Hello and welcome to a new lesson in the previous lesson, we saw how to write Melva, they can embed
shellcode in the text section.
And in this lesson, you are going to see how to embed Chowk in the data section.
So going down to these new project here called Piil in data section, and you can put it in the same
forward as the previous lesson 02 imbedding bill.
So as usual, we have to FA's compile script and also the source code.
So let us take a look at the source code calk payroll data section, thus GPP.
Right.
Click on it and open it if not back.
Plus, plus.
You will see that it is almost similar to the previous version where we embedded the Chalco in the tech
section in the previous lesson.
This show was in sight and main function, and therefore it is found in the taxation of the file itself,
which contains the executable code.
Now we put our site to function.
So when you put any kind of object variable, our site function becomes a global variable or a global
object.
So this code is now in the data section.
That data session is where all the initialized data are stored in F.R..
And also, many of these loaded in memory.
It is also starting a data session in memory.
All of those objects in today's session, global variables global because our site and you function
the same thing also applies to this variable here, which is our site in the main function.
Therefore, this is also a global variable.
And also, it can be found in the data saying there isn't a quote is to see exactly the same as the
previous one.
We have what you along to allocate memory.
And then once we collect memory, which is set to read and write, we will print out the addresses for
the shellcode and also the address for the other key to memory, which came from which you ALAC.
And then we will copy the Chalco into the allocated memory and then change the protection for using
which will protect to make it readable and executable.
And then we sure prompt us to use it.
Presenter.
And then he waits for the user to press in Turkey.
And then down here we test whether the return value for which is protected was successful.
If you are successful, you should be non-zero.
And then you enter here and create a tray out of these allocated memory which came from which you are
OK.
Then you will wait for a single object.
Meaning that you will wait for the check to close before the program quits.
So that is now compile this as usual.
Def command line executable for sixty four.
So go down to the bottom left and key native and then select the first one.
Excessive for native to command from four v v s two zero one nine.
And then we are going to change our directory to this location.
So we called you click on these right click and copy this path.
Come down here, see this space correctly, paste above, hit, enter to go to that path type diyar,
release the contents of that territory and confirmed.
And you compiled Becky's name.
So we are now going to run the compiled script to compile this source code into executable.
So we just type the name of the script and enter.
Now he's in the process of compiling and he has succeeded.
As you can see, these new far has been created.
We are at one small to confirm the following day.
And now we are going to run this file so we type be a president and keep pressing.
DETTMAN Did you get any kind of ifar into the security?
Immediately you will see that he prints the address of the shellcode, as well as the educated memory.
And this coming from the previous who over here in here.
So now we copy these analyses.
So we just select all of this.
Right click to copy.
Come back to take on, file you to create a new blank file and then directly in peace.
These two lines in here now, they're going to examine this memory.
So we are going to attach a 64 dbg to this running process.
So open the ICC for me, Ruggie.
Sure, that have used to 64 bit version and then options, preferences.
Make sure your system breakpoint is unchecked, your gas callback is unchecked, leaving comedie entry
breakpoint checked.
Any check on safe.
Now click on file attach against the ingraining process, which is in memory.
Going to attach.
I tend to go to the CMOs here, so like on the mainland, you hear, because they are also known as
their user, Miyu, and then you go goodday and being run to synchronize your debugger with the running
process.
Now we are going to press enter on the keyboard.
So when you press, enter your big boss and the breakpoint here containing the key interrupt three,
which is the shellcode.
So this is coming from.
They.
So that when you press enter here just now, the president here get shower has captured the enter key
and then proceeded to create the tray.
So the trick here will go take these allocated memory here and execute.
And once it executes, you execute these four Chalco here, which are nine zero nine zero, C, C,
C three.
And then you pass it this interrupt here.
So this interrupt here cost the debugger to pass.
This is interrupts easy.
So now this form circle here, we can search for any memory to see where it is phone picking on a memory
tab and right click and you can click on find Pétain key in the pattern for the shortcut, which is
nine zero nine zero.
C, c, c three, which is coming from here.
Nine zero nine zero.
C, C three.
You can also confirm he's in a c.p.u just now.
Maybe.
Sorry.
So now click on OK.
And he search.
He is found to eat.
So let us copy this now correctly.
Copy corruptible and go to the Lang file and basic below here.
Right.
We can paste the first address here.
He's referring to the allocated memory address that which is allocated for the process.
And if you look at it in memory in this region, Pfeifle and back Fonzi rules five four eight four zero.
He saw here this pi.
It is highlighted and because the iboga was passed in this location.
So this is one way to allocate allocated for us.
And you guys, I mean, here you can see it is nice private, meaning that what you created is for the
private use of this process.
And being here, you know, the protection is executable and readable, previously was readable and
writeable.
And if you go back to the program, so you can see that originally were channeller and then you created
this region of memory.
You set it to be readable and writable.
That's why you get RW as the initial production value.
Then later on, after we call this API to copy the Chako to the allocated region of memory, we will
use which protect to change you protection from readable, writable to become readable, acceptable.
That's why you see here now it is executable.
You're the.
Now the next one is taking place in memory that this chocolate is found.
He said this address, one tree.
He triple zero.
If you look at it in the memory map, he's in the guitar section here.
One tree, five, f e triple zero.
This has to be expected it to be the initialised data section.
Daytime.
So this shows that the global variable this is this is starting a global variable section known as a
doctor transaction in memory.
So this video shows you how to create Shellcode Einstein in the data section.
So to do that, you just put your shellcode as a global variable, and that means to put it outside
of any function.
That's all for this video lesson.
Thank you for watching.