search

🧠Brainpan 1

hashtag
License

The following post by anthonyjsaab is licensed under CC BY 4.0arrow-up-right

hashtag
0 - Introduction

LogoBrainpan 1TryHackMechevron-right
Machine version: Brainpan 1

Reverse engineer a Windows executable, find a buffer overflow and exploit it on a Linux machine.

Created by tryhackmearrow-up-right

hashtag
1 - Port Scans

hashtag
1a - Discovery

hashtag
1b - Service Versioning and OS Fingerprinting

hashtag
1c - Vulners

hashtag
2 - Port 10000

hashtag
2a - Manual Inspection

We can only see an infographic that is not very helpful in our case

hashtag
2b - Dirbusting

hashtag
2c - Retrieving a Windows executable

This is the only interesting file available on port 10000
Executing the program activates a listener on IPv4 0.0.0.0:9999
We have only one input to the program through port 9999 which is the "password"

Notice that this banner is the same one we retrieved from the target machine's port 9999 (nmap output).

When debugging the program, we can discover that the password is "shitstorm", but that does not really help us:

This is useless

Thus, if we can exploit a buffer overflow locally through this exe, we can do it remotely on the target machine's port 9999 as well.

hashtag
3 - Developping an exploit - Buffer overflow

We will develop this exploit on a local Windows 10 x64 machine. Once functional, we will use it on the target.

hashtag
3a - Fuzzing

Finding approximatively how many chars is too much chars, causing a seg fault:

Worst case scenario the offset is 750 bytes

hashtag
3b - Offset

Going forward, we will use x64dbg its plugin ERC.Xdbg

To know the exact offset, we will generate a non-repeating pattern using ERC and use it as payload.

The value of the EIP after feeding brainpan.exe the pattern is what we should get here
The offset is 524 bytes

To double-check that the offset is in fact 524 bytes, we use the following:

Notice that the EIP's value in 0x42424242, which corresponds to BBBB in ASCII. The offset is 524

hashtag
3c - Finding bad characters

We need to check what ASCII characters are problematic. We generate a list of all the possible ASCII characters using:

Then, we send it:

We should check for anomalies using the ERC command:

Note that the address you see in the command is the value of the ESP after sending the payload.

0x00 is definitely problematic and should not be used in our future shellcode

So we found our first bad character: 0x00. Now, we replace 0x00 by 0x01 in the Python code and retry. We would see that there are no more mismatches after 0x00. So 0x00 is the only bad character.

hashtag
3d - Finding a JMP ESP

We can see that brainpan.exe has no protections against bufferoverflow whatsoever
We find a JMP ESP instruction inside the exe at the address 311712F3

hashtag
3e - Exploit Code

We got a reverse shell on our local Windows machine

hashtag
3f - Actual Foothold

Using the same Python exploit code, but changing the shell code and the target IP, we get a reverse shell:

hashtag
4 - PrivEsc

hashtag
4a - Upgrade shell

Even tho a Windows executable is running on the target machine, the target machine is a Linux machine. We should get a decent bash shell to continue:

hashtag
4b - Abusing sudo

PreviousBacktrackNextCapture!

Last updated