Exercise: Exploiting a Windows Buffer Overflow on Buff
The machine Buff is a Windows box that is running a website on port 8080 that is built using "Gym Management Software 1.0". This software has a unauthenticated remote code execution vulnerability that can be exploited to upload a web shell. Using the web shell, we can upload netcat onto the box and get a reverse shell as the user buff\shaun. Once on the box, you will discover an application that is running as Administrator called CloudMe_1112.exe. This can be exploited through a buffer overflow to get an elevated reverse shell as Administrator.
Initial Discovery
An nmap shows three ports open: 5040, 7680 and 8080. Port 8080 has been opened by an Apache web server that is running PHP (7.4.6). The other two ports haven't revealed anything specific and so we can leave them for now.
Navigating to http://buff.htb:8080 you will find a web site for a Gym; mrb3n's Bro Hut.
Looking through the pages, the Contact page shows that the web site was made using "Gym Management Software 1.0". There is also a copyright notice for Projectworlds.in.
Searching for exploits related to this software, we find details of an unauthenticated exploit on the Exploit Database (https://www.exploit-db.com/exploits/48506\) which allows for an unauthenticated remote code execution. We can download the exploit by using searchsploit to mirror it to the current directory using the -m flag:
The exploit is based on an upload function in the app that allows the upload of image files. The PHP file upload.php does not check if the user is authenticated and does not properly validate the uploaded file.
Looking at the source code for upload.php, the uploaded file is first renamed v to the value supplied as the id argument u to upload.php
It will take the extension of that file from the first bit of text it finds after the "." (2):
It is a good idea to make a couple of changes to the exploit code. Firstly, it has been written for Python 2 and so needs parentheses () for all of its print statements if run with Python 3. Curiously some have parentheses, but others do not. The other thing I did was remove the PNG magic bytes that are added to the file. These bytes won't affect the PHP code and are used by some programs to identify the file type as a PNG file. However, the code in the Gym Management Software does not check this so it is superfluous.
Running the code, we get access to a web shell:
Because curl is slightly unwieldy to use, we can send a curl request to Burp Suite, intercept that request and send it to the Repeater (using the CTL-R key)
In Repeater in Burp Suite, we can now get a reverse shell by uploading netcat and executing that. You can get a Windows version of netcat from /usr/share/windows-resources/binaries/nc.exe and copy it to your working directory. Start a Python web server on your box:
Then start a netcat listener:
Then in Burp send:
Remember to change the IP address to your box's IP address.
And then run the reverse shell
To get the reverse shell on your box:
We are on the box now as user buff\shaun, although this section was talking about using custom exploits to obtain initial access, the actual buffer overflow exploit comes from the privilege escalation step. After gaining access, we start the discovery process to find out more about the environment, other users, configuration, software installed etc. In shaun's home directory in Downloads, you will find a program called CloudMe_1112.exe. Looking again at Exploit DB, we see that there is a buffer overflow vulnerability for the version 1.11.2 of CloudMe which is a file storage service (https://www.exploit-db.com/exploits/48389\). The exploit details that the CloudMe app is running on port 8888 and if we do a netstat to look at what the machine is listening on, you will see that port 8888 is open:
We can confirm that this is opened by CloudMe by running the PowerShell command:
Of course, we don't know who the owner of this process is because that information needs a higher level of privilege than we have as the user shaun but as this is Hack The Box, it is likely that all clues point to Administrator.
We could just use the exploit code on Exploit DB but we are going to do this from scratch. We are going to do this on our Windows 10 Commando VM. Download the version of CloudMe from Exploit DB (https://www.exploit-db.com/apps/f0534b12cd51fefd44002862918801ab-CloudMe_1112.exe\). To explore the program we are going to use the Immunity debugger (which can be installed from https://www.immunityinc.com/products/debugger/\) and install the addon for Immunity called mona (which can be installed from https://github.com/corelan/mona\).
