Welcome back to Advanced Exploit and Zero Day Discovery Development.
We are now in the Blockchain and Advanced Code Reuse Attack section of the course.
Rob Chaining Defeats Data Execution Prevention, which is introduced in Windows XP Service Pack two
as exploit mitigation measure data.
Execution prevention comes in two modes, both hardware and force and software enforced.
We will be covering hardware and for state execution prevention.
In this course there are four modes and how DEC works opt in mode where depth is enabled for system
processes and custom applications designed to use it.
That's actually the normal operation.
Opt out mode deps enabled for error effects of Excel specifically exempt applications always onboard
system wide data execution prevention is enabled and always off mode.
Death is permanently disabled.
Rob or return or program is designed to defeat DEP Rob chaining works by using gadgets which are cherry
picked.
Machine instructions are readily available in the vulnerable applications memory regions.
Each gadget ends with a return instruction.
Each return points to another rob gadget.
Hijacking of execution is not relinquished until a virtual protect is called to shut down death.
Rob bypasses the need to directly inject code by cherry picking instructions off the vulnerable applications
executable memory regions, which is why it is known as a code reuse attack.
The rock gouges readjust the stack frame.
The goal is to reach the Windows API libraries using the right gadgets.
Much like navigating a maze.
The purpose of rough chaining is to call Virtual Protect.
Virtual Protect is basically a on and off switch, which would set the entire stack as executable or
not executable.
This is an example rap chain generated by Mona's, the MONA module, a thin immunity debugger.
Notice how the highlighted section points to virtual protect.
Before that, we have a pop exit and return instruction.
Pop means to execute the instructions, locate in the X register, then take it off the stack.
The return instruction immediately points to the next pointer, which points to a virtual protect.
Thankfully, the creation of rock gadgets has been simplified, using tools available in Metasploit
and immunity bugs mono module.
Usually a substantial amount of understanding assembly is required to build rock chains in such a way
that we can call the Windows API functions.
We will use immunity bunkers, mortar module to construct our rock chain and exploit vault server with
system wide hardware and four step.
Set permanently on an a windows server machine.