Okay.
So welcome back to Introduction.
I'm sorry.
I was just arguing with my family.
He just did something incredibly stupid.
So in this final part, we're finally going to do the read the plot attack, which is to return to the
procedure linkage table.
And basically we're going to overwrite the global offset table entry.
So instead of pointing to print F, which is actually in the source code of this function, let's see
where is my source code?
So instead of calling print F, we're actually going to overwrite the global asset table entry from
the procedure linkage table and then have a 0.2 system instead.
So what we're going to do is actually add a few gadgets of my own.
And here is we're going to do a new debugger for vol dash to.
And then want to run press.
R And then when press control c.
And then we want to type X info x file system and we want to take note of the memory address.
You could also do exactly this thing like p system.
You can get the same value.
So watch whatever way it works for you.
Works just fine.
So we're going to do let's see, attempt four and then we're going to do this call equals this.
Not to mention from import star.
Let me see.
What we want to do now is find the printf function that we want to replace and we want to calculate
the offset.
So you can either calculate the offset.
Well, here we just do print f right here.
Just save the address or you can do something like
sorry.
Protects the print F address minus the CIS call address, which is fa00.
So you could have just said offset to CIS call equals this or you could have alternately done this.
Offset to assist call equals current f minus fiscal.
So for this we will need the following gadgets.
So let's open up proper.
Let's just use the first one to offset this this call.
Either way, it would actually work.
I'm just a little bit irritated right now because I told my father I am busy working on these courses,
but he has chosen to disrupt, you know, my instructions or my time to instruct all of you.
So you file full volume and then we're going to search for the following gadgets.
So one search for search def, one return.
Return equals this.
We're also going to search for the guide to search pop the RTI return.
So pop RTI rat.
Remember to move the last colon.
Search.
Pop up,
pop up, return.
And then when to search for sub RTI from the base point because what we're doing is we're actually using
that gadget to calc to overwrite our global offset table entry for our Cisco.
So we turn this print function into a call basically.
So what we're going to look for is cert sub RTI.
Let me see.
O sub and gadget that we're looking for is the one located right here.
So we're going to add another gadget and we're going to call it sub RTI from return base pointer.
And finally, we're going to look for the shell string within our binary.
So back up here, we're going to do the command VM map.
Remember, this is our address, Ray.
So set start equals this.
Set dollar sign and equals this.
And then we could run.
The command search pattern shall start and full.
So we can tell that it's a two byte string and we can use this copy, this address either or would work
actually, but we'll just use the first one and we're actually going to do this.
The shell equals this address.
So your final source code for your exploit.
That means basically we need 216 bytes.
Right.
To overwrite the instruction pointer.
Offset to overwrite return instruction pointer.
Then we're going to pack another gadget or return gadget
to 64.
Let me see.
Oh, I missed something.
I'm sorry.
We also need the print f.
So disassemble main.
Disassemble me.
And then we're actually going to disassemble the print function.
And we're going to notice this section right here for the Global Offset Table entry.
So I forgot to mention about that.
So we're going to save two variables.
So save this.
Credit f at.
Procedure.
Lingo.
Language table.
Print f global offset table.
We want to save this value.
Salsa Pop rti return
de 50 4ff the global offset table
pack pop return based pointer return.
Above a piece of the floor offset to Siskel, which is who knew this value.
So if you don't know what I'm doing, what we're basically doing is that we're going to replace the
global offset table entry to point it, to assist call.
Instead, at this section right here, we're actually going to change.
Um this global offset table entry to point a system instead of actually just printing a string.
So basically that's what we're doing.
Plus equals passive for sub BP.
Oops.
Above
64 return plus plus equals p 64.
Pop RTI return.
But plus those 64.
So.
Plus plus
plus plus p 64% at pointer procedure linkage table system standard output buffer.
Write buff.
What is this?
Turn this off.
Let me just check the code.
Correct.
Let's see.
We are doing a
packing a let's see the procedure to linkage table address.
We're putting the shell string.
We then pop the register return as an argument.
We're executing a return.
We are then making a calculation to make printf point assist call.
This is our offset to the this call within pop, the base return and the return.
We then pass the address for the global offset table over effectively overwriting it with our offset.
And then we're going to pop the return because at this point when we run this gadget, it actually calls
system instead of print f.
So we hijack control and then we pop out the return, which means that it's basically running this.
So it's going to be doing system.
Michelle and then we ask you to return because you always have to end with a return for 64 bit column
conventions to align the stack which allows you to execute your show code.
So let's see if this works.
No attempt for pi.
Copy all this.
Python.
Three, four,
four.
Press enter again ID and we have our shells low control, easy to zoom.
And then we're going to do that slash route, slash flag text.
So if you don't know what this actually means, this is actually the flag or the lyrics of a song.
I'm never sure.
I'm not sure how many people are from the United States or if you guys watch G.I. Joe.
But there's a 1987 cartoon, G.I. Joe movie, which had a like a really epic kind of entry.
And this is the hooks for the Cobra section for you.
Yeah, but this is going to be your flag for the final quiz for outer space layout, randomization,
bypasses.
So if you really want to walk through this to the debugger, let's go back.
We're going to do Python three, attempt for pi, pipe it into payload.
And because we're not running in this anymore, we're going to do let's see, let's put a Z here.
This is symbol three.
Underscore me.
Let's put a break.
Here.
Break.
Me plus 71.
Now I'm going to run up the payload
and I want to put another breakpoint at system.
So you can either step through it.
Single step through our rock chain.
Or if you want, you can delete the first breakpoint.
Press Continue.
And as you can see, if you look at this address now, we are calling our printf function which is now
replaced with a call to shell.
Right here.
So we continued.
Asleep.
The second breakpoint continue.
It would set fault because it's actually forking.
Its SEC faulted because it fought a process, and that's why it doesn't work.
But as you can see, we already have our shell.
So if we ran a finding of breakpoints for our payload, it should say something like detaching after
V Fork from child process 424 What's going on is that it basically spawned a shell session and because
it had received no commands, it just died.
And that's why we can always do this exploit again and again and again, so we can just do Python four
for tat.
Where Von.
Oh, sorry.
Python three ID.
See Import PTI, PTI, icon and bash.
He wrote cat flags and this is your flag for the final exercise.
So I hope this is a great thing for you guys to go through at this point.
You already know how to bypass non executable bits, how to write custom shell code, how to do 64 bit
exploitation, how to bypass the stack canary.
And you are more than ready to take either offensive securities exploit 301 which would teach you the
windows exploitation side of modern exploit development.
Or you can go take the N from SANS, which is a sec 60 and you are more than ready to take the SEC 760
course, which will be focused more on heap and kernel exploitation.
So thank you for your time.