But the.
Und Kopi.
Yep, so if we go to the address here, exactly, so if we go to the address here, what what is the
value that we have?
We have let's let's copy it actually.
Let's copy it and let's bring it over here.
OK, so this is a little endian.
Don't remember.
Don't forget that.
So we have uh.
We have, uh.
All of you have the nine and then we have 10 and then we have six eight, right.
This is what this is a little engine.
OK, so for f so at this location, we have this value and we are comparing it with X.
So let's look at X, which is the one actually which is holding our kookie value.
It got pushed into X I think.
I think from previous instruction probably I missed that, but we'll see it in another, uh, when I'm
going to do the the follow up again.
So look at X.
What do we have an X.
So why let me just delete this and say at this location, we have this right and then here, let's do
X?
Yes.
Yes, we have.
It's just that and then are they the same value?
The answer is yes.
So this means the cookie was not overwritten.
So this was the cookie, by the way.
This was the cookie that is currently that was currently added to the stack.
So let's continue.
So everything looks good and then we are going to, uh, finish the execution and jump here.
Everything, because everything was successful.
And we are gonna return from here.
And then we are cleaning the stack and we will be ending our program.
But I'm going to just continue to and I'm not going to jump over these things just to reach the end
of the program.
And then the program will terminate.
But the exit code is what zero like because there was no problem in executing the program.
Now let's modify it and overwrite our stack cookie and see what's going to happen.
OK, let's modify it, see what the stack cookie is, uh, gets modified, so let's close this.
And this time, so this was for case number one.
Let's bring this down.
OK, so you see, this is, by the way, where we.
Yeah, I don't remember which one exactly, we overwrote the stack, but these were all our entries.
Let's go to a test again.
Hopefully, if you continue, you, uh, if you also do this by yourself and repeat the process, you
will understand what I'm doing here.
So let's run it again.
Let's hope if you didn't follow in the previous one, you'll follow now and you'll see how our, uh,
stack cookie is going to be, uh, overwritten this time.
So F7, let's continue the execution.
And if we now look at our team on, uh.
I see a change.
Let's see, so we should have a default ones good, cause we still have not book added our the one that
comes from the opera, uh, the program yet.
So let's now continue.
Continue, continue.
I this is where we.
Continue, yep, this is where we will probably start adding our, uh.
So this is where we will be adding our.
Uh, Jean, let's just check again.
You have not added yet, so let's go back.
So this is where our first entry will be here and then we are going to push.
The first entry of the chain, we're into, uh, the segment here, so what sorry, what the segment
is currently pointing, uh, will be pushed onto the stack.
So let's do that, which is FCC, which is the end of the chain.
By the way.
We just go back here at the end of the chain, see this one?
And it's going to be pointing to our, uh, next one, which at the end also points to the end of the
chain, which I mean, it's our and last one in our stack, uh, in our chain.
I mean, sorry.
So let's continue.
All of these are good, good, good.
And let's see.
I hope I didn't jump over the one where we will add our handler until now, no.
So all good over here.
Yep.
This is where X has the handler.
So this is where the handler was added, by the way.
So it's 19 F 60.
This is where our chain now starts.
So now I see a chain.
Let's do that again.
I'm not jumping over things for you.
So I've, uh.
What did we have to get?
So we had 60, OK, and this one was.
Added to get the entry, so 19 of 60, so if I go one, I can.
Nineteen sixties where our country now starts the.
The threat environment, not now at this location, points here, which is exactly what we saw.
OK, again, I hope I'm not.
Rushing into stuff, so the address here, this was good.
Now let's do the call to our what our function, which is going to do the copy.
So this is, by the way, where we will be doing the copy.
Let's go there.
So this is the function that will be doing the copy.
So let's do this.
And now.
Uh.
I'm going to jump over this, I don't want to go into it.
I will continue over here.
Uh.
And continue, continue, continue.
These are.
Not important, at least for now.
I want I think I probably.
Uh.
So.
Let's see, what do we have here before I just continue?
These are all good.
Uh.
I am not, by the way, people going every single step, but I I want to reach our, uh.
Oh, just to try to bypass that jump over something, by the way.
What happened here?
We sent the.
Let me start this, by the way.
Our court was sending sort, so I.
Let me just check.
So now we arrived at our main program.
This is the main.
And by now, our chain is not loaded or it is actually, yes, actually it is loaded.
That God, is this mean, I think it is.
Yeah.
