Hello, everyone, welcome to a new video of our binary exploitation series.
Last time we were able to change the flow of our program and we were able to make it to our message
board memory address instead of returning back to the main function.
But since the very first bite in our message, both is the old boy it.
The execution stopped, and that's why we were not supposed to have an in our show.
I tried to draw it here so you can understand in a better way.
So again.
The zero X or here, ninety eight means not or no operation from its name, it doesn't do anything.
So once we hit anywhere in this new operations called bobsled, it will slide all the way down until
it finds another instruction.
So instead of making our message, our return address to point to the very beginning of our show code,
which is here is for you, for you zero, we're not supposed to do that because we have a nobody here.
So we make it maybe be zero zero zero anywhere inside this.
No operations or an upscaled once to do that.
It will slide all the way down until it finds a different instruction before we generate our show.
Colditz Exactly.
Calculate exactly how many bytes we need to reach the return address.
But before the return address, there was another address that was needed.
Right this one, this address needed by the string format function.
So we need to calculate how many bytes before this one just opened the PyCon.
Length, so that's one twenty seven plus the no bite, that's one twenty eight, right?
OK, good.
We have Chalco here, but you can generate your own code using something like MSM venom like this one.
But of course, we need you can change just to us, that's where we need to do.
And here it's eighty six and then servers to keep up with the IP address in your port.
And we can also add something here to make it.
Smallest.
Here you go.
We got our show good here.
Of course, I'm not using this one because I really have on my show Kota Off on the Internet.
It's RiverCity special, which I'm going to copy here to check the and so called equal.
So it's seventy six flights, so we already have we really have one twenty one twenty eight bytes total
to reach our first address of our strength for math function.
So if we subtract seventy six, our show code from that, we get fifty two.
Right.
So we have fifty two bytes.
One of them of course is the little byte.
So fifty one will be for the knobs that I already have my exclusive temp file that I created here.
So I have my target IP port the now the null byte, my fifty one knob's which is slash X ninety and
then the validators which is the same address as our message above, and then my show code that I just
copied and I have after that.
So show code and then the valid address.
Right.
And then 12 bytes of junk.
You remember that.
And then again the message boards address, which points to our show code from the very beginning,
from the 90s.
But here we I did a little bit of change.
The message board here, the one that I'm using, it's not a zero, remember, because if you look here,
we don't want to start from zero because it has no byte in the very beginning.
But we can start from Besar so we can start from here from inside the normal operations, like the knob
and instructions.
So I change to to make it be zero instead of a zero.
Of course you can make anything, anything inside this knob sled where you can make and c0 the user
doesn't matter.
I'm going to start my program again.
OK, so this is a single good time and stop here after destroying Fermat function.
OK.
Let's execute our file.
Nice.
So if we step in now before we get to the return address, the return destruction.
Let's check our SEC.
It points here to our zero address, right, this one here if we check it.
It's exactly from inside our operation to see all these knap operations and then our show code will
start from here.
All the way until.
This one CD, Katie, so that means if we step in one more.
It actually started or an upright step in again and again and again, it will keep sliding this cold,
not that it will keep going down.
So will it continue for now?
Of course, you got segmentation fault because it's running, but actually executed our bean bean.
So let's actually do this in real environment here without the GDP.
Let's make sure it's not running.
And now I'm going to bring another show here, this one.
It's set up Ngarkat to listen for PT. One, two, three, four.
This is my reverse show bought and now I'm going to execute my 10th.
Nice.
We've got a connection.
It's executed some commands.
And move this here.
Very nice.
Now, we actually have a few issues with this exploit.
First, the address we use is not supposed to be fixed if it's a law enabled, which is address space
at randomisation.
I already disabled it, but let me enable it and show you what I mean.
First, I'm going to kill my program.
OK, and then I'm going to issue this comment.
Which will enable SLR, but remember that GDB by default disables eSolar, so.
Let's start GDB again, let's enable eSolar.
OK, so if you're a member of this valid address from before, let's actually examine this address.
So zero zero zero for every.
It was easier before I remember.
It says here cannot access memory addresses at zero, 40, 40, a zero, right?
So let's do something.
We're going to recompile using the dash.
Gee, I'm going to show you something here real quick.
OK, OK.
So if we look here before we do anything, if we look at the message both,
what's the address, OK?
Oh, I forgot Destler Stuart again off and then brakemen.
OK.
Oh, I did eSolar off, it should be on, OK, so long on and then very.
Now let's examine the message.
Bullfighter's has changed.
Right now it's a zero ten four nine zero zero striding.
Right.
So break me and run our program.
It's now four DB zero zero.
So we notice it was the very first bite on the on the right side.
Here it is zero and the first one on the left, which is zero zero.
But you can't see it because it's not it's not here now.
But yeah, it is.
It's zero zero zero zero zero for the two bytes in the middle there changing for DB zero.
And the one from before it was where is it.
It was four, nine, ten.
So that's a problem.
The other problem is the valid address that we used in our code.
Remember that we use this address as a valid address is going to be the same thing.
So we need another address first, a valid address to be fixed, address not changing even with a Celeron.
And then we need to somehow guess the message, both address.
Right.
So are we going to actually brute force the message above, address the memory address, but we will
do this in our next video.
Well, thanks for watching and see you in the next one.