diff options
Diffstat (limited to 'presentation/ctf-guix-store.tex')
| -rw-r--r-- | presentation/ctf-guix-store.tex | 295 |
1 files changed, 295 insertions, 0 deletions
diff --git a/presentation/ctf-guix-store.tex b/presentation/ctf-guix-store.tex new file mode 100644 index 0000000..65ecebd --- /dev/null +++ b/presentation/ctf-guix-store.tex @@ -0,0 +1,295 @@ +\documentclass[notes]{beamer} +\usetheme{Rochester} +\usecolortheme{seagull} +\usepackage{svg} +\usepackage[export]{adjustbox} + +% \setbeameroption{show notes} + +\title{CTF — GNU Guix storefile mistake} + +\begin{document} + +\frame{ + \titlepage + \begin{figure}[h] + \includesvg[height=0.25\textheight]{Guix_logo_with_flag.svg} + \end{figure} +} + + +\begin{frame}{Functional package management in a pill} + \begin{itemize} + \item Dolstra, Eelco (2006). ``The Purely Functional Software Deployment + Model'' (Ph.D.). Utrecht University + \item pioneered by Nix \includesvg[height=\baselineskip]{Nix_logo.svg} + \item also employed by GNU Guix + \includesvg[height=\baselineskip]{Guix_logo.svg} + \item no Filesystem Hierarchy Standard (no /usr/bin, /usr/share, etc.) + \item packages live in a \textbf{store} directory, e.g. + \begin{itemize} + \item /gnu/store/y0d8ab1mi6lh0a3vpx5lyd4ksq9wbn4x-orc-0.4.32 + \item /gnu/store/9pypr3c3y379shbwm9ilb4pik9mkfd83-mesa-22.2.4 + \item /gnu/store/rv91v4s30kcjh7xq6k4l2njklk79frxk-freeglut-3.4.0 + \item /gnu/store/30zfbjasrsk2wg8nhsd1xgi3q3n9796z-less-608 + \end{itemize} + \item a daemon \includesvg[height=\baselineskip]{Awesome_Demon.svg} builds + packages from definitions and puts them in the store + \end{itemize} +\end{frame} + +\note{ + \begin{itemize} + \item we're using GNU Guix here (no, not the trademarked GUIX…) + \item store filename determine by hash of package inputs + definition + \item multiple versions of a package can coexist + \item per-project development environments + \item easy rollbacks + \item emphasis on reproducible builds + \end{itemize} +} + +\begin{frame}[fragile]{Functional package management in a pill (sample package)} + \small +\begin{verbatim} +$ cd /gnu/store/30zfbjasrsk2wg8nhsd1xgi3q3n9796z-less-608/ +$ find . -type f +./bin/less +./bin/lessecho +./bin/lesskey +./etc/ld.so.cache +./share/doc/less-608/LICENSE +./share/doc/less-608/COPYING +./share/man/man1/lessecho.1.gz +./share/man/man1/lesskey.1.gz +./share/man/man1/less.1.gz +$ ls -lh bin/less +-r-xr-xr-x 2 root root 192K Jan 1 1970 bin/less +\end{verbatim} +\end{frame} + +\note{ + \begin{itemize} + \item store is read-only (only Nix/Guix daemon can write) + \item store files are root-owned and world-readable => secrets must be managed + differently + \item dates set to Epoch (but ls -lch shows real creation time) + \item the same package won't be built twice, even if requested by multiple + users + \item a package will built again (or grafted) when one of its dependencies + gets updated + \item a package not in use can be garbage-collected + \item no support for quotas yet as of 2024 + \end{itemize} +} + +\begin{frame}[fragile]{Functional package management in a pill (declarative OS)} + \begin{itemize} + \item \textbf{packages} are defined declaratively + \pause + \item \textbf{services} are defined declaratively as well + \pause + \item service \textbf{configurations} are defined declaratively \textit{as + well}… {\small +\begin{verbatim} +(service httpd-service-type + (httpd-configuration + (config + (httpd-config-file + (server-name "www.example.com") + (document-root "/var/public_html"))))) +\end{verbatim} + } + \begin{itemize} + \item …and result in store files like + /gnu/store/54ywa5x1b75simbvzhxqkfxsjk040ail-httpd.conf + \end{itemize} + \item Yay, we can replace Ansible! But what about secrets? + \begin{itemize} + \item option 1: keep private keys and passwords outside the store + \item option 2: put them encrypted in the store + \end{itemize} + \end{itemize} +\end{frame} + +\note{ + \begin{itemize} + \item GNU Guix and Nix have their DSLs (the first one is actually Scheme Lisp + + some APIs) + \item on Guix/Nix server packages and configurations are immutable (we can + switch to different ones but not alter the existing ones) — convenient + \item an application may require database credentials, some API token, a + private key for TLS certificate, etc. + \item encrypted secrets in store — one master key kept outside the store + \end{itemize} +} + +\begin{frame}{Sensitive information exposure scenario} + challenge — password hunt in /gnu/store\\~\\ + + \textit{``You're an employee of a secret government agency. Analysis of + wiretap recordings have lead the agency to believe that an individual known + as Abdul Al-Inh-Ohn-Ih has come into possession of highly classified + government documents. If this turn out true and Abdul blows the whistle on + information from those materials, years of intelligence efforts shall be + ruined.