Welcome back to Advanced Exploit Development and we are about to begin our rock chaining exercise.
First, let's take a look at our initial starter file.
Bone Server.
Rob Change.
Size Start.
So this is basically a standard staff base buffer overflow attack.
And as you can see, we have a single memory address, overwrite IP to hijack execution.
And we're just going to demonstrate the difference between how this works in a non def enabled application
versus one that's enabled by DEP.
So go back to Mirror Debugger.
Right click.
Where does administrator.
Yes.
File well server.
Press play.
Harrison Barnes Thurber press play again to.
An execution is hijacked as normal.
We inserted a key, a brake to stop execution from continuing, but execution is definitely hijacked.
Now let's enable system wide depth.
So closing the debugger.
Click on start right click on computer properties.
Advanced system settings.
From the vast app settings, data, execution, prevention and turn on depth for all programs and serves
except those I select.
Apply and restart your computer.
Welcome back.
After finished restarting the computer.
Log back in.
Ask me later on that.
Come on, keep going.
In case you're wondering, I didn't enter the license key for this install of Windows seven on my KVM
installation, so that's why I see you.
Give me that.
So back to me.
Debugger run as administrator.
Yes.
File ball server not execute press play now run the attack again.
Press play to continue.
And notice House's access violation while executing this memory address containing are not.
So as you can tell, what's going on is even you cannot even execute KNOP instructions as as depths
enabled.
So this concludes the first section of rock shading.
In the next section, we're going to show you how to figure out.
How to bypass Depp.