Hello, everyone, welcome to new video of our bad during P series.
Last time we were able to back-door our seven Zipp application by creating a new executable section
and execute our show code from it.
But this method is not very effective against most antivirus software.
The reason why is an antivirus were detected, the entry point of the program was hijacked and also
a new section header was created.
Let's make it harder for the antivirus.
And instead of creating a new section header, we will find unused space inside the application and
take advantage of it by inserting our shield code and execute it.
We are also not hijacking the entry point of the program, but instead we will find a certain function
of the program to hijack its flow.
This time we are using PUDI application instead of seven zip.
Let's first open Pudi and try to connect to any server via S.H..
Noticed the string appeared on the screen, logging has.
This string is very useful.
We can try and look it up in our next theory to the book.
Let's find it.
After downloading, we can type log in, as in the search bar at the bottom.
I've really tried the first memory address before, but it wasn't what I wanted.
Let's set a break point to the second memory address
by pressing F2.
Now let's continue our execution and connect to our IP address.
I'm going to click continue two times.
Very good.
We hit our breakpoint.
Also, the log in as string did not appear yet.
This is a very good indication
if you notice the instruction at our break point.
As we discussed before, the push and destruction with a memory address is five hex bytes, and if we
replace it with our jump in destruction, then it should be the same size.
That means we're not overwriting any other instructions after this one.
Let's save the up code of this instruction first in a text file.
We also need to save the memory address of the very next instruction, this one, since we are returning
back to it later.
Now, we don't know we are we are jumping to we can find an unused space in the program by a tool called
Cave Miner to find our code cave section.
You can install this tool in Inch'Allah using PIP install goldminer.
To use this tool, we can type cave dash from the command line, followed by a search, then the size
of the unused space, and lastly, they file here using five hundred bytes as the minimum space that
I'm looking for.
As you noticed, we found few caves, two of them in the data section.
I've already tried to put my shortcode in the second cave, which is the largest, but it didn't work
well.
The reason why is sometimes the cave won't be completely empty and you might find many instructions
replaced every time you open the program.
With that said, I'm going to choose the first cave for my shortcode.
Let's copy its memory address through a text file first.
Now, before we do anything, let's make sure that the DOT data section is marked as an executable using
Lord P.
I'm going to start the program again until I hit the break point from before.
Now, let's override this push instruction and jump to our new cave.
Now, quick step into.
Notice that not all instructions are reserved, some of them are overwritten by other instructions,
this might cause us a problem later, since the program will still replace these instructions every
time we open it.
Let's choose a different memory address inside our cave.
Going to copy its memory address.
Now, I'm going to reopen my program and jump to this address instead.
Let's add some knob instructions and patch this file with a different name.
We're going to work on the new Corbino.
Now let's look for our jump in instruction and set a breakpoint.
Very good.
Again, the same procedures from before, let's say the registers and the flags.
Now, let's pace our show code, going to save it in text files first.
Let's not our infinite loop and destruction.
Same as before and at two hundred and four to our E.S.P.
Let's pass the destruction we saved in the beginning and continue the flow of our program by jumping
back to the address we saved in our text file.
But before we do that, let's restore our registers and the flags first.
Now, let's jump to the very first point we received in our text file.
Let's patch this file with a different name.
With three, open it in 30 to deport.
I'm going to set a breakpoint at the bottom of our show code and check if we get a reverse shelf first.
Let's continue the flow of the program.
Very good.
We got we got our show.
Let's exit the program from six to a and try to run it normally.
Perfect.
We were able to use the Code K for our show code and it worked.
We got our show.
That was all for this video.
Thanks for watching and see you in the next one.