\\~\\} + + \textit{Abdul has been using the Matrix protocol for some of his + communication. Your current task is to get access to his Matrix account. + Start your investigation by taking a look at his blog.''} +\end{frame} + +\note{ + A user of certain shared GNU Guix system has put a secret (a password) in + /gnu/store by mistake. The CTF competitioneer has to SSH into another account + on said system and find the password. + + \begin{itemize} + \item we have some lore + \item real-world references might be intended or not… + \item no direct info about the exposures (one needs to figure this out) + \end{itemize} +} + +\begin{frame}{Investigation (Abdul's blog)} + \includegraphics[ + height=\dimexpr\textheight-0.5cm\relax, + center + ]{screenshots/abdul-blog-index.png} +\end{frame} + +\note{ + \begin{itemize} + \item language — itself a hint Abdul is likely to make mistakes + \item only the few relevant blog entries (no misleading of competitioneers) + \item mechanics of Guix relevant to the challenge are touched in the posts + \item some extra effort required — obtaining a Gemini browser + \end{itemize} +} + +\begin{frame}[fragile]{Investigation (peeking through Gemini)} + \includegraphics[ + height=\dimexpr\textheight-0.5cm\relax, + center + ]{screenshots/gemini-capsule.png} +\end{frame} + +\note{ + \begin{itemize} + \item most relevant parts of blog only accessible through Gemini (a lightweight + alternative to HTTP) + \item a Gemini browser ``Lagrage'' recommended in HTTP part of Abdul's blog + \end{itemize} +} + +\begin{frame}[fragile]{Investigation (Spotting mistakes)} + configuration which hits a mistake is included in Abdul's blog + \footnotesize +\begin{verbatim} +;;; ... +(list (shepherd-service + (provision '(mattermost)) + (modules '((shepherd support))) ;for '%user-log-dir' + (start #~(make-forkexec-constructor + '(#$(file-append matterbridge "/bin/matterbridge") + "--conf" + #$(local-file "config.toml")) + #:log-file (string-append %user-log-dir + "/matterbridge.log"))) + (stop #~(make-kill-destructor)) + (documentation "Start local matterbridge."))))) +;;; ... +\end{verbatim} +\end{frame} + +\note{ + \begin{itemize} + \item the config suggests Matrix password is in config.toml in /gnu/store + \end{itemize} +} + +\begin{frame}{Investigation (Account creation)} + \includegraphics[ + height=\dimexpr\textheight-0.5cm\relax, + center + ]{screenshots/account-creation.png} +\end{frame} + +\note{ + \begin{itemize} + \item both Abdul's blog and the server's main website urge one to make an + account and log in to the tilde server with SSH + \item emails entered not actually used + \end{itemize} +} + +\begin{frame}{Hint 1} + \includegraphics[ + height=\dimexpr\textheight-0.5cm\relax, + center + ]{screenshots/hint1.png} +\end{frame} + +\note{ + \begin{itemize} + \item page with the hint accessible through Gemini only + \end{itemize} +} + +\begin{frame}{Hint 2} + \includegraphics[ + height=\dimexpr\textheight-0.5cm\relax, + center + ]{screenshots/hint2.png} +\end{frame} + +\note{ + \begin{itemize} + \item link to GNU Guix HTML documentation + \item suggestion that it has sth to do with the local-file macro (used in + Abdul's code) + \end{itemize} +} + +\begin{frame}[fragile]{Finding the flag} +\begin{verbatim} +~$ (cd /gnu/store && ls -cht *config.toml*) +qmdh299prllp4fygw893w00lv9ypi5z2-config.toml +~$ +\end{verbatim} + +rather expected contents of qmdh299prllp4fygw893w00lv9ypi5z2-config.toml + +\small +\begin{verbatim} +# ... +[matrix.noevil-pl] +Server="https://matrix.noevil.pl" +Login="abdul" +Password="fla\u0067{full_source-bootstrap}" +RemoteNickFormat="[{PROTOCOL}] <{NICK}> " +NoHomeServerSuffix=false +# ... +\end{verbatim} +\end{frame} + +\note{ + \begin{itemize} + \item ``g'' in flag replaced with unicode escape to make bypassing with + recursive grepping harder + \end{itemize} +} + +\begin{frame}{Credits} + \begin{itemize} + \item GNU Guix logo — \copy 2015 Luis Felipe López Acevedo (CC BY-SA 4.0 + International) + \item red flag — by Wikipedia user Wereon, uploaded 2007 (released into + public domain) + \item Nix logo — \copy 2016 Tim Cuthbertson (CC BY-SA 4.0 International) + \item Awesome Demon — by Openclipart user qubodup, uploaded 2014 (released + into public domain with CC Zero v1.0) + \end{itemize} +\end{frame} + +\end{document} |