Hello, everyone, welcome to a new viewers of our back during P series.
Today, we are going to learn how to backdoor a file using lower P and X 30 to debug program and some
reverse engineering techniques.
The tools we are going to need in this video is lower P X 30 to debug Edge X D Hex editor and sends
it.
We're going to back door to seven zip itself.
The seven zip I'm using is an older version of the seven zip which has a slot turned off.
The version I'm using is version seventeen.
You can download it from SourceForge.
Should be easy.
Let's start by copying our seven zip file to our desktop.
Now let's open lower key and then click on P editor, then browse for the seven zip file.
Next, we click on sections.
We can see all sections here, click on the last one and choose at Section header, I have to click
add section header.
Now we need to edit this section by clicking on it and choose edits section header.
Let's give it a name.
Mike test.
Now we need to change the virtual and the Rossides to one thousand bytes you can make unless you can
make it more, it's up to you.
OK, close it.
OK, there's something I missed, which is the flag, let's just open it again.
Click on facts, make sure they're all read right and executable code, because we are going to execute
our code from this section, so we need to make sure it has the executable code checked on.
Since we haven't defined this new section yet, which is going to air if we try to open seven zip now.
To fix this, we will open this file in any Hex editor in our case, we will open in Høst.
File open, let's choose our file.
Now, go to the last, buy it all the way to the bottom.
Put the put the cursor here,
then choose insert bytes from the file, I mean, from the edit menu.
Put any number of votes you want to fill since the election was one thousand buys, we write one thousand
and the body count, we'll leave everything else the same.
Now, let's verify that we can open the application now.
Very good.
Now, let's open this application in 30 to the park and go to the entry point.
We are at the entry point now, if we go to memory map, you can see the structure of all the section
within the application.
Notice our section that we just created that test.
Now, before we continue, we need to redirect the entry point to our new section, and once we are
done executing our new section, we need to come back here again.
So the execution flow of the application doesn't get corrupted.
First, let's look again at our new section and copy its memory address from the memory map.
Now, let's look at the first instruction, which is push SBP, this instruction is on one of up code,
which is fifty five.
But if we change this instruction into something like don't, then that instruction will be corrupted
because they don't have the same code and we will override the instruction next to it if we want to
replace it by dumping instruction.
The jump instruction by itself is not one code, but if we jump to a memory address, it will require
five hex characters, one for the code and four for the memory address we are jumping to.
But if we look at the entry point instruction push SBP and the next two instructions movie PSP push
f f f f f f f f.
They are a total of five hex characters.
So if we replace this instruction by jump and then the memory address of our new section, it will replace
all the three instructions.
But we don't want that.
So says we need these three instructions later to continue the flow of our program.
We will save them in a text file.
Right, click binary copy.
Since I really stepped in one time, so I'm here now, I'm going to reopen this application and import
Sevenzo file.
Again, we are at the entry point now since we saved the first three destruction's, we can replace
the first one with jump and then the memory address of our new section.
We had space and then we type jump and then the readers of the new section.
Now, if we step into it will go to our new section.
Now let's save this file as a new copy so we can leave this first copy intact.
We're going to patch it file.
Patch file, and then we choose patch file again.
We give it a name.
From now on, we will work on the new one.
Now, there is another problem, if you remember, from our stack, from the Linux binary exploitation
videos, it needs to be the same when we are done executing the new section and return back to the next
instruction after the entry point.
Which if this is our entry point, we need to come back to this instruction, the very first instruction
after the entry point, because if we jump back to this back to this instruction and we said that we
said earlier with the stick and registers having different values than the initial values we stored
in them, the program won't run and it will crash.
With that said, we need to push all registers onto the stack and restore them back right before we
restore the first three instructions in the program that we just saved.
Let's first step into one time and go to our new section.
Good.
Now, let's say the registers and the flags on the left side here, we're going to push them on the
stack by using the push aid instruction and push F.T..
Let's save this file has seven zip three.
We are back at the entry point since we need this next instruction after the entry point anyway, so
we need the memory address and we will save it into a text file.
Let's continue and go to our news section by clicking step into.
Now let's create our reverse shall TCP payload without with massive venom.
OK, let's copy our show code to the text file.
Let's copy and paste our show code into our program here, using the ignore size option.
Binary paste with ignore exorcize.
It's all good, but there's one problem here with our Chalco and massive venom Chalco, it has an infinite
waiting time code waiting for a single object and that will prevent the execution flow from continuing
after we get our show.
This instruction deck IACI, which decrements he is, AICI, will make the value of the register negative
one, which is infinite.
Since we don't want to be infinite, we will leave it zero and change this instruction to not no operation.
Let's find this block of code in our theory to debug.
Now, let's compare them.
Looks like this is done, we are looking for.
One more thing, if you look at the shoket, there is one called SBP at the end, this will make the
show code call the exit function, but we don't want our program to exit.
Right.
We can also not this instruction from now on.
Let's break point on it.
Since we pushed F.D. an ad at the top, we need to pop them back to restore our all our registers and
our flags.
Let's do that here.
Keep in mind that they have to be in reverse, so if we did push, push aid first, then we do pop aid
west.
Now, let's pay us to three instructions that we have saved in the very beginning.
Then the last instruction is to jump to the entry point, to continue with the execution flow of the
program.
We really have the address saved.
Let's jump to this address.
I'm going to save this file within your name.
Let's talk in a minute, CAF listener for our connection.
Hoopes.
We got our shell, but the program still crashed.
Let's find out why.
The reason why this happened is the civil rights E.S.P was changed from what we have saved on the stack
before.
Let's first check where the ASP is pointing at after the first push ad and push f the instruction.
Going to step into now this is the beginning of our so-called let's check.
Where is this pointing at?
Let's save save this address.
Now, let's go all the way down to our knob and obstruction right before our pop F.T. and Pop 80, I
already have a breakpoint here and let's continue and see what's the new value of our E.S.P.
He is pointing at a different location.
Let's save this one.
They are not the same.
That's why when we tried to pop back all the values in the registers and E flags, they ESP was not
pointing at the same as before.
So we need to adjust our stack to make our point at the right location.
Let's calculate the difference between a calc in the program and make sure it's.
This is the very initial value and this is the new one.
Let's subtract.
We got two hundred and four in Hex, so we need to add this value to DP to adjust to make it point to
the right memory address.
So instead of our two knobs here, we will change.
It will add up to a four.
But notice the corrupted our instructions after it, right, let's correct that again, Pop, F.T. Pop,
and then our three instructions.
And then our job.
Now, let's save it at a new as a new file.
Let's start our next listener again.
Nice, we got our show and we still was able to open our program.
Very good.
This was the end of our video.
Thanks for watching and see you in the next one.