Friday, January 19, 2024

Vsftpd Backdoor - Ekoparty Prectf - Amn3S1A Team

It's a 32bits elf binary of some version of vsftpd, where it have been added a backdoor, they don't specify is an authentication backdoor, a special command or other stuff.

I started looking for something weird on the authentication routines, but I didn't found anything significant in a brief period of time, so I decided to do a bindiff, that was the key for locating the backdoor quickly. I do a quick diff of the strings with the command "strings bin | sort -u" and "vimdiff" and noticed that the backdoored binary has the symbol "execl" which is weird because is a call for executing elfs, don't needed for a ftp service, and weird that the compiled binary doesn't has that symbol.





Looking the xrefs of "execl" on IDA I found that code that is a clear backdoor, it create a socket, bind a port and duplicate the stdin, stdout and stderr to the socket and use the execl:



There are one xrefs to this function, the function that decides when trigger that is that kind of systems equations decision:


The backdoor was not on the authentication, it was a special command to trigger the backdoor, which is obfuscated on that systems equation, it was no needed to use a z3 equation solver because is a simple one and I did it by hand.



The equation:
cmd[0] = 69
cmd[1] = 78
cmd[1] + cmd[2] = 154
cmd[2] + cmd[3] = 202
cmd[3] + cmd[4] = 241
cmd[4] + cmd[5] = 233
cmd[5] + cmd[6] = 217
cmd[6] + cmd[7] = 218
cmd[7] + cmd[8] = 228
cmd[8] + cmd[9] = 212
cmd[9] + cmd[10] = 195
cmd[10] + cmd[11] = 195
cmd[11] + cmd[12] = 201
cmd[12] + cmd[13] = 207
cmd[13] + cmd[14] = 203
cmd[14] + cmd[15] = 215
cmd[15] + cmd[16] = 235
cmd[16] + cmd[17] = 242

The solution:
cmd[0] = 69
cmd[1] = 75
cmd[2] = 79
cmd[3] = 123
cmd[4] = 118
cmd[5] = 115
cmd[6] = 102
cmd[7] = 116
cmd[8] = 112
cmd[9] = 100
cmd[10] = 95
cmd[11] = 100
cmd[12] = 101
cmd[13] = 106
cmd[14] = 97                    
cmd[15] = 118
cmd[16] = 117
cmd[17] = 125


The flag:
EKO{vsftpd_dejavu}

The binary:
https://ctf.ekoparty.org/static/pre-ekoparty/backdoor


Related articles

  1. Hacking Tools For Games
  2. Pentest Reporting Tools
  3. Hacking Tools Hardware
  4. Hacker Tools Github
  5. Black Hat Hacker Tools
  6. Hacker Tools Free
  7. Hack Tools Online
  8. Pentest Automation Tools
  9. Hacking Tools For Pc
  10. Pentest Tools Nmap
  11. Hacker Tools Hardware
  12. Tools 4 Hack
  13. Hacking Tools For Mac
  14. Hacker Tools 2019
  15. Pentest Tools Download
  16. Hacker Tools Linux
  17. Pentest Tools Download
  18. Pentest Tools Framework
  19. Hackers Toolbox
  20. Growth Hacker Tools
  21. Pentest Reporting Tools
  22. Hacker Tools Hardware
  23. Hacking App
  24. Hacker Tools Software
  25. Hack And Tools
  26. Pentest Tools For Ubuntu
  27. Hacking Apps
  28. Hacking Tools And Software
  29. Hack Tools For Ubuntu
  30. Hacker Techniques Tools And Incident Handling
  31. Hacker Tools 2019
  32. Hacker Tools For Pc
  33. Hacking Tools 2020
  34. Hack Tools Mac
  35. Free Pentest Tools For Windows
  36. Hacking Tools Online
  37. Pentest Tools
  38. Hacking Tools Mac
  39. Pentest Tools Website
  40. Hacking Tools For Windows
  41. Hack Tool Apk No Root
  42. Easy Hack Tools
  43. Hacking Tools 2020
  44. Hacking Tools Name
  45. Hacker Tools Github
  46. Hak5 Tools
  47. World No 1 Hacker Software
  48. Termux Hacking Tools 2019
  49. Computer Hacker
  50. Pentest Tools Alternative
  51. Hack Tools Download
  52. Hacks And Tools
  53. Hacking Tools Kit
  54. Nsa Hack Tools
  55. Hack Website Online Tool
  56. Hacking Tools For Games
  57. Best Hacking Tools 2019
  58. Hacker Tools Windows
  59. Pentest Tools Url Fuzzer
  60. Hacking Tools For Windows 7
  61. Hack Tools For Ubuntu
  62. Computer Hacker
  63. What Is Hacking Tools
  64. Pentest Tools Online
  65. Pentest Tools Online
  66. Hacker Tools Mac
  67. Hacking Tools
  68. Hacking Tools 2020
  69. Hacker Tools Github
  70. Hacking Tools For Windows
  71. Hacker Search Tools
  72. Pentest Tools Tcp Port Scanner
  73. Hacker Tools Hardware
  74. Hacker Tools Apk
  75. Pentest Tools Tcp Port Scanner
  76. Pentest Box Tools Download
  77. Hack Tools For Mac
  78. Hacking Tools Github
  79. Pentest Tools For Ubuntu
  80. Kik Hack Tools
  81. Nsa Hack Tools Download
  82. Pentest Tools Download

No comments: