2 kyu

Ruby’s Eleven

356 of 358duchess_of_objects
Description
Loading description...
Games
Security
Puzzles
Object-oriented Programming
View
AllIssuesQuestions1Suggestions1Show Resolved
  • Please sign in or sign up to leave a comment.
  • luifer321 Avatar

    Kind of stuck here. I've been trying to solve it, but I can't figure out what's the security hole in check_credentials! another hint?

  • Eldar33 Avatar

    Excellent kata. Filled in knowledge gaps.

  • EugZol Avatar
    • Add JSON to the list of frozen modules. With the redefining of JSON.load credentials object becomes totally under control, and then it's easy way to all tests pass.
    • The term "Metaprogramming" should be defined more clearly in the description.
    • I didn't quite understand the tests. Do they check that any admin password is good, not just 'h4xx0r3d'?
  • wkirschbaum Avatar

    This was a rough one... hated it until I got it right, but learned some stuff on the way. thanks @duchess_of_objects

  • RShields Avatar

    This comment has been hidden.

  • Becojo Avatar

    This comment has been hidden.

  • khovansky-al Avatar

    Excellent kata. Although after submitting my cheating solution and reading intended one I feel disappointed I didn't make it "the right way". Still, enjoyed every second of it.

  • fylooi Avatar

    Such a satisfying kata!

    I got 90% of the way through the intended solution, gave up and ended up exploiting a different vulnerability. Lol!

  • mitjok Avatar

    Why the test don't pass even though I provide username, password from the SecureLogin::ADMIN in Frontend#given_credentials?

    https://www.evernote.com/l/AYOBsQGpQexNub3hg406G6kKJBP9exJLUNQ

    @user = user if (user.password == given.password) Why plain user.password is tested for equality against crypted given.password?
  • Kache Avatar

    It is unclear when and where code is called/run due to the (presumably intentional) obfuscation.

    Finding the solution to this kata felt unrewarding to me.

    The provided hints were mostly unuseful, and this kata ended up just being a ton of trial and error attempts to get a direct reference to the ADMIN object.

  • iostat Avatar

    I can't believe it took me as long as it did to solve it.

    Such a satisfying kata though. Oh man.

  • wconrad Avatar

    Outstanding Kata. Difficult, and very satisfying once I found the solution. Thanks for making it.

  • wconrad Avatar

    The instructions show given_credentials as a global function, and don't show that it needs to be defined in the Frontend module. It bears mentioning, though.

  • tmwh Avatar

    This comment has been hidden.

  • geneccx Avatar
  • tansaku Avatar

    Great Kata - another class you might want to consider freezing is JSON - I was able to use that not to complete challenge, but to get login access

  • ashlebede Avatar

    This comment has been hidden.

  • lbriais Avatar

    Thank you very much for this kata. It was a nice challenge, and after having MonkeyPatched like crazy, I eventually wrote something much simpler...

  • benzrf Avatar

    I cannot find a single vulnerability in check_credentials!. As far as I can tell, modifying core or app classes is the only way to get logged in at all. How the hell was I supposed to solve it otherwise?

  • duchess_of_objects Avatar

    First 1 kyu Ruby kata?

    Whoa! According to the catalog, this kata is well on its way to become the first 1 kyu Ruby kata ever … I’d never expected that!

    I’m looking forward to your continued feedback, reviews, and submissions to help Ruby’s Eleven come out of beta!

  • duchess_of_objects Avatar

    Update 2: Hacked!

    After over three months and more than 500 submissions, I’m super excited to learn that the vulnerability has now been found and exploited!
    Kudos to waterlink who was the first warrior to submit a valid solution that avoids patching any core classes.

    Thank you all for your submissions so far … keep on hacking!

  • JoshBrodieNZ Avatar

    Taking a look at this now. Haven't solved it yet and I'm avoiding cheating by metaprogramming my way into the frozen objects, but feedback so far is that working through the code and targetting aspects that turn out to be dead ends has been great fun already.

  • duchess_of_objects Avatar

    It’s been a few months. Despite over 100 submissions, no one has found the vulnerability so far …

    Hint: For starters, you might want to audit the check_credentials! method thoroughly.

  • duchess_of_objects Avatar

    Hi dear and brave beta warriors,

    Thanks so much for visiting my kata! I’d love for you to help out improving this during the beta phase. These are the four issues I could use some help with:

    • How can we clarify the description? Maybe make the back story shorter and/or more interesting?

    • How can we simplify the vulnerable target code in the SecureLogin class? The warriors have no control over the SecureLogin class, however the description reveals the full source code of the class. I feel that improving this class might be a bit difficult. On one hand, the code needs to be short enough to be interesting. On the other hand, we need to keep around at least a little smoke and mirrors otherwise the vulnerability might become too obvious. Any thoughts?

    • Can you help me fix all the remaining vulnerabilities (except the single one I planted there on purpose)? I want this discussion to be openly visible so I’m not going to reveal the solution here. However, I’m going to comment every valid solution you submit to let you know if the vulnerability you exploited is the one I wanted you to exploit. :)

    • Which classes/modules/objects do we need to freeze to prevent monkey-patching? This is what I came up with so far (it’s not visible to the warrior):

    # Disallow patching for sensitive classes
[
  Kernel, String, Array, Set, Struct, SALT, SecureLogin,
  SecureCredentials, USER_DATA
].each(&:freeze)

    Feel free to add any thoughts you have. Thank you in advance for your help!

    Update: User tiagoefmoraes was the first to exploit a vulnerability I didn’t put there on purpose. (See spoiler comment)