All right, everybody.
So welcome back to Introduction to Exploit Development.
So we are now going to really walk through our Linux exploitation exercises.
I've been receiving complaints that due to the newest Linux Kernels and Linux versions, usually five
and up, that basically the previous exploits I've been teaching has not worked, which is why we're
going to re explore.
I actually have three exercises right now.
You can ignore this one, but what I need you to do is install Docker.
So let's do this.
Sudo get update ampersand sudo app install dash y.
Docker io.
Now I already have the newest version of Docker and the first thing you want to do to go back through
lib http damen 1.2 is let me see for my write ups.
You want to run the command?
I'm already running this route, so you don't have to run as pseudo.
But first you want to do echo zero because you want to turn off outer space without randomization.
We're not at the level where we want to bypass SLR and on Linux machines we need to disable address
space layout, randomization.
Let's see this kernel randomize.
The space
randomize.
Double check that is off so capped and it's off.
Now I want you with Docker Run.
Remember, I'm running a super user, but if you're not a super user, you can just run with pseudo.
But I'm just going to do this for formalities.
So pseudo docker pull GHC.
I'll slash my personal github repo 27 slash intro exploit dev lib htp dave and latest.
Now that we actually have it running, we want to make sure that we get an environment running to make
it work.
So let's open up another terminal.
So you just log on a superuser and then we're going to run it.
Because remember, this is a 64 bit penetration testing distro.
We're running on Linux kernel 5.18.
We're actually a 64 bit machine and we're going to run it in Docker emulation mode.
So the command to do this is do soccer pseudo Docker run double dash platform equals Linux slash I 386
dash it for interactive double dash privilege.
So inherits the attributes such as the outer space layout, randomization, being disabled by your host
machine and gc cri io dot slash 27 intro exploit dev lib http date, then latest and run it with a shell
prompt bash.
This is going to take a while because platform emulation is not particularly quick, but so far this
is probably the best option I have.
So before we get started, the next exercise, I want to show you where you're vulnerable.
And also I want to show you something about the difference between Python two and Python three so that
we can make sure that we can teach our students both methods.
So the difference between our original exploits cat fixed solution is that you don't have a B that you
can see which stands for bytes.
So in Python two, our original exploit, which I covered in our previous Python 2.7 methodology, did
not use B because in Python two strings are interpreted both as either bytes or an array of characters
called strings.
So this is going to be part of our reboot and there will be changes.
So let me show you the Python three exploit, which is what I want you to do right now.
The final solution for this actually has the word B, as you can see, pretending the string.
This specifies that not as a string, but as bytes.
Otherwise, let's say that I broke this, by the way, in Python three.
Let's say that I didn't want to write binary.
Let's say we take out the speed if we ran this solution.
Python three.
I'm sorry.
It's an indicator you can see.
Right?
Argument must be string, not bytes.
So the problem with penetration testing is that you need to learn both python 2.7 and three because
a lot of exploits predates 2019.
And since the time I actually wrote this course, we actually transitioned to Python three and almost
everything apart from two was deprecated.
Unfortunately, on websites like Exploit Database and security trails, there are still exploits still
written in Python two.
So I just want to cover this up.
So I want to just go over this and explain to you that we are now going to learn Python 2.7 and all
variants of three.
Also notice that we are no longer reversing the bytes four and a Python 2.7 version.
We are actually going to pack it using the Python C Structs Command and this is pretty much the main
difference between Python two and three.
And I just want to teach you a new technique because once we go into 32 bit and 64 bit return oriented
programming wrap chains, this will be a very convenient command.
You don't want to be reversing the bytes of every rock chain.
So thank you for staying with me.
In this class, I will restart our fuzzing process and our exploit development process for this reboot
of our class in our next session.