search

Venus

hashtag
About Release

hashtag
Download

hashtag
Description

Difficulty: Medium

Venus is a medium box requiring more knowledge than the previous box, "Mercury", in this series. There are two flags on the box: a user and root flag which include an md5 hash. This has been tested on VirtualBox so may not work correctly on VMware. Any questions/issues or feedback please email me at: SirFlash at protonmail.com

hashtag
Recon

└─$ ip -4 -brief address show eth0
eth0             UP             10.0.2.15/24

└─$ sudo netdiscover -i eth0 -r 10.0.2.0/24 | tee netdiscover.log
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname
 -----------------------------------------------------------------------------
 10.0.2.1        52:54:00:12:35:00      1      60  Unknown vendor
 10.0.2.2        52:54:00:12:35:00      1      60  Unknown vendor
 10.0.2.3        08:00:27:64:6e:66      1      60  PCS Systemtechnik GmbH
 10.0.2.19       08:00:27:18:54:5e      1      60  PCS Systemtechnik GmbH
chevron-rightnmap_scan.loghashtag

hashtag
HTTP (8080)

Writeup.png
circle-check

Creds: guest:guest

Login as guest

Writeup-1.png

We got an auth cookie which seems to be Base64:

Password seems to be rot13?

Writeup-2.png

hashtag
Directory Enumeration

Enumerate directories:

Backend is Django (Python)

Writeup-3.png

Django gives 500 on unsuccessful username/password combinations.

hashtag
Username Enumeration

If we go back to the / login and try invalid username/password, we get Invalid Username:

Writeup-4.png

Then valid username and invalid password, we get Invalid Password:

Writeup-5.png

This means we are able to enumerate usernames by the login form.

hydra syntax for http-post:

By using usernames from xato-net-10-million-passwords-10000.txt we found 3 valid users:

Sidetracking, but these users exist in following wordlists from SecListsarrow-up-right 👀

hashtag
Leaking Passwords With Cookies

Do the same for the magellan user

hashtag
SSH (22)

hashtag
magellan

The credentials didn't work for Django admin page, but we are able to login into ssh!

circle-check

Creds: `magellan:venusiangeology1989

User.txt

hashtag
Privilege Escalation (root)

Get linpeas and run it. (tee to save the output if further required)

venus_messaging

Nothing eye-catching, but some apps are running locally.

Ok, looks like we have internal service which wants a password..

ss doesn't show the running process, probably because of permissions. If we filter ps we can find the relate

Using strings we identifed probable password, after trying it it worked. But now we are stuck in infinite loop of Enter Message

It's an ELF file, so some Reverse Engineering will be required :/

Download file:

Reverse Engineering

Open the file in Ghidra or other Reverse Engineering software. Im using ghidra_auto.pyarrow-up-right to speed up file analysis.

After renaming variables and types main function looks like:

circle-info

Note: L -> rename variable, Ctrl+L -> change type, Ctrl+Z -> Undo, Ctrl+Y -> Redo.

Program first authenticates us and then puts us in infinite loop of recv_message(conn)

Smells like Buffer Overflow

Buffer Overflow

First we need to find BoF point.

circle-info

Note: pwndbgarrow-up-right is being used.

Writeup-6.png

Get RSP value offset

So at 1040 bytes the buffer starts to overflow and overwrites RBP and at 1048 we overwrite the RSP. The RSP points to the memory address where the program continues execution, so if we control the RSP we could point to a memory address we control and continue execution there, for example place some shellcode in the first 1048 bytes we send and then point the RSP to this address but this method would not work in this case as the stack is not executable. (NX: NX enabled)

The technique we can use is ret2libcarrow-up-right, because fortunately (or not) the ASLR is disabled:

Writeup-7.png
circle-info

Post: https://ir0nstone.gitbook.io/notes/types/stack/return-oriented-programming/ret2libcarrow-up-right

Writeup-8.png
Writeup-9.png
Writeup-10.png
circle-info

Source: https://github.com/datajerk/ctf-write-ups/tree/master/vulnhub/venusarrow-up-right

Buffer Overflow Explained

In this payload, we are setting up a chain of instructions to call the recv function to read a command into the binary's memory, and then calling system with that command.

  1. Initial Padding

  • 0x418 * b'A' adds padding to overflow the buffer up to the return address. This value (0x418) should match the exact offset to reach the return address based on the binary's layout.

  1. First Gadget: pop rdi; ret

  • p64(pop_rdi) adds the address of the pop rdi; ret gadget. p64 converts the address to a 64-bit little-endian format.

  • p64(fd) adds the file descriptor (usually 0 for standard input) into the rdi register, which is the first argument for recv.

  1. Second Gadget: pop rsi; ret

  • p64(pop_rsi) adds the address of the pop rsi; ret gadget.

  • p64(binary.bss()) adds the address of the .bss section (a writable section of memory in the binary) into the rsi register, which is the second argument for recv. This is where the data will be written.

  1. Third Gadget: pop rdx; pop rcx; pop rbx; ret

  • p64(pop_rdx_rcx_rbx) adds the address of the pop rdx; pop rcx; pop rbx; ret gadget.

  • p64(len(command)) sets the length of the command to read into the rdx register, which is the third argument for recv.

  • p64(0) sets the value of the rcx register (though it's not used here).

  • p64(0) sets the value of the rbx register (though it's not used here).

  1. Call recv

  • This adds the address of the recv function in the Procedure Linkage Table (PLT) to the payload. When this is executed, it will call recv(fd, binary.bss(), len(command)).

  1. Second pop rdi; ret Gadget

  • p64(pop_rdi) adds the address of the pop rdi; ret gadget again.

  • p64(binary.bss()) places the address of the .bss section into rdi, which now contains the received command string.

  1. Call system

  • This adds the address of the system function from the libc library to the payload. When this is executed, it will call system(binary.bss()), effectively running the command stored in the .bss section.

TLDR;

hashtag
Exploit

Root.txt

hashtag
CVE-2021-4034 (root)

Linpeas also returned few CVEs for the box, but because of Exposure: less probable I scrolled through them.

polkit with suid bit is vulnerable to CVE-2021-4034arrow-up-right on the box.

PreviousMercury

Last updated