Hello, everyone.
And this video, we will continue our, uh, explanation about the search, but this time, which is
structured exception handling, just in case you missed the previous video.
But this time what we will be doing is, uh, last time we had this security check disabled.
So this time we will be enabling it.
OK, and compiling the application again.
So this time the goal is to bypass the security guard.
OK, I already wrote on my account what security guard is, but just in case, let's open up the Microsoft
Web page and take a look at it quickly.
So Stuttgart or Stuckey's, they get enabled with the GSA flag.
OK, so once you apply this, uh, there will be like a security cookie added to the stack.
And that way what happens is the system before it unwinds the frame and goes back to the previous frame.
So let's say a function, uh, a program, a function and a program does a call to another, let's say,
uh, function or the program does a call to a function before the program goes back and the.
Let me just repeat that again.
You have a program, it does a call to some function, so before the function ends and goes back to
where it started.
The unwind process will check if the security kookie or security detail, which was added on to the
stack, has been overwritten or not, if it has or it has been modified, I mean, if it has, then
it means the stock has been corrupted.
So the application will will, uh, uh, will get terminated.
OK, so the application will get terminated if the security cookie is going to be modified.
OK, so we will check this all and this video will learn a little bit about the how to bypass this using
S.H..
Uh, I'm also going to like show at least the security cookie debugger that using the debugger, look
at it in memory, use a debugger and see how it's being checked and how the application will crash once
it sees that the, uh, the value has been modified and and so on and so forth.
So there are a couple of things we will be learning in this video.
The idea is not really just about exploitation, but also to learn more about these, uh.
Is mitigation technique, so this is a by the way, a compiler compiler mitigation technique, so it's
a technique to mitigate exploits added by a compiler.
As you saw, we applied it using the compiler itself.
Now, all we need to do is compile, which I already did.
So we now have, uh, a new application, by the way.
So if we use our previous like just one one important thing, if we use our previous code, which we
coded last time in the previous video, to exploit the same application, because I love that the same
name, it will not work because.
This attack is now different and the offsets, all of these have changed, so I run this, you'll see
that this is not going to work.
OK.
So the buffer length is all correct and the application started, but it will not work and it will terminate.
Why?
Because the the Stargardt's probably prevented that from happening.
And all of these offsets, again, have been modified.
So what we are going to do now is let's create a copy of this or even let's see what was this one?
And start from there because we need to modify.
Yes, let's use this one.
So let's do a copy.
Going to call it bypass.
One is going to be a little bit a long journey, so please stay focused.
If you have coffee, tea, whatever you like to drink.
Uh, make sure those are available beside you.
So what I'm going to do now is, uh, you, uh, let's say, yeah, let's disable this, because at
the beginning I want to find the new offset.
OK, so I'm going to do off equal, uh, let's say.
And.
Uh, pattern.
Yep, and let's do a pattern.
Here equals.
Uh, a multiply by one thousand.
And I just want to run the immunity thing, uh, create a pattern or actually, let's wait a minute,
we already have one here.
So let me just use this.
This one was done on the previous video, so I just use that.
So if you don't know how to create a pattern, please just go back to the previous video and watch that.
This is very simple, using, uh, immunity debugger and Mörner and, uh, thanks to my honor, we can
do that.
So if we run the code now.
Because I want to adjust the offset, bring some coffee.
And now.
If we run the application, so if we're on the application, an exception happen now.
And as you can see here, look, as you can see here, the pointer to our next guest has been overwritten.
The handler has been overwritten as well.
If we go down here, we can't even find the end of the chain of our exception.
Handler.
Why?
Because everything has been overwritten.
You can also see this and see a chain like with.
It probably last time, so we can see that our I see a chain, which is this record smash that offset
twenty eight.
So by the way, keep this one in mind.
This is telling you the offset, but let's see how we are going to actually find the offset.
So we now had, let's say, a shift of nine.
So the.
Yippy got overwritten with this value, but.
Well, let's copy it and now use mine again, one at an offset, OK, and give it the value so we will
see that it's found that offset position 32.
Great.
But keep in mind the.
The next, because, remember.
