Hello.
In the previous lessons, we have seen how the fourth experiment failed 32 percent, 64 bit payload
cannot be injected into a 64 bit process because of the, well, emulator security features.
So the only way to do that now is to bypass it.
Using this heaven's gate exploit following differing views execute x64 and x64 functions, which is
in the Metasploit Framework.
So let's take a look at see how we can do that.
So we are using this same project, which we downloaded earlier.
And then, yes, also notes Here you can go in download, which contains important links for study.
No, the experiment.
Now the x64.
Quote comes from here, this here, Annie X-T4 function comes from this line here.
So both these things.
Here, as you can see, this one is different, viewer said x64 execute, x64 could.
And then this one you see as key for function.
Also by stealing fuel.
And then if you take a look at Fodor.
Heaven's gate for the day, the far here, heaven's gate, Visconti's The.
They shall call for this.
Hey, this move.
And this comes from this here.
This link.
There are two versions.
Is a new one and the older one, we are using the new one.
So if you go to this link here now, you can get the shot.
Go for these images here.
So this one is the method Britta.
So interpreted Metasploit ballots.
So this first one is the shock for you.
And second one is a show called For One Night, which is also known as remote trick, also known as
x64 function.
Which refers to this X-T4 as a city for an excessive force of emissions and also can be seen from this
diagram here as excessive force, how good is this first one?
And actually, for function, you need a second one.
So these two are used in our heaven's gate injection.
If you don't open the.
The source code for intrusion, you will find a classic injection, which you were using before.
And there's another one called Heaven's Gate Injection, which we are going to use now in this project.
Heaven's gate injection misuse of the shellcode.
So what we do now is we copy and you shall call.
These shall go and we shall quote.
He's coming from this speech, which I shall with you this speech here.
So I just merely copied this speech and put it in here for easy reference.
So what we do is we copy this first one actually before shackled and basically here.
And then called Copy the second one, which is your excuse for function, shackle and PC here.
Next thing we do is we are going to inject the payload into the target process.
What we do first is to allocate memory in the target process.
So the target process here is first to use Microsoft Paint.
He refers to this target process.
So what we do is we allocate memory in the target process.
He had to get him in a target process here today, process.
And then we copy our chocolate over to it.
So copy the payload or do it over here.
So that refers to this line here.
Then next, we allocate memory in a local process for this chocolate, which is here.
This is this line does.
Then you look in memory for X-T4 function, which is this line here.
So these two lines allocating memory in a local process, the Trojan itself.
Next, we copy the shackle into the Alcatel memory, so this line here Mary copies active for AS ex-City
for into the allocated region and then changed the permission to become executable here.
So we make this executable by using virtual instead of which.
Normally we use which, along with the first parameter, would be null.
But over here we're using yellow.
First parameter is the allocated region and what are doing is newly changing the permission to become
readable in a secure book.
So after this line is executed, Haskell, 64, becomes executable.
And next, we are going to copy the A64 function to the allocated region.
So we are copying this X-T4 shortcut into the active region.
So allocated reunions of memories this one.
And here is a show.
So what we're doing is copying this shellcode over to the allocated region.
Next, we are going to set up the perimeter to run the.
As said, excessive function.
Now, if you take a look at this over here, this function coming from here, this is where you declare
any function pointers for x64 and rescued x64.
And down here is very used to switching pointers over here.
OK, so the first barometer is if he he's the equity for function and second parameter, it is contains
all these things.
This is a context.
Context comes from here.
He's gone days, which is actually a structure which we declare here.
This structure comes from a different view with GitHub itself.
If you go back to Steve, if you will, is going to have.
You can see the structure here.
He started his use by default function, so we have to replicate it in here.
He coming back to this.
So now after you've already initialize the contents to his problem, which is your name, I guess offbeat
and remote causes of shock, which is the message and a barometer to the message.
Bociurkiw is zero.
So we put now, no.
So we put zero here.
Then we execute it.
After that, we once executed it will be in a suspended state.
So we have to resume it in order to execute the chocolate.
So this is how it works.
So there is now trying to do this saying see action.
So we open X 86 92 and we go to this directory and combine.
After compiling the random bin to make sure there is indeed a Teletubby application and we confirm it,
yes, it is.
And we need to inject this.
Into City for the process, so we need to run the city for Microsoft Be.
64Bit, maybe something is wrong.
No, we can run our routine.
So my I've been bids to the segregated.
And this is a memory insight because I've been used as an educator to inject the payload, which is
the message box payload.
So this presenter and this is the memory allocator in a Trojan horse.
So for this to chuckle, which is referring to these two shall locally.
He's addressing what causes this address here.
And just to address here, he's referring to to address in the local process, Italian.
So you enter.
OK, so the church has started in a suspended state, so we're now in this part of the.
So it is about to call resume trade, so we enter, he will resume.
And we should get our chocolate.
I can hear the beep sound and I hear you chuckling.
Health regulations.
So let us try to confirm that this message box is indeed coming from Microsoft Paint, we can use process
occur to confirm.
So let's run for hacker and then we drank this icon.
Find windows and tray.
Drag it over to our message box and release.
And you confirmed the parent for the message boxes in the Microsoft Paint.
And then if you go to memory and go to the protection columns, Quadrophenia to our X, which means
a readable executable.
You will find one region of memory, which is an our X.
But for now, if you double click this, you will find your shell code.
OK, so this is how we can use heaven's gate to bypass limitation of WHO While 64 emulator.
So you don't even have completed this all the four experiments for our project.
So that's all for this video.
Thank you for watching.