(Feb 11, 2015 07:18 PM)Matthew Shultz Wrote:  

PHP Code


<?php 
mount -t reiserfs 


What do you mean extended attributes? Read/write access?

Code

/dev/mapper/ghost-root

Chances are this is already mounted. I don't really understand the output of what you are giving. What command was run? What arguments? I can't really tell by the examples you have given.

(Feb 11, 2015 07:35 PM)pwntoken Wrote:  The command which I ran was:

Code

mount

It gave me the output sample you just saw. Now, I have to enumerate which one particularly is is Reifer FS? and yes, by EA i mean, r/w access.

(Feb 12, 2015 06:32 AM)Benign Wrote:  I don't see any reiserfs file systems mounted on your system.

---

Have you got a device on which to build your reiserfs filesystem?

If so, and you have already partitioned and built it, then just mount it to the apachelogs mount point with:

mount -t reiserfs /device/with/reiserfs /apachelogs/

It will mount it rw by default.

(Feb 12, 2015 01:11 PM)pwntoken Wrote:  and how about enumerating the devide (in-case I had no idea what device was created in the first place since it's a remote server and we were given to break into the box as per exam rules for penetration testing).

Now since, I do not know whaich device was created hich had the mount point and if it was REifer's FS, how do I go about enumerating these? so that I could complete my assignment of exploiting the Reifers FS with an exploit which requres a Reifers FS to be mounted first. The Linux kernel version used is exactly the same which the exploit was written for. Only that there are no immediate Refiers FS I can see from.

Code

mount -1

according to another user who replied in this thread. 🤫

(Feb 11, 2015 07:13 PM)pwntoken Wrote:  How do I mount ReiserFS filesystem with extended attributes?

(Feb 12, 2015 07:59 PM)MoonCakeRuler Wrote:  There's actually a mini-section about this on Hardened Linux From Scratch. Finally some use out of reading it. XD

But yeah, here's how you mount it. First, open your /etc/fstab file and add user_xattr to your file system's entry. For example, let's say /dev/sda5 is your ReiserFS partition. Your line may look like this:

Code

/dev/sda5   /directory/to/mount/on   reiserfs   defaults,user_xattr   0 2

You can then simply mount the file system as usual. If it was already mounted, you'll need to remount it.

I'm actually pretty sure that's how it's supposed to be done in your case as well. I checked the exploitdb script you linked to. If you check lines 54 through 60, you'll notice that the script is reading /etc/fstab and looking for the user_xattr option in that line.

I don't understand which filesystem you want to mount though. /dev/mapper/ghost-root seems to be ext4 already. And I'm not sure about /apachelogs. But hopefully you'll get the idea. If not, maybe someone can help once you provide some additional details.

(Feb 12, 2015 08:08 PM)pwntoken Wrote:  Okay if:

Code

/dev/mapper/ghost-root

If ext4, it there any way possible I convert the ext4 to Reiferfs as you have given the procedure and then mount the /dev/mapper/ghost-root instead?

(Feb 12, 2015 08:32 PM)MoonCakeRuler Wrote:  That may not be possible. I don't think there is a simple way to convert it, other than to you know, back up your stuff, boot into a live medium, re-format your filesystem to reiserfs and then retrieve your files. However, that is extremely messy, dangerous and I'm not sure if you can attempt that on your assignment.

In your original post you say that you want to mount /apachelogs? Can you provide details about it? Do you want to mount /apachelogs on a ReiserFS instead?

(Feb 12, 2015 10:23 PM)pwntoken Wrote:  no. It has been done. Thanks a ton to you. However, I made certain changes to the exploit you saw in the original code. I mouted the ReiferFS, but now, the python exploit code which I have modified says:

Code

File "root.py", line 38
    if ret != 0
      ^
SyntaxError: invalid syntax

Here is the code:

http://pastebin.com/raw.php?i=1raFye0A

(Feb 12, 2015 10:54 PM)MoonCakeRuler Wrote:  That's a rather simple error. :3 You forgot the colon at the end of the if statement. Your if statement should look like this:

Code

if ret != 0:

You've made the same mistake on the next if statement. Also, on the os.system() call to setfattr, you need to save the return integer to a new variable and use that in the if statement or you need to change that line (line 41) to look like this:

Code

ret = os.system('setfattr -n "user.hax" -v "hax" /var/log/apache_logs/data/team-edward')

And, don't forget the colons on line 42. Three changes all in all so far unless I missed something.

(Feb 13, 2015 09:19 PM)pwntoken Wrote:  Hey I changed the entire script and w00t. Thank you and kudos to you sir. Respected for the help.