10 zero, if I remember correctly, this was.
I mean.
Yeah, 20 zero, so probably I missed one.
One thing, OK, no problem, let's just continue here.
These values, so this one is going to be stored at IEX, which is where our appointer.
So.
Currently, our next Assiut is at 19 of 60.
So this video is going to be stored in the works now.
So nineteen sixty now we are pushing X on the stack again doing these operations.
OK, ok, ok, ok.
All good, so this is where.
We.
But the values and to ethics of ethics now holds our ace.
Now we are going to do the call to do the copy.
So this one is the one that's going to do the copy.
And that's to.
So the here we got we are initializing, by the way, uh, we are initializing the stack cookie here
and these values, I think these are the ones.
Well, what is the execution now, by the way?
That hurts all the eggs.
OK, so F 18, f f 18 is what our next instruction got pushed into copy to X..
OK, now we are pushing X on the stack.
Now.
Where our exception handler is OK, this value got copied to X. So this value at this location, by
the way, so if we follow this is if you remember, uh, let's copy this value of these four bytes.
So if you copy.
Is for both sides.
OK, so they are six, uh, twenty one three, three fifty.
Uh, six, be OK.
Let's see what's this value in the X?
OK, let's continue.
So now we continue to hear continue.
Continue.
Uh.
Now, we thought, OK, copy this value back to the entry point of our chain or our chain, it's so
of, uh, nineteen fifty eight.
Nineteen forty eight.
19 of the.
19 of he.
Yeah, this one.
So this value.
It is now going to be what?
At the beginning of the chain.
So let's look at the beginning of the chain now again.
Just to double check.
We should see that.
So, yeah, nineteen fifty eight now it's at the beginning of the chain, so as you can see these,
by the way, structure, exception handler, these handlers get dynamically added to the stack as they
are used or as they are going to be needed.
So now we continue, continue.
And this is continue.
Continue.
OK.
And this we are going to move one value from Xolair going on here.
Move.
I mean, copy, by the way, uh, copy one bite from Essex, which is the A's and to L so if we look
at that now, we copy that into AOL.
Now the AOL is going to be copied.
And to this location.
So this is where we started.
Now, by the way, to do the copy operation.
OK, so since this is a copy operation and we have 70, uh, 50 bytes, I'm not going to go over all
of them.
So what I will do is I am going to add a breakpoint here.
And Heidrun.
So now we are at the break point, I can remove it so we might we copy the 50 bytes, OK, and now if
we continue.
Now, if we continue.
Uh, pushier, watch this video and I'm going to jump the print function, so the print was successful.
OK, but now when when the function wants to unwind and go back, this is where things get interesting
because now we are going to check the cookie.
So.
John Kerry, now we are going to do a copy minus to add to this location, SBP minus four.
So we copied that over here.
So you can see SBP EBP is pointing at FGF eight.
If he, uh.
F f eight.
Right, and we said at minus four, so at minus four, we copied B minus two value there.
So now it's minus two.
And now what we are going to be doing is copying SBP minus 10 to X..
So look at X now.
X now is these 40 ones.
And this is, by the way, where our stuff quickly is supposed to be.
So let's continue.
And now we are going to put this into the beginning of the chain.
So this is where we are adding, actually.
So this is, by the way, not the cookie.
This is where we are adding the, uh, sorry, not the cookie.
This is where we are adding the, uh, pointer to the next handler right to the beginning of our chain.
So you can see the pointer now is going to be added to the chain.
So if we continue and now if we check the chain, by the way, again, we should see that it has been
now overwritten.
Yeah, we can see that the address has been overwritten y because, uh, we wrote it with the CS, with
the A's, I mean, sorry, let's continue pop up these values, ok.
OK, uh, EBP minus one seed that's going to be copied into X.
So good to do this.
This is now let's do this function and see the value again.
So it seems the previous value that we did, the previous instruction is where we load the value from
the stack into X and now we are going to compare it.
So if we go to.
Forty four fifty five three zero zero four, which I think we are already there yet here we are going
to compare this value with the value and ethics.
We are going to compare this value with the value in X, OK?
Uh, so if we compare now the value here, what's going to be the comparison is false for sure.
So we are now going to be actually, uh, I'm going to jump this just to so we are now at Interop 929
because the the, uh, the system will terminate the application.
Why?
Because the cookie got overwritten.
And by the way, the cookie is usually added.
Before the siege, OK, the before the next siege.
