POSTS 2024-05-10

VULNLAB: Reaper2

writeup Vulnlab Machines

ReaperTwo is an Insane Windows machine that involves both browser and kernel exploitation. The attack chain begins with enumeration of exposed services and access to an SMB share containing development artifacts. A vulnerable web application leveraging the V8 JavaScript engine allows for arbitrary JavaScript execution, which is escalated to remote code execution through a type confusion vulnerability in Harmony Set methods, combined with WebAssembly-based shellcode execution. After gaining an initial foothold as a low-privileged user, privilege escalation is achieved by exploiting a vulnerable kernel driver that exposes a function pointer execution primitive. The exploit bypasses modern protections such as kASLR, DEP, and SMEP by leaking kernel addresses via MSRs, performing a stack pivot, and constructing a ROP chain to modify Page Table Entries (PTEs). Finally, custom kernel shellcode is executed to steal a SYSTEM token, resulting in full system compromise.

VULNLAB: Reaper2
2004 words · 10 min
Insane Windows Code execution Kernel exploitation ROP Chain Python Web Assembly C ASLR

Overview

  • Type Machines
  • OS Windows
  • Severity Insane
  • Creator xct
  • Release date 2024 May 10

Enumeration

Start the instance via Discord, wait around 5 minutes and let’s go:

image

10.10.95.132

Nmap

$ nmap -sCV -Pn -p- --min-rate=1000 -T4 10.10.95.132
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-04 09:44 JST
Nmap scan report for 10.10.95.132
Host is up (0.26s latency).
Not shown: 65530 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Reaper2 Calculator
135/tcp   open  msrpc         Microsoft Windows RPC
445/tcp   open  microsoft-ds?
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-03-04T00:48:29+00:00; -1s from scanner time.
| ssl-cert: Subject: commonName=Reaper2
| Not valid before: 2025-03-03T00:35:46
|_Not valid after:  2025-09-02T00:35:46
| rdp-ntlm-info: 
|   Target_Name: REAPER2
|   NetBIOS_Domain_Name: REAPER2
|   NetBIOS_Computer_Name: REAPER2
|   DNS_Domain_Name: Reaper2
|   DNS_Computer_Name: Reaper2
|   Product_Version: 10.0.20348
|_  System_Time: 2025-03-04T00:47:50+00:00
49668/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
  • Found main open ports: WEB, SMB and RDP
  • Add Reaper2 in in /etc/hosts

Website (80/tcp)

image

image

image

Found Javascript/12.2.0 and JS engine v8

image

  • Found an arbitrary JS code input into d8.exe
  • d8.exe is a lightweight, standalone command-line interpreter for the V8 JavaScript engine, used for debugging JS code and V8 itself.
  • d8.exe is used with arguments: --allow-natives-syntax --harmony-set-methods.

Shared folder (445/tcp)

$ nxc smb reaper2 -u guest -p '' --shares
SMB         10.10.95.132    445    REAPER2          [*] Windows Server 2022 Build 20348 x64 (name:REAPER2) (domain:Reaper2) (signing:False) (SMBv1:False)
SMB         10.10.95.132    445    REAPER2          [+] Reaper2\guest: 
SMB         10.10.95.132    445    REAPER2          [*] Enumerated shares
SMB         10.10.95.132    445    REAPER2          Share           Permissions     Remark
SMB         10.10.95.132    445    REAPER2          -----           -----------     ------
SMB         10.10.95.132    445    REAPER2          ADMIN$                          Remote Admin
SMB         10.10.95.132    445    REAPER2          C$                              Default share
SMB         10.10.95.132    445    REAPER2          IPC$            READ            Remote IPC
SMB         10.10.95.132    445    REAPER2          software$       READ            software developement share

Found software$

Check the software$ share (using smbclient-ng to be able to have a fast enumeration about ACL):

