Lab 01 - Recover the Grades Application

At the end of this lab, you should be able to:

• use basic Linux commands during a security investigation;
• use Python to automate repetitive tasks;
• inspect and repair files based on their format;
• identify hidden or embedded content;
• interact programmatically with a web application;
• use a new security analysis tool;
• relate practical security problems to the concepts discussed during the first lecture.

The university has recovered an old application used for managing student grades

. As with any homework project the documentation is incomplete. You have received only two files and some messages from the administrator:

pass.txt
bla.zip

Your goal is to recover the application, start it, authenticate to it and find the forgotten administrative interface.

The administrator left the following message:

I am a security guy, so protected them using Base64. Several times.

You received:

pass.txt

Recover the original information. Decode the Base64 outer layers until you obtain readable information. At the end of this exercise you should have a list of possible passwords.

Save the result as:

passwords.txt

The second file provided by the administrator is:

bla.zip

Unfortunately, it is password protected using one of the passwords contained in passwords.txt.

Write a small Python program that:

1. reads the passwords from passwords.txt;
2. tries each password against bla.zip;
3. stops when the correct password is found;
4. extracts the archive.

Python provides the following module:

import zipfile

You may find the documentation for ZipFile.extractall() useful.

At the end of this exercise you should have a directory containing the recovered grades application.

You now have the application files but you don't know which file contains the application configuration. The configuration file has all of the following properties:

• human-readable;
• exactly 987 bytes in size;
• not executable.

Find it.

You should discover a server configuration similar to:

[server]
host = 0.0.0.0
port = 0

Change the configuration port to 8080 and start the recovered environment:

docker compose up -d --build

Check whether the application is running:

curl http://localhost:8080

The application should now display a login page.

The administrator password is in the

static/admin-screenshot.png

Unfortunately, the screenshot appears to have been corrupted while it was being transferred.

Try inspecting the file:

file admin-screenshot.png

Something is wrong with the file header.

A valid PNG file starts with the following bytes:

89 50 4E 47 0D 0A 1A 0A

After repairing the file:

1. verify it again using file;
2. open the screenshot;
3. recover the administrator username and password.

Use the credentials to log in to the grades application.

The administrator remembers that he also provided a admin-backup.hex file dump with the list of app's API endpoints. However, it got mixt into the screenshot file. Look again at:

admin-screenshot.png

The screenshot is not particularly large or detailed, however the file is considerably larger than expected.

Start by running:

binwalk admin-screenshot.png

Remember that filenames and extensions are not always trustworthy.

Using admin-backup.hex you discovered that the administrator apparently had a complicated backup procedure. The file is a hexdump of another file, which has then been compressed and archived several times using different formats.

Reverse the process.

First convert the hexdump back into binary data using xxd.

xxd -r admin-backup.hex > recovered

Then determine what kind of file you have and use the corresponding tool to extract them. At the end you should recover:

web-paths.txt

You can now access the grades application and authenticate successfully. However, the administrator remembers that there used to be an older administrative interface. Nobody remembers its URL. Fortunately, web-paths.txt contains a list of possible paths used during development.

Write a Python program that searches for the forgotten endpoint.

Your program should:

1. read candidate paths from web-paths.txt;
2. request each path from the web application;
3. inspect the HTTP status code;
4. display interesting results.

The administrative interface should provide you with a GIF image.

The page contains one final piece of evidence recovered from the old grades application. When you access the page, your browser automatically downloads:

evidence.gif

Open the GIF. Nothing particularly interesting seems to happen. You can stare at it for the next hour if you want. Or you can investigate how animated GIF files actually work. Your goal is to recover the final flag from the GIF.

You may find tools for extracting individual GIF frames useful. For example, ImageMagick can separate an animated GIF into individual images. Inspect the resulting frames.

An animated GIF is not necessarily a single image.

Waiting for the animation to reveal everything may not be the best approach.

Login into Moodle and take the Lab01 quiz.