Brainpain (BoF Lab)
https://www.vulnhub.com/entry/brainpan-1,51/
Task 1 - Deploy the machine
Deploy attacker machine (Kali) and Brainpain machine on VirtualBox, Vmware or on a compatible emulator:
and check relative IPs:
🐲 Attacker/Kali IP: 192.168.56.7 obtained using ip a
The Brainpain VM is on the same subnet, than we do host discovery with nmap or arp-scan only in our subnet: nmap 192.168.56.0/24
🎯 Target IP: 192.168.56.8
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system, while Windows systems usually have a TTL of 128 secs.
2.1 Ports in listening and relative services
There're two open port, analyze them searching more info about services version and potential vulns:
sC
run default scripts
sV
enumerate versions
A
aggressive mode
Pn
no ping
oN
output to file with nmap formatting
We see that on port 1000 there's a web server, than we can try to open it on a browser.
and this is relative page source code:
We can see that it is a static page with only an image included.
While on port 9999 there's an hypotetic login form, but without possibility to insert input.
Now, we try to find potential hidden directory using gobuster:
and we find an interesting path: http://brainpain:10000/bin/
Going to it we find an interesting file exe, that we can download in locally:
Check more info about executable using command file:
that confirms exe windows file. Run it using windows emulator (wine):
Program was waiting a connection on port 9999, then we can use netcat on localhost and the same port:
now we can interact with login shell and insert psw (that we don't know).
Reading first tab page, after psw input we can see output that displays: [get_reply] copied 9 bytes to buffer. It means that program returns output of copied bytes to buffer and we can use it to test potential BoF vulnerability.
Task 3 - BoF Exploitation
3.1 Fuzzing
We can try to test sw using a fuzzer script in python:
add it into offset variable of our script:
program was crashed and we need to copy value of EIP register
EIP value in hexadecimal: 35724134
Now, we need to use pattern_offset ruby script with EIP value to calculate correct number of byte needed to crash app:
Output means that program cashes after 524 bytes.
3.2 Control EIP
Our scope is to overwrite EIP register and put into command to jump to ESP register (where we'll insert our payload/shellcode) and force execution, then we can try to put into EIP register 4 character of letter B (42 hex), using fuzzer below:
Now we've insert 524 letter A (41 hex) and 4 letter B (42 hex), infact we can see that EIP value is: 42424242.
Next goal is to overwrite EIP putting JMP ESP value, then find JMP ESP address
JMP ESP address is: 311712F3, to convert in little endian format: \xF3\x12\x17\x31
In the next fuzzer script we need to add this value to EIP and put 400 letter C to ESP (400 because payload usually is 350 bytes):
All right, ow we need to replace the 400 C's of the ESP with our shellcode:
3.3 Shellcode generation
in the below script to prevent i've add before shellcode a sequence of NOP chars to prevent the inexact memory addresses matter. NOP sleds help align the actual shellcode to a specific memory address. In some cases, the payload needs to be aligned to a particular memory boundary for successful execution. NOP sleds provide a flexible way to achieve this alignment. Of course NOP operations will be not executed and program will pass directly to our shell code inserted into buf variable.
First to execute it, we need to listening it on the same port of shellcode IP and PORT running a multi handler on msfconsole:
Then we can run our shellcode script to brainpain machine (192.168.56.8):
Connection was established on port 5555, and we've obtained a reverse shell
Task 4 - Privilege Escalation
We can execute /home/anansi/bin/anansi_util as root:
The program accepts manual option + command. Taking tentatives i can see that manual refers to linux man function. Then, i can use it to open a man page regarding a command (e.g. ls) and inserit into a !/bin/sh to became root.
save it, and we'll obtain root permissions!
Last updated