So if you look at the stats, you'll see the buffer and then you'll see the the next four bites are
for the the cookie and then you will see the nexus search and then so on and so forth.
So now we hit shift F nine.
Our application of the plan.
So if I hit now, shift my.
Oh, it's Rollingstone.
So there is no problem and probably.
It's not able to proceed.
It terminated, actually, I think there was a delay in my, uh.
My my system is getting slow, so the application terminated, why?
Because the.
Because the cookies was overwritten, let's just repeat the process again, by the way, just one more
final time and just to make sure you you got the idea here.
So we do a five again for this one.
OK.
So if we do, we start let's start our work.
OK, so this is where we are actually, uh, copying this value to X. So this value is being copied
to X.
OK, so let's remember this, but I think that's copy.
Just check it out.
And now let's continue the execution.
The.
Ka ching.
All of these are all good.
OK, so those are all to check.
The values that we have, we can see our pointer to the next US, which has already been added, so
that's good.
And let's just check it out the chain.
Want to see it chain.
I think I've got something.
You see the chain.
So the value nineteen of sixty, so we have this is what it is, 19 of 60.
OK, let's continue.
So this one is now going to do the call to our, uh, to our, uh, uh, function, so let's call that
so we continue here.
I'm going to jump over this one, by the way, but I want to go and, uh.
But at least you come back here.
Uh uh.
All of these are called good.
Probably these are the cold that's actually doing the.
The cookie thing, maybe I didn't check.
I kind of jumped into it.
Let's do OK.
OK, cool.
These are good.
OK.
Uh.
Look, I stand good, good.
I want to see where our.
CWD.
Oh.
We got into this problem again.
Let me do this.
I think I have to.
OK, so that's.
That's actually.
So I just wanted this time to see this is actually even every time is getting changed and I think this
is the value, by the way, of the cookie.
I think it is.
So let's just continue.
I will jump.
I've got this book right back here.
These are the exceptions got added back.
And here I think this is, uh.
The.
Exceptions get added, I'm going to jump over this one this time.
OK, now this is where we do the, uh.
Uh.
This is where we do to what?
That's good here.
So.
I have nine, we reach the main function, which is what I want, good.
So he's got added to the stack.
The pointer to the next associate cat got added.
OK, so now let's check here.
This value over here is going to be added minus to this value here.
It's going to also be added to the stack.
So all of these, uh, that, uh.
This value is going to be pushed into X, which is where our current, uh.
See, it starts, so our current chain starts at F 19, F F 60, that's going to be added to X, could
push it onto the stack again.
Now, we are creating this space over here where she pushes the Idei.
Let's just all move.
OK, so this value here.
At this location, so if we follow this location and to.
No dress and we follow it, let's just copy.
These videos here, so we copy.
OK.
Um, it's it's actually exactly the one I knew it was the one, so you can see a six F eight.
Then we have zero nine.
Then see eight.
This is the the the cookie, the one that was posted.
OK, so now it's going to be copied to X, probably this operation is going to happen with it.
So it's copied there.
Now, X is going to be absorbed with this value at Eppy minus eight.
OK, now accord with SBP.
Now it's going to be pushed back to the stack.
OK, so.
Uh, so this value here is now pushed back to the stock.
That's just copy it over.
I just want to keep this again, I'm not checking.
By the way, how the cookie is generated.
I don't really care about that for now.
But just to understand this, and here we can see the value and this is now actually pointing to our,
uh.
So now the handler.
OK, now 19 of 18 is going to be pushed at the beginning of our chain.
So now if we check the chain again, we should see 19 F 18.
The starting point of it, as you can see here, 19 F 18.
Good.
So let's continue.
And then we do these continue.
This one is going to do the call for the copy.
Let's do that.
Yep, this is the call for the copy.
What's going to happen here is that it's going to store CVP to make sure when it rewinds does a check.
So EP got stored, uh, the uh, the cookie.
I mean this is where we are now entering another function will keep this file is going to be pushed.
OK.
And now push this value onto the stock, 44, 55, 24 zero.
This one also pushed onto the stock and then push pushbacks.
Uh, yeah, this pushy now onto the stack, OK, create some space.
OK, so we created some space.
And what do we have next?
Is.
I we created some space now that value at that location is going to be copied into, uh.
Going to be copied into X.
Right, yeah, into X, so it's copied the.
Now, some excellent operation.
These are all added and just continuing, by the way, here.
OK.
