App - System

This works normal on my local Windows machine via Debugger, via PE32 executable, however on the remote machine via SSH the filename is not reachable if it’s not in CWD of ch73.exe. So not working.

Could anyone verify that it’s working with no extra symlinking and other tricks? Just put your malicious file to /tmp, /var/tmp directory and execute it with wrapper — and it should work? Cygwin really confuses. I even encoded all bad chars like CRLF, NULL — still same. But on local — it works fine!

This is 2nd challenge from Ech0 that does not work for me on remote side, either not properly constructed! I tried to contact him via message, but root-me messenger does not work neither :(((((((((((((((

https://www.root-me.org/en/Challenges/App-System/PE32-Advanced-stack-buffer-overflow

I asked him to come and see you.

Thanks, for this Advanced BOF, I popped CMD shell via SEH overwrite (hopefully no spoiler), but seems SEH is not working properly via Cygwin. So not working on remote

Hello,

I am facing the same issue. Local exploit is working but I can’t even read the crafted file using the wrapper.sh provided for this chall.

Could someone explain to me how to make this chall work ?

Thank you

Hello,

Please use Windows path :

./wrapper.sh "C:\cygwin64\tmp\test"

Sorry if it was confusing, but it will be the same for all challenges under Cygwin environment.
Just remember :
/ = C:\cygwin64\
/tmp = C:\cygwin64\tmp

In case of any doubt, you can check by yourself the corresponding Windows path by calling cmd.exe :

Hello,

Thank you, this helped me to try my payload.

I’m facing another known issue now. gdb.exe in version 8.1 is configured for x86_x64 and using breakpoint on mingw32 compiled binary is crashing.

gdb: unknown target exception 0x4000001f at 0x401829

See this link for more info:
https://stackoverflow.com/questions/40923437/gdb-unknown-target-exception

hi ...
I’m a little bit surprise by this challenge ...
it works fine on my station, without DEP ...

when i try it on the server, via radare2, i correctly jump to my shellcode, but DEP prevent exec .....
that’s ok ... but do i really need to go trough a ROP chain to change memory protect via VirtualProtect () ?
i mean, for 25 points .... it seems a bit over complicated no ?

did i miss something ?

btw : cool challenge ...

Stack is not executable.

ok ...
after a few tweaks ....

now i can pop a shell via :
cd /tmp/
/challenge/app-systeme/ch73/ch73.exe ropp (<== ropp is my file with [Th1b4ud : spoil])

BUT, with wrapper.sh ..... nothing happen .... i mean strictly nothing ....
i’m a little bit confused with this cygwin conf ..

i mean, the challenge is to do a buffer overflow ...right ? with some improvement ....
not fighting with cygwin ...

any tips ... welcome !

thanks ...

Some hints for everyone who is fighting with the odd cygwin64 environment:

– use radare2.exe to debug on the remote machine.
– just ignore the 64bit libraries
– if your exploit is working in radare most addresses should work with ./ch73.exe and ./wrapper.sh as well.
– /wrapper.sh does not return anything if it just crashes. If you successfully open a shell you will see something.

Hope this keeps some people from skipping this task as its method of exploitation is quite nice...

I can get a shell via ch73.exe
But when I use wrapper.sh just nothing happened. It seems crashed.

At first I think there might be some different address.
Then I used "jmp dword_ptr[]" to jump the right instruction.
It works right in "ch73.exe" . But still nothing in "wrapper.sh".

Any tips about the difference between "ch73.exe" and "wrapper.sh"?
Thanks!

btw : Finally I finished the challenge. Thanks to the tips from shelli.

Is popping a shell the only way to solve this challenge ?

I found a way to have ch73.exe display the contents of the file it is given as an argument, but this file has to be tweaked and .passwd cannot be tweaked.

Bonjour,

j’ai également des problèmes avec ce chal.

De mon côté, l’exploit fonctionne OK, mais pas sur le serveur. Je peux lire qu’il faut utiliser GDB ou radare2 pour debugger online. Est-ce que quelqu’un sait comment autoriser une exception, comme dans Immunity Debugger (à l’aide de Shift+F7/8/9) dans GDB ou radare2 ?

J’ai fait des recherches sur le web, mais n’ai pas trouvé cette info...

Merci par avance

Sorry, I posted in French... Now the English version.

I am also having some issues with this challenge.

I wrote an exploit locally, that works like a charm, but fails on the target system. I’ve read that I should use GDB or radare2 to debug on the target machine. But as opposed to Immunity Debugger (using Shift+F7/8/9), I do not know how to bypass an exception in GDB/radare2.

Would someone know how this can be done with gdb.exe our radare2 ?

Thanks in advance

Hi the people who already solved this any tip about how to work with wrapper.sh , is it part of the challenge to figure out how to exploit with wrapper , because i cane get a cmd.exe with ch73.exe ...
Thanks