Running CloudMe will involve registering an account (which is free). Once it is running, close it and then drag and rop the exe file into an Immunity window. You should see windows as shown here:
If the program says Paused at the bottom right of the window, then select Run from the Debug menu. We are going to send a pattern of text created by using msf-pattern_create -l 1500 on the command line or in Immnunity, you can use !mona pattern_create 1500 in the command window at the bottom of the screen.
Once CloudMe is running, you can send the pattern to CloudMe using netcat:
This will cause an exception in the CloudMe app that will be reported by Immunity giving an address that it is trying to execute.
Buffer overflow showing ascii characters in instruction pointer rip
We can confirm the address that is causing the exception by looking at the values in the registers which are listed in Immunity's register window:
This shows the pattern on the stack pointed to by ESP and the instruction pointer EIP has 316A4230. If we use msf-pattern_offset to find out the offset, we find it is at 1052
In mona in Immunity, we can do the same thing with
Now that we know how to overwrite the instruction pointer held in EIP, the plan is to execute shell code from the stack by using a jmp ESP instruction which will jump to, as in execute, the address pointed to by the register ESP. We can use mona to search for this instruction by using !mona jmp -r ESP.
We get a great deal of output showing the locations of either jmp esp instructions found and the libraries they are found in, or other equivalent instructions like push esp + ret. This works like a jump instruction because the return instruction ret will return to whatever is on the top of the stack and the value stored in the register ESP is pushed to the top of the stack with push esp.
Both the jmp esp and the push esp + ret are found in Qt5Core.dll and this library does not have ASLR protection.
The exploit on Exploit DB chose to use the push esp instruction rather than the jmp esp one. Either will work (you can verify this yourself). However, now that we have found out all of the necessary information, we can go ahead and create exploit code. We will stick with using shellcode that will run the application calc.exe. This makes testing easier because it is simple visual way of making sure the exploit is working.
In this code, we set a variable junk to be 1052 characters u. The next 4 bytes after that will overflow into the EIP and so we create a variable with the address of the push esp + ret, gadget. Finally, there is another variable NOPS that is set to 30 times the hex byte 90. I will come back to what this is shortly. We can create the payload for the exploit using msfvenom. The command syntax is shown in the code as a comment v. The -a flag is the architecture of the exploit which is x86. The -p flag specifies the platform and, in this case, it is a Windows executable with the executable specified by the CMD= parameter. We have specified some bytes to avoid with the -b flag. This is done because sending null bytes and carriage return or linefeed characters can cause some network connections to terminate and we want to avoid them. Finally, we can specify the output format as Python using the -f flag.
Using the output from msfvenom, we create a variable buf to hold the shell code w. We then construct the payload with the combination of junk + EIP + NOPS + buf x. Finally, we can create a socket, connect to the target and send the payload y.
The result of running the exploit is shown below. If successful, you should see the calculator application running.
One thing you will notice about the exploit code is that it has added 30 bytes of b"\x90" which is called a NOP sled. The NOP instruction is a no operation instruction, as in, it doesn't do anything. The processor will simply move to the next byte until it hits the shell code. This allows for the possibility that we haven't been able to calculate the exact offset for the shell code because of memory alignment or other factors.
To get this exploit running on the box, we need a tunnel and so you can use chisel (which can be installed from https://github.com/jpillora/chisel\).
Get the windows version of chisel onto Buff
On the Parrot box run chisel as a server waiting for a reverse connection:
Then run chisel.exe as a client on Buff
We will cover using chisel for tunnels in more detail when looking at pivoting but this is the same principle as using SSH as a tunnel.
We can now connect to the CloudMe application from our Parrot box on 127.0.0.1 and port 8888
Taking the exploit code that we developed on the Windows machine, we need to replace the shell code with a reverse shell again using msfvenom:
Start a listener on port 6003 and then run the exploit code:
Last updated
Was this helpful?