The state's record, or let's say the record for the structural exception handler are two four bites,
the first four by eight points to the next one, the next record and the next four bites actually points
to the handler itself.
So at the outset, so this one is telling you the pattern, the offset is 32, which means that the
next S.H. is at 28.
So this was also another way we can find the, uh, the offset, but it's probably just in this case.
OK, so keep that in mind.
Now we have 32.
Let's go modify our code and.
Let's go here, so we have.
So this is my first one going to follow the same thing, we we are used to bypass one, bypass two and
so on and so forth.
So let's call it this way.
And now let's do.
Ayes multiplied by 32, right, or we can just immediately do 28 and then and actually, no, we could
just go now immediately to this and say 28.
Yeah, let's just stop using this one.
We don't need it anymore.
OK, and.
Let's continue.
So, well, actually, let me do one thing sorry, let me do one thing.
Let's see, uh.
Let's see the Stuckart, let's see the Stuckart here.
So instead of twenty eight.
Uh, let's do let's do like 50 to overwrite this with 50 and see what's going to happen.
So I hope we manage to override the.
The cookies as well would this option.
So now, uh, if we look at the chain one to see each.
Jane, Jane, you can see the default for the system.
Oh, good.
So now we secured our application.
OK.
And then.
Let's execute the Asian.
See what's going to happen, I'm jumping over most of them, I just want to see so our point out to
next, it now got lost.
By the way, if we run this again, we should be able to see it because it's got now loaded added to
the stack frame, added to the stack.
I mean, and if we go back, I probably because I'm using of eight.
So I probably jumped over the, uh, the entry where it got added to the stack.
But I will do a detailed, uh, step by step in a in and let's say in a couple of minutes.
So don't worry about that for now.
I just want to see when the override is going to happen.
So let's continue the series.
Continue, continue.
We will do a deep dive into this or at least look at them.
So continue, continue.
I'm going to jump over this.
Look, the point those have not been written yet.
OK, so now.
OK, so great.
So what happened is, as you can see here, I because I jumped, by the way, over most of them, so
we didn't get to see this.
But actually what happened is the cookie got checked and it terminated.
Let's do a let's say a step by step check into this and look at what will happen in a normal situation
and what will happen when our cookie over gets over it.
So we know 50 bites will overwrite the cookie, by the way, and interrupt.
Twenty nine.
This one is if you Google it.
This one will lead to the interrupt, uh, which will lead to an internally implementation, if I will
add that also to the video, which will call the first failed.
Function or.
And this one will actually terminate the terminate the process immediately.
OK, so that's why the process will get terminated.
So if I do shift F nine, you'll see that the process is going to terminate.
And you see the exit code gave some exit number, some error code.
OK, why?
Because the application did not exist properly.
Let's see what will happen when we exit the application normally.
So let's do instead of this, just put 16 because our stack our if we go back to the code, uh, we
were copying 16 bytes.
So let's say our normal case, everything is working properly.
Let's wrap this.
And look, so now if we run this and let's start.
Look, I'm also going to, by the way, jump over things just to speed things up and but then again,
I will do a deep dive into all of these.
At least we'll go through them step by step.
For now, I just want to.
Uh, see that everything if run successfully, no problems.
Unable to process the exception so that we.
Uh.
What happened here?
OK, so.
That's actually called.
That's less than that, maybe 10.
Hutton.
And the buffer here, and you had a.
OK, so let's run the length since 10 this time.
Um, yeah, so this time we should.
Uh.
Just look like, yeah, that's good.
So we start this, uh.
I'm just.
Going to continue.
Uh, good, good, good, good, good, good.
But I think you're here to see everything here finished successfully, and that's why the exit code
was zero.
Can return zero.
So everything finished successfully, so that's why there was no errors in this case, right?
There was no errors in this case.
Now let's look at everything in detail and look at the how how this is going to work.
But before we do that, by the way, one important thing here is let's put break points out our main
function.
So that's why I installed here the demo copy of IDA.
So just load your EXI here and I just want to find the main function.
So we look at.
This.
This is probably where the cookies.
Yes, this is where, by the way, the cookies get and the exception handler, this is where the cookies
and the exception handlers get registered and added to the stack.