OK, now we are going to be this is where we are going to be starting the copy operation.
So we can see, by the way, our next sketch is here, right, we can see our handler is here.
Right.
So I'm assuming this one is our cookie, by the way, let's just save that.
Like Kopit.
Yeah, let's copy this out here.
I assume probably this is the one.
OK, so let's continue here, have seven now, copy one byte.
And now that one bite is going to be.
Checked if we finished, so I'm going to vote because it's about my bike operation, I'm going to put
a point here on the program.
So, uh, it will do all the copies.
Did I reach the oh, so I put the front in the wrong location.
I put the point here, if I ran, the application would have nine now it should.
So here you can see this is where our pointer is and this is where our.
Uh, yeah, this is what our pointer to the next one, et cetera.
So now I had.
If nine, we can see this fire.
I want to, by the way, just copy this value also, just in case.
Uh, actually, being that this location.
OK, so if I hit the F nine now, these will all be overwritten with the buffer because we have the
bytes.
So F nine got overwritten.
Exactly.
Great.
Now, if we continue.
So to this to this this is a print message, so I'm going to jump over it.
OK, step over.
But we still get the we still get the message.
But now, one, we want to go back to the previous caller, which was mean.
We will start, uh, doing our checks.
So we are going to do the check.
So continue.
I am going to do the continuous or minus two is going to be copied at that location.
Uh, that value over here, minus GBP minus 10.
So SBP is at FGF eight F F eight.
And then minus 10 is going to copy those values into X, OK, let's do that continue.
Bush, OK.
OK, continue here, I'm going to do the do the call actually jump into it.
Because we want to check the this is where the cookie gets checked, so X now has this value.
Right, this values and X and it's going to be compared with the value add three thousand.
Uh, for three thousand four.
So this value.
Was it any one of these, by the way?
And I think there was some calculation that got.
So it's not really directly done, probably, or I missed a step, by the way, I could have missed
a step.
But anyway, this is a cookie which is going to be checked.
Right, so it's going to be checked.
And, uh, now.
We can see the.
It's telling us, uh, Torchy, BP, we are going to jump into another Collaroy came, by the way,
and I'm going to bypass this.
OK.
OK, now we are going to actually do the call to interrupt 29 and as I said, interrupt twenty nine,
I will add the link to it.
It's a face past fail and, uh, enterable.
Nine, whether the architecture is exacty six or x 64, uh, it's going to be first.
The the value of it is loaded into, uh, X.
So we saw the value number two, which is going to call this function.
Uh, this interrupt was, uh, two and then it's popped into X.
So the location of the code argument is always an X on an X 64 bit system is going to be in X, uh,
and on our machine and item sixty four is going to be an R zero zero.
Again, I'm just reading this from, uh, the Microsoft website.
So now we try to continue.
We can't because the interrupt has happened.
If we had, uh.
Shift of nine, the application should terminate with the board that, uh, the application terminated
so we can see that one if we had overwritten our code, even if our, uh.
Even if our code.
I would exploit was successful, by the way, uh.
Without triggering in Assiut.
The cookie will actually temper our exploitation process, so what we will be doing this time is work
as we saw.
If we override them, then the cookie will prevent us from running the application and then probably
terminate our child.
But I see it as one way to bypass the cookie.
So what we will be doing now is.
We will be using the search method, which we have already done to bypass the cookie, so all we need
to do here actually is, uh.
I think.
This should be fine, by the way, but let's now double check.
All of the Chilkoot.
And I think this address is no longer this one, so let's.
Let's just run it to get some, uh, some addresses, by the way, as the addresses are now different,
everything else should be the same except the the offset we saw.
It's 32 now instead of so we have 28 bytes and then we have four bytes for the Nexus S.H. and so on.
So let's let's just continue.
But this time I just want to get an address.
And.
Yeah, so I go and no, not.
Yecch.
OK, we can do that, wait a little bit.
I'm going to take too much time.
OK, so we go to Assiut.
We can take one of these addresses over here.
And just use a set of wheels, for example, this one, so 15, 45, I'm going to use this one.
Fifteen forty five.
OK, so if I go back.
Was this.
Um, go back here.
So we do, yeah, here it is, I have already probably done that on my test.
OK, and this is from the previous video when we didn't have the, uh.
Estacada, like enabled.
So we can now get rid of this or actually why did I do that?
Let me just do this right and to.
Number three.
So this is number three.
Let's do this.
