely the web framework<\/p>\n

***Update: Figured out the difference between the images. The one that was extracted using ‘unsquashfs’ seems to be missing files versus the other two that I did using dd and 7Zip as you can see below (dd image on the left and unsquashfs on the right):
\n

\"Difference<\/a>

Difference between the filesystems<\/p><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"

So continuing from my original post about the SANS 2015 Hack Challenge, here is my quick write up about exercise two. Exercise 2 ========== > What operating system and CPU type are used in the Gnome? What type of web framework is the Gnome web interface built in? – System – DISTRIB_ID=’OpenWrt’ – DISTRIB_RELEASE=’Bleeding Edge’ – DISTRIB_REVISION=’r47650′ – DISTRIB_CODENAME=’designated_driver’ – DISTRIB_TARGET=’realview\/generic’ – DISTRIB_DESCRIPTION=’OpenWrt Designated Driver r47650′ – DISTRIB_TAINTS=” – CPU:\u00a0ARM version 1 (SYSV) – Gnome web framework:\u00a0Looks to be node.js > What kind of a database engine is used to support the Gnome web interface? What is the plaintext password…<\/p>\n

Continue reading<\/span><\/i><\/a> <\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-309","post","type-post","status-publish","format-standard","hentry","category-challenges"],"_links":{"self":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/309","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=309"}],"version-history":[{"count":8,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/309\/revisions"}],"predecessor-version":[{"id":320,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=\/wp\/v2\/posts\/309\/revisions\/320"}],"wp:attachment":[{"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=309"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=309"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.herbiez.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=309"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}