Also, as you can see here, this is where the REGISTE, the exception handler, it's it's stored in
eggs and some operations are done on the eggs.
And then, uh, that is going to be stored into the, uh, segment registered of a zero, which is where
our exceptions handlers are located.
So that's why over here you can when we dump the, uh or when we go to zero, we can see where the exception
handler start.
And this is where the security cookie checks.
So these are a couple of proteins, probably, uh.
So these are all of these proteins.
So these are, by the way, the I think the cookie I'm not going to go into details about the cookie,
but it is a random value.
But anyway, for here, what we want to do is two things.
So let's find the address.
Of this, and the good thing is we have a static address, so I want to just put a break point at 10
14.
So when I look at my program, let's increase this make it, uh, this one I mean, make it 50 to do,
uh, make an, uh, overwrite the, uh, the cookie.
OK, or actually let's leave it ten just to see the cookie first and then see how it's going to be,
uh, modified.
How should we do it modified?
Yeah, let's let's go this way, no problem.
So let's do this and run it.
And then go to address what is the address again, 10, 40.
OK, so we need to go to address 45.
Ten or three, let's go here.
So this is where the by the way, the cookie is being added.
Security Koki.
So let's add an address here, and if I by the way, with the time by the time you, uh, watch this
video, there's anything wrong with this approach.
Please let me know at the end.
I, uh, I'm also doing these videos, so I don't forget what I have in my head.
Kind of.
So that's one.
And then the other thing I want to use either for here is also to find the main function.
So Main also starts at 10.
E0.
So this is where Main starts.
Right.
Let's double check here.
Yeah, this is, uh, ten forty and then Main is a 10 zero, so this is where I mean.
The starting.
Uh, the, uh.
What do we have here called to this?
What is this going to do?
To a lot of other things.
So, I mean, I just want Chuck.
You have this.
Exception handled in Maine call this function.
Which is our could.
Which is the print message, right?
Let's just check the one to get this one quickly.
So what do we have here?
This is the.
Uh, the printing.
You print off, OK, so this is where the stuff is happening.
Um.
So, Brent, uh.
What else do we have here?
Uh, just checking out a couple of different things, I just want to make sure.
So, yeah, this is Maine, which we want OK to have and then.
Just checking different details.
Anyway, by the way, I hope I didn't confuse you with this, just we, uh, the important thing for
now, because we use the debugger is to find Maine.
So we know Maine is at 10 e0.
And by the way, it will continue to be a 10 zero.
Why?
Because, uh, I will show you in a minute.
Just let me put a break point and then I will show you.
So we go to ten.
The zero.
OK, this is where Maine is going to start.
OK, so if I go back to my computer code and compiler and just a reminder why this is always going to
be the same, we go to the Linko, we go to advance.
You can see Dynamic Pace has been, uh, disabled.
So we disabled or, uh, there is no dynamic pace and we already specified where the pace addresses.
So that's why it will always start up.
The address is forty four, fifty five and then relative offset for everything else.
So good.
And again the idea here was doing this just for demonstration purposes.
So what else do we need to do to get this started.
Uh, let, let's just start then.
So we OK so now we are uh we started the application.
OK, I'm going to continue doing the.
OK, return.
OK, John here was 14.
OK, if I run the code, by the way, we should stop at our uh uh, we are we are now at the main main
entry of our application.
So if we now push BP, you should see BP has been added.
OK, let's continue push, push these initialization other different stuff.
I'm not going to deal with them for now and here and now before I can before I do this.
By the way, let's look at the.
Mona, SHC.
OK, so if we do that.
We can see that this has been registered or added to the stack, probably from a previous instruction.
And now we can see that X, which has this entry descent three, by the way, is for our, uh, one
of our, uh, sections 19 F zero, 19, 18.
So we look at 19 at 18.
This is where it's pointing.
Let's see where this is going to be pushed to look.
The now.
What happened is at this address, we use the address and we added the pointer to the next search,
which we already saw in the logs.
So in the logs we saw, the address was 19 of 16.
So if we look back here, we can see at X, which has 19, F 18.