Let's remove the salt so we don't get any more, and now let's run our call, let's copy this address,
by the way.
I will need it to put a breakpoint on it.
OK.
Und.
Good.
So let's go to this address here.
Uh, the break point for our.
So if we.
It.
Nine, we are at the main function, right, we are at the main function and now if we.
Let's let's continue let's let's just do a couple of quick instructions here.
So this is where we are in the hour.
The one that will do the right.
Yep, this is the one that will do the copy got initialized with the cookie also.
And now we are copying the one.
At the time, see one bite at a time.
So I'm going to put a break point actually is still here, so I'm just going to hit of nine.
We finished the copy.
All of those and even the pointer to next, which we finished overwriting all of this with a special
code and everything else, all all is done properly as we want.
So now we can continue our execution by.
Oh, we've got an exception, great, though, we triggered an exception, and if we check the chain,
I see a chain.
And if we check the change, we can see that the chain has been overwritten, so this is where it started
overwritten with this value.
And, uh, yeah.
So let me do just one thing.
One.
You I want to Chuck.
Uh.
Yeah, OK, good.
So let me just do this.
So now what we need to do is, uh, shift of nine.
We should stop at our exactly so that knowing what happened is the value in our chain right where our
next asset is located.
This is again, we saw it in Mona.
Why go back here?
But let me just again see it changed.
OK, so if we look again here, what am I looking at?
We look again here.
Uh, yep, this one we can see where is the handler is at forty four, fifty five.
So we are now calling actually this one, so we are calling it OK.
But since excuse me, there is nothing there to be done.
We are going to now do the pop up return, so we will pop these four bites.
So this is if there was a handler, this is where the code for the handler will start.
But since there is no really handler, we just.
We feel that the application of the system we are going to now use to return to this address, so the
return to this address, if we don't dump, what is it?
It's our job instruction.
So once we do the return, this value is going to be loaded into IP.
So F7 loaded into IP.
We went to the jump instruction and now the jump instruction is going to go to FGF, to Sophi afterwards,
immediately at here.
So we are going to jump all these values over here.
So see now we are at five two and now if we continue hit our F nine, by the way, our application continued
and we got our on our code.
So we bypass the security guard quickly.
It didn't even check that.
Why?
Because when we triggered an exception, we had to follow, uh, the exceptional routine.
And since we, uh, I mean, the the the exception handler.
Routine, but since the exception handler routine is really not a routine, there is no handler there.
There were just addresses mangling how to jump around in memory.
We managed to bypass that and not continue unwinding the process and going back to the previous function.
So that did not happen.
And at this time, we managed to run our, uh, payload.
OK, so.
That's it for this video.
I hope you saw how those cookies got get added to the application.
They are, again, usually at, uh, before the next inspection exception handler.
Uh, but again, you can trace them and see how they are getting compared to where they are getting
compared.
And based on that Interop twenty nine is going to be called, especially on an, uh, an intel architecture,
whether 64 or 32.
But otherwise, like you saw, we bypassed the, uh, the application.
We did not have to, uh.
We've managed to bypass the security guard.
I let me, by the way, just before I and the video, let me just do the one final thing here.
Call this.
See it as.
And bypass for.
And then let's delete this, we don't need it and see, uh, run it without the without the debugger.
Very so good.
Oh, let's check if everything is working correctly.
If we run this.
We should get our application and get our calculators.
So we managed to run our code seems to added four parts extra, so we managed to run our Salkeld and
bypass the Stuttgart protection, uh, which is actually a catch.
Exploits are known for bypassing Stuckart protection.
You have any questions or if you want me to go in, uh, let's say explain anything else related to
this, please let me know.
Otherwise, I will continue on another example on S.H., because this time the buffer was immediately
after, uh.
Our handlers, all we we, uh.
We called the handler, the handler actually was just a prop operator, and then the pop up return did
not do anything, but we now call the next search and the next day just did a jump to the location after
the those handlers.
But in our in this case, we had a space in the area behind that.
So we were able to exploit it.
But what if your area is actually before that?
How are you going to deal with that?
So we need to go backwards.
So we're going to be dealing with a negative offset.
So that's what we will be discussing in, uh, other videos.
And sometimes you you might need to do multiple jumps.
So also keep that in mind.
We might need to do multiple jumps.
And I hope I will find a, uh, an example to see to see how those will all play out.
OK, so that's it for this video.
I hope you learn something and see you in the next one.
Thank you.
And, uh, bye bye.