$ pipx install smbclientng
  installed package smbclientng 2.1.7, installed using Python 3.12.8
  These apps are now globally available
    - smbclientng
    - smbng
done! ✨ 🌟 ✨

$ smbng -d '' -u 'guest' -p '' --host reaper2
               _          _ _            _                    
 ___ _ __ ___ | |__   ___| (_) ___ _ __ | |_      _ __   __ _ 
/ __| '_ ` _ \| '_ \ / __| | |/ _ \ '_ \| __|____| '_ \ / _` |
\__ \ | | | | | |_) | (__| | |  __/ | | | ||_____| | | | (_| |
|___/_| |_| |_|_.__/ \___|_|_|\___|_| |_|\__|    |_| |_|\__, |
    by @podalirius_                             v2.1.7  |___/  
    
[+] Successfully authenticated to 'reaper2' as '\guest'!
■[\\reaper2\]> use software$
■[\\reaper2\software$\]> acls
d-------     0.00 B  2024-04-29 04:31  .\
d--h--s-     0.00 B  2024-04-29 22:01  ..\
d-------     0.00 B  2024-04-28 21:26  kernel\
             Owner:   BUILTIN\Administrators
             Group:   REAPER2\None
             Allowed: CREATOR OWNER          WRITE_OWNER | WRITE_DACL | DELETE | READ_CONTROL | SYNCHRONIZE
             Allowed: Everyone               READ_CONTROL | SYNCHRONIZE
             Allowed: BUILTIN\Users          SYNCHRONIZE
             Allowed: BUILTIN\Users          READ_CONTROL | SYNCHRONIZE

d-------     0.00 B  2024-05-10 04:33  v8_debug\
             Owner:   BUILTIN\Administrators
             Group:   REAPER2\None
             Allowed: Everyone               READ_CONTROL | SYNCHRONIZE
             Allowed: BUILTIN\Users          READ_CONTROL | SYNCHRONIZE
             Allowed: CREATOR OWNER          GENERIC_ALL

d-------     0.00 B  2024-04-28 18:39  v8_release\
             Owner:   BUILTIN\Administrators
             Group:   REAPER2\None
             Allowed: Everyone               READ_CONTROL | SYNCHRONIZE
             Allowed: BUILTIN\Users          READ_CONTROL | SYNCHRONIZE
             Allowed: CREATOR OWNER          GENERIC_ALL

■[\\reaper2\software$\]> tree
├── kernel/
│   ├── kernel32.dll
│   └── Reaper.sys
├── v8_debug/
│   └── v8_debug.zip
└── v8_release/
    ├── d8.exe
    └── snapshot_blob.bin
■[\\reaper2\software$\]> get *
'kernel32.dll' ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100.0% • 782.5/782.5 kB • ? • 0:00:00
'Reaper.sys' ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 0.0% • 0.0/8.9 kB • ? • -:--:--
[error] Failed to download '\kernel\Reaper.sys': SMB SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.
...
■[\\reaper2\software$\]> exit

Except kernel/Reaper.sys, all files have been downloaded.

OR

We mount a shared folder and copy all files:

$ mkdir software
$ sudo mount -t cifs //reaper2/software$ ./software -o user=guest
Password for guest@//reaper2/software$: <Just press ENTER>

Double check:

$ tree software 
software
├── kernel
│   ├── kernel32.dll
│   └── Reaper.sys
├── v8_debug
│   └── v8_debug.zip
└── v8_release
    ├── d8.exe
    └── snapshot_blob.bin

4 directories, 5 files

$ cp -Rf software/* .    
cp: cannot open 'software/kernel/Reaper.sys' for reading: Permission denied

Unmount the shared folder:

$ sudo umount ./software

Double check:

$ tree         
.
├── kernel
│   └── kernel32.dll
├── software
├── v8_debug
│   └── v8_debug.zip
└── v8_release
    ├── d8.exe
    └── snapshot_blob.bin

5 directories, 4 files

Except kernel/Reaper.sys, we downloaded all files.