Nebula VM Intro...

-
I was preparing for class when I recalled that it has been weeks since my first post then I thought to myself it's probably because of school, but remembered something I read in Phineas Fisher's paper "if not you, who? if not now, when?" and hence this post. The truth is during the past weeks I have gathered a lot of content for the blog, I just haven't had the time to properly document and post, so after a lot of thought I have decided to start with a walkthrough of the Nebula VM, there is already a lot of walkthroughs on the internet on this machine, but I thought one extra post won't hurt, moreover my aim is to make my post different from most technical post I have seen online, how do I plan to this? most posts I come across on the internet show how to do something, not why and I think that approach most of the time leaves a beginner confused, therefore what I intend to do on this blog is to show the reader why we do what we do.

 Disclaimer: All content on this blog are for educational intent only, but how you choose to use your knowledge is entirely left to you.

 About Nebula

 From the Author's site:
Nebula takes the participant through a variety of common (and less common) weaknesses and vulnerabilities in Linux. It takes a look at

  • SUID files
  • Permissions
  • Race conditions
  • Shell meta-variables
  • PATH weaknesses
  • Scripting language weaknesses
  • Binary compilation failures
At the end of Nebula, the user will have a reasonably thorough understanding of local attacks against Linux systems, and a cursory look at some of the remote attacks that are possible.

Lab Setup
  • Download Nebula VM (why?): this is the Linux virtual machine containing the exploit exercises we are going solve
  • Download & Install VirtualBox (why?): this allows you to run the Nebula VM that you downloaded in the previous step, although there are other options in my experience VirtualBox works well
  • Download & install Kali Linux (optional): this machine will be used to solve the exploit exercises
  • Host OS: Windows 10
Both Kali Linux and Nebula VM are configured with a Host-Only Virtual Box Network Adapter

PS: this post and the next few posts will be geared towards beginners, if anything is unclear you can always use the comment section or search google

Comments

Post a Comment

Popular posts from this blog

Before You Dive In...

-
I have always wanted to write, partly to improve my writing skills but also to document my research in reverse code engineering, software exploitation and computer programming in general, my current goal is to have at least a post a week, but since am just starting out I do not know how feasible that will be considering school and my need for quality over quantity. In the coming weeks, I will post on varying topics from software reverse engineering to exploitation and basically anything that interest me. My primary aim is just to cement my knowledge in my fields of interest by giving back to the community as I learn and hopefully along the way help someone trying to learn. A quick disclaimer though is that I am no professional at either writing or the subject on which I will be writing (at least for now),  am just trying to navigate through the vast ocean of knowledge hoping to pick one or two things along the way, so corrections, constructive criticism, and even unconstructive o...
Read more

OverTheWire: Bandit Lab

-
Image
Bismillahirrahmanirrahim (In the name of Allah the most gracious, the most merciful) So recently I and @electro decided to solve wargames and CTFs in the spirit of honing the skills and because we are preparing for something really important (another post for another day). We decided to start with the labs at overthewire  and the first on the list was Bandit Lab. Bandit Lab was a fun experience, mostly easy, except for one or two tricky levels, level 26 and level 33 in particular. This Labs weren't so difficult but required a bit of thinking outside the box, hence why am documenting them. NB : this writeup doesn't include our thought process while solving the levels Level 26 Level Description When we attempt to login to this level using the private key obtained from the previous level we get automatically logged out and since the level goal already informed us that we are dealing with a different shell, we need to figure out what it is and how to break out of it. Above is the ...
Read more

SSRF Notes: PortSwigger Labs Continued

-
Image
  Lab 3: SSRF with blacklist-based input filter Task :  This lab has a stock check feature which fetches data from an internal system.  To solve the lab, change the stock check URL to access the admin interface at http://localhost/admin and delete the user carlos.  The developer has deployed two weak anti-SSRF defenses that you will need to bypass. This Lab is just like the previous ones except that we need to bypass blacklist filters. This is what a normal request to the stock check feature looks like: Passing http://localhost/admin to the stockApi parameter does not work this time. we get this response: That's the filter blocking us. It turned out 127.0.0.1, localhost, admin are all blacklisted so cannot be used. So after trying a couple things the following was able to bypass the filter: We get the following response: So to complete the Lab we just proceed to delete carlos. And that's it Lab solved.
Read more