4

I am taking a Sec Lab class and we've been sectioned into teams and tasked with 'attacking' the other teams while 'defending' against them.

Each team is set up with 4 VMs, and we have a few days to harden them. ALL VMs live on a single server which we have physical access to (it's in the lab room). Each VM will be loaded with a flag.txt file which we cannot hide/modify/encrypt etc. The goal is to simply gain entry into other teams' VMs.

I am wondering -- since I have physical access to the server, is there any way for me to tap into all of the VMs and bypass the designated passwords? Or to inject keyloggers or something of the sort in order to collect all of the passwords?

For obvious reasons, I won't be asking this in class, but I am curious.. since everyone is focusing on plans of attack via port scans, mitm network spoofing, etc.. I am thinking of different, less brunt, approaches.

If anyone could offer some advice on what I could actually do after physically plugging into the VM farm server, please let me know!

  • Open services on the host OS, plant a backdoor account with access to the hypervisor, then simply log in and disable all their protections? – schroeder Apr 23 '18 at 10:07
  • 4
    Befor you use physical access, you might want to check with course administrators to see if this is allowed. Competitions like this often exclude physical attacks. – Anders Apr 23 '18 at 10:35
  • 1
    Can't you change the root password of VMs via GRUB? askubuntu.com/questions/24006/… – xandfury Apr 23 '18 at 10:59
  • 1
    In short, if you have enough skill and determination, just about anything you want. – SuperAdmin Apr 23 '18 at 14:03
  • 1
    What can't you do with physical access is probably a better question – Anthony Russell Jul 22 '18 at 14:42
1

What you can do will to certain extent depend on the setup they have. For example, if they have full disk encryption, you can't extract the flag directly from the host OS.

Also, you can monitor their network traffic (and MITM it), but if they know what they are doing, it should all be encrypted.

However, you can always try to memory-hack the OS, as RAM will not be encrypted. By accessing the memory, you should be able to read any keys, as long as you can locate them. You can also attempt to modify the code running on the machine by simply rewriting (injecting malware) a running process with root privileges or just modifying the security software (disable checks, make it accept any password/key whatever else you need). Again, you need to be able to locate what you want to change and figure out how to change it, which may not be easy.

  • That sounds good.. I doubt a lot of teams will know to set up full disk encryption. Could you provide a few links / refs on how I might go about tapping into all of this? I’ve never done this sort of thing – stillot2 Apr 23 '18 at 10:26
  • @stillot2 All of it depends on the used VM, host OS and VM OS. Try to check for a tool to open the data file of your VM. Note that setting up encryption of home directory in Linux is easy, it even prompts you to do so on installation, so if the flag is in home directory, this may not work. – Peter Harmann Apr 23 '18 at 10:30
  • @stillot2 To monitor the network, you can easily use any bog-standard capture software, such as WireShark. You will see the traffic as going to/from the VM. – Peter Harmann Apr 23 '18 at 10:31
  • @stillot2 Memory hacking is far beyond what I can teach you here and now. There are tools for editing memory on almost any OS, but without the knowledge of what to extract/edit and how, it will not be helpful to you. – Peter Harmann Apr 23 '18 at 10:32
  • Awesome. I have and understand wireshark so that's good.. and the whole class is on the same network, different IPs. Would I be just as well off capturing traffic from my own OS? Would there be a benefit to try to infiltrate host OS, install wireshark, and run from there? (I guess I could see the decrypted streams?) – stillot2 Apr 24 '18 at 5:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.