🧠Brainpan 1

License

The following post by anthonyjsaab is licensed under CC BY 4.0

0 - Introduction

LogoBrainpan 1TryHackMe
Machine version: Brainpan 1

Reverse engineer a Windows executable, find a buffer overflow and exploit it on a Linux machine.

Created by tryhackme

1 - Port Scans

1a - Discovery

1b - Service Versioning and OS Fingerprinting

1c - Vulners

2 - Port 10000

2a - Manual Inspection

We can only see an infographic that is not very helpful in our case

2b - Dirbusting

2c - Retrieving a Windows executable

This is the only interesting file available on port 10000
Executing the program activates a listener on IPv4 0.0.0.0:9999
We have only one input to the program through port 9999 which is the "password"

Notice that this banner is the same one we retrieved from the target machine's port 9999 (nmap output).

When debugging the program, we can discover that the password is "shitstorm", but that does not really help us:

This is useless

Thus, if we can exploit a buffer overflow locally through this exe, we can do it remotely on the target machine's port 9999 as well.

3 - Developping an exploit - Buffer overflow

We will develop this exploit on a local Windows 10 x64 machine. Once functional, we will use it on the target.

3a - Fuzzing

Finding approximatively how many chars is too much chars, causing a seg fault:

Worst case scenario the offset is 750 bytes

3b - Offset

Going forward, we will use x64dbg its plugin ERC.Xdbg

To know the exact offset, we will generate a non-repeating pattern using ERC and use it as payload.

The value of the EIP after feeding brainpan.exe the pattern is what we should get here
The offset is 524 bytes

To double-check that the offset is in fact 524 bytes, we use the following:

Notice that the EIP's value in 0x42424242, which corresponds to BBBB in ASCII. The offset is 524

3c - Finding bad characters

We need to check what ASCII characters are problematic. We generate a list of all the possible ASCII characters using:

Then, we send it:

We should check for anomalies using the ERC command:

Note that the address you see in the command is the value of the ESP after sending the payload.

0x00 is definitely problematic and should not be used in our future shellcode

So we found our first bad character: 0x00. Now, we replace 0x00 by 0x01 in the Python code and retry. We would see that there are no more mismatches after 0x00. So 0x00 is the only bad character.

3d - Finding a JMP ESP

We can see that brainpan.exe has no protections against bufferoverflow whatsoever
We find a JMP ESP instruction inside the exe at the address 311712F3

3e - Exploit Code

We got a reverse shell on our local Windows machine

3f - Actual Foothold

Using the same Python exploit code, but changing the shell code and the target IP, we get a reverse shell:

4 - PrivEsc

4a - Upgrade shell

Even tho a Windows executable is running on the target machine, the target machine is a Linux machine. We should get a decent bash shell to continue:

4b - Abusing sudo

PreviousBacktrackNextCapture!

Last updated

Was this helpful?