So it was pointing 19 F F 18.
What is that again?
Yeah.
And what we added into that is the next pointer is at 19 of 60.
And then the handler is at 44, 55, 11.
Fifty five similar to what we saw were in Mona here.
So forty four.
Fifty five.
Eleven fifty five.
So we saw here.
How this value actually got added to the stack now, so we now know how this value got added even to
the stock, so we managed to see that.
Let's continue now, though, if we continue, let's see here.
Oh, so we now arrive, by the way, 10, 40, remember, were 10 Fortier's.
So turn 40.
If we just go back here, it's where our cookies are dealing with.
So let's make it pay attention to this one.
By the way, I highly recommend you use maybe, uh, like a pen and paper to write things down, or
I will just write them here on a notepad.
Let's see what we have.
So we look at.
Let's see here.
So did we start pushing BP, BP, BP's now added to the stack, which was where is it?
Yeah, this one.
So let's copy this.
Just to check.
A, B, P equals this, and then let's continue our executions of seven, which minus two or minus two
is going to be added to the stack again.
Also, we can see that here.
So minus two here and then push this value 44, 55.
Two or three zero.
So we're going to push that.
So let's take a copy of this, by the way.
Let's take a copy of this and you'll see why this is one and then, uh, continue.
Take a copy of this also.
One thing, if I go back, by the way, to the Microsoft documentation.
This is really the buff, like the stack is not really one.
It's like it's an offset to.
If I remember correctly, I really don't know what I read this, but it's an offset to a kind of let's
say, uh.
Uh, whole, uh.
Structure.
OK, so probably this is the structure, uh, for example, the following suit.
Yes, but first, OK, no, not this one.
Yeah, I don't know where I found that, but, uh, well, I think I can probably if I found it somewhere
else.
So where did I find.
Yeah, let's, uh, I don't remember where I read that, but, uh, it's probably not just one value.
Let's check again.
We'll see that.
So now we are going to add another key here.
We are going to add.
Whatever is pointing now.
Here, so let's see what's pointing now at our first entry of the chain, so if we do this before we
continue just to see I an idea, so we see that our first entry is 19 F F.
So let's copy this.
Oh, it's 19.
Off of that, I copy that, Binoy.
No, I don't think so.
OK.
The line.
Yeah, so this value is going to be copied well into X.
OK, and this address, let's call it of first, uh, start of.
Sort of a sea change.
Right.
This is where it's located now.
Let's save these notes.
The desktop.
And let's call it, uh, and see it, but, uh, clucky by us.
OK, and if we go back here to our execution, so this value which we saw is going to now be starting
to IEX.
So let's continue.
Oh, it's, uh, what was it, 19 of 18, so got started into X, now X is going to be pushed onto the
stack, so it got stuck.
Let's continue here.
These are all the different kind of initialization stuff.
I'm going to continue.
Because this is not really what we need, so here is what's happening, by the way, the copy, by the
way, this is the copy.
The we we saw how the stack got initialized, by the way, with that, uh, with that value, with the
stack cookie.
And now we are, uh, we are writing these values onto the stack.
OK, we are we are copying the values here in our code.
The A's, there is 10 ayes, we are now they are getting copied, were onto the stack so that this operation
is.
This one is Karpinsky here.
There's a lot one getting copied, so we copied now 840 ones and you can put, by the way, a breakpoint
at this entry and then just head off nine if you don't want to, especially with ten, it's fine.
But later on, if you are copying more than 10 bytes, it's going to take a while to do that.
So now the copy should be.
What good, so that's why we finished.
Now we are here, so we should get this message.
Saying you and let's let's finish the argument one now we are going to call this is a brain function,
really, so I'm going to bypass it.
So I'm just going to I mean, I'm going to jump over it.
So I'm not going to do that.
But if you look here now, we got the message, OK, all good.
So now we are we should finish and go back to the previous function or the one who called us.
So we continue here.
So let's do all of this.
OK, good.
Now look at this video.
So look here at this address.
Look here at this address.
Let's go.
Uh, following the.
OK, so if you look at this address here, not this I'm sorry.
Uh, so let's go to DCX.