Hello, everybody.
In this module, we are going to break the ice when it comes to exploit development.
I understand that creating exploits while looking at assembly of codes in a debugger might be a very
intimidating or daunting task, something that might be outside of your comfort zone.
So we're going to cover some very, very basic concepts, such as shell code, basically a shell code,
at least within the realm of binary exploitation.
It's basically a similar language opcoes and operands intended to hijack CPU execution and perform malicious
acts such as connecting back over a burst shell or spawning a listening band show on the phone or application,
or just simply crash in the program.
Shell code exist in many forms, but within this class we are only going to talk about what shell code
is in binary exploitation a bind show the spawn against a target host by exploiting a target application
that is listening.
After launching the exploit, the victim would have a new listening port and you can simply network
how to it to connect to its command shell.
This will be covered in the CROSSFIRE explicit section of the class.
A reverse shell connects back from the target to the attacker, a specific listening port or service
on the attackers open before the exploitation attempt just to catch the shell.
This is useful for exploiting machines behind a firewall or router and it can usually bypass the firewall
by having the target machine solicit the connection.
We catch the reverse of the command net cat dash envelope listening port.
We will cover a burst shell in the cell mail 5.5 section of the class.
But there is also something that's commonly mentioned.
It's called mature.
Upper mature repeater is nothing any special outside of Rapid7 proprietary remote access Trojan remote
access trojans fine function like bein in reverse shells, but they have additional modules and functionality
convenient to an attacker such as Keyloggers, persistence modules, exfiltration modules, privilege
escalation modules because you not always can gain system simply by exploiting a vulnerable application.
Sometimes you need a second exploit to raise your privileges to system without the convenience of interpreter
or other remote access.
The Trojan penetration testing must perform the post exploitation process manually using commands on
the command line, fuzzing, forcing it to send or transmit junk strings to the vulnerable application
with the intent of crashing it and possibly locating a exploitation opportunity.
The first process is assisted with the availability of open source and commercially available buzzers.
You have different kinds of fuzziness.
You could have network work off others.
You could have network or file format footers.
Some could be mutating.
BUZZER We will build our own phaser within the Seattle labs mail 5.5 exploit.
The Abutters are critical to the exploit development process.
We attach the debugger to a specified process that is already running to analyze the results of the
crash.
We will use three debugger in this course immunity debugger for Windows.
The new debugger Petya and Evan's debugger for both Linux systems.
Technical requirements.
We need to have virtualization enabled on your laptop or your PC.
We will walk you through those steps in the next module.
A copy of Windows seven Vista or XP running as a virtual machine is required and we call Linux running
as a virtual machine as the attacking guest.
All exploitable applications will be made available for download from the course materials section.