Everyone, and welcome to this video also about software exploitation, so in this video, we will.
Go over another example, which I explained last time in previous videos that there are three different
ways to exploit a process or an application.
So we talked about exploiting the client, using a local exploit, like a multimedia application excuse
me, by, like crafting a malicious playlist and feeding it to the multimedia application or a word
processor also by feeding it a malicious, let's say, word documents or when the word processor tries
to process it, you exploit a weakness in that application.
Same thing applies to a PDF reader or really any other client application.
Excuse me.
Then we jumped to the exploiting the application remotely, so you have a service or a process which
is running and listening to some connections, like an FTP server waiting for a connection to connect
to it and then.
Providing it some service on a Web server, running remotely like serving Web pages or any other really
network service which you can access over the network.
So this is the threat.
Actor will be sending their malicious, let's say, payload remotely.
They don't need to, let's say, for the victim or anything else if once they find this service running
and they they are in direct contact with it.
And when I meet what I mean by that, a contact here is there let's say there is no filtering, no firewall
cetera.
So they can communicate with the process, then they can craft their malicious payload and send it remotely
and exploit that process.
Now, the third one, which I left till the end and will use a really good example today and I'll explain
why it's a good example and a little bit is exploiting the client, but this time also remotely so you
might be looking at, hey, but the client is running on my computer or it's running at the clients
and it's not running remotely.
So how am I going to do that?
The idea is in this case or in this scenario is that the client themself will visit your like evil website.
So you be the threat actor Mike Craft and even the website.
Once the client visitors visit that website, if the if the application they are using to visit that
website, which is probably a Web browser, it has a weakness, then probably the actor will be able
to exploit that weakness.
Or a user has an FTP client and they want to connect to another server.
So the threat actor will create an evil FTP server and once the client connects to it, they will be
served well with evil, with an evil payload or with a with some malicious data to exploit that application.
Same thing applies for any other network service or any service that you can use a client to connect
to it remotely.
So this time what we are doing actually is the threat the actor will be serving the client with an evil
service.
OK, again, the threat factor is going to be serving the client with an evil service.
Now, what type of evil service?
It depends on the type of application you want to target.
If you are targeting enough the server and if the client, then definitely it's an FCP server.
If you are targeting a browser, then you might be interested in creating an evil website and so on
and so forth.
OK, so this is the example which we will be discussing today, also in the past couple of examples
that we did, we were always looking like, for example, for a jump PSP or call E.S.P.
This time it's not going to work.
So in today's example, OK, the the other thing which we will learn out of this, not just the exploiting
the client remotely is there is no jump speed.
And I on purpose picked a really good example.
There is no jump up or let's say there is no job or call to E.S.P.
We can do that.
There is also a nail biter.
How are we going to deal with that?
So there there's a nail biter.
There are situations similar to the one that we are going to deal with today that you will see.
We can avoid the nail biter and kind of fool the system that we are going to work around the bite.
And also the final thing is why a debugger is important.
So why?
This is another example which will show why the burger is important.
OK, this is also going to show why the budget is important and using a debugger will be able to see
where is my data going in memory and why would I go with this option, not this option.
I'm going to do all of that.
And yeah.
So let's get started.
The example I decided to use for this one to explain all the ideas, like we want to explain this.
This is one.
And I also want to explain this.
In this single example, we won't be doing in this video anything about bad character.
So we'll try to avoid them.
Just use some bad characters, which I already know are bad characters.
How to deal about that?
We have another video for that.
But for now, let's just focus on how to get, uh, how to deal with these three cases and work on exploiting
a client remotely.
OK, so let's let's start.
So here we are going to be targeting a client called an FTP client.
It has a vulnerability in the Virgin.
Six point seven has a remote buffer overflow the the exploit author Sebastian Castro.
You can go check his work out.
The exploit is found an exploit DB the same thing for the application and you can find it under forty
four, five hundred and ninety six.
OK, so that's the exploit that we will be using.
OK, so just make sure you install, go here to this application and start the vulnerable application.
I've done this a long time ago, but I, I think I have never had the chance to.
But I prepared the video I did yesterday to a video on this.
But unfortunately, due to a mistake, I forgot to I posted it and I forgot to unpause the video.
So that's in the past now.
I had to now record it again.
And actually when I had to do the session again for my students because there was no recording, so
I had to do it live today and now I'm doing it again.
But hopefully will.
That's for the good for everyone else.
So just make sure you install it.
I think I only have two days left in my trial, so hopefully we'll get to exploit it today and get rid
of it and move on to another case scenario.
OK, so here is our application.
Let's go to our threat actor, download the same file again.
This is the one for five hundred and ninety six.
Just download that to the code, the the exploit.
OK, and let's move it to our to this directory.
So it's downloads and downloads for let's move it over here.
I'm going to make a copy of it.
By the way, I again, I've explained this multiple times.
I like to exploit why.
So it's exploit one.
OK, and let's do yeah.
Let's open this using my, uh, mousepad editor so open and let's see, these were from my my previous
example, which I did at the college.
So, uh, where is my home.
Uh, this one.
Yeah, this one.
OK, so we're going to leave all the credits for Sebastian.
We will just do a couple of modifications.
We don't need the buffer for now because we are starting from scratch and moving on.
I'm going to delete all of this.
OK, a little of that and then leave all of this.
I just need to add one thing here, which is about the, uh, reusability of the, uh, so this exploit,
if you stop it and reuse it again, it will tell you that the port is already bound to port.
Twenty one.
So in order to avoid that, I think I found it.
I forgot I used to use it in the past, but this is the code to do that again.
Uh, I haven't brought a lot of Python code in a long time.
Now I'm getting, I think, a little bit rusty maybe.
So this is going to enable the reusability enable that's just type it here.
Nibbler kind of reusability.
Uh, the useability.
And the key of the port.
No twenty one will be freed.
OK, so that's what we need here.
We are going to delete all of this, by the way.
We are going to start from scratch.
So I'm going to, uh, I'm going to delete.
Though we know the payload size, by the way, is 400, but we are going to start from scratch, so
let's just put.
Junk.
OK, and then the junk here, I'm going to send a sort of multiplied by 400.
I'm going to delete all of this.
We don't need them now.
At least we will gradually update our payload.
Let me just go quickly over what this is doing.
So this is important, the socket and this is Python libraries, and then it will try to run this line
of code.
So that's why we have the tri except.
So it's going to try run this block of code, OK, which is actually creating a socket and it's listening
it, it's binding it to the IP zero zero zero, which means it's listening on all interfaces on point
twenty one.
So it's going to be listening on twenty one.
OK, and then we going to create a queue of five, then just display a message saying this is the number
your like ATP started on.
Twenty one is that's what it's going to say.
And then if anything fails here we are going to get this message.
So if this block fails, we will be getting this message.
So that's part one.
Then we are creating the jonquiere to the payload which we want to send and then here in the loop we
have.
It's always true.
So as long as there are payloads or sorry packets coming in from a client or clients connecting, we
want to use the socket and accept that connection.
And from that, take the address and create an object of type socket.
So this is a socket object, but this will have the details of the client so we can use it to connect
back to the client.
And that's why we are using it here.
So that then it's clear that the the the user here or let's say the owner of this FTP server, we can
say welcome to my FTP server, for example.
So this is going to be sent immediately to the client who is going to be connecting to our server.
The client will send something here.
So it's most probably is going to be a user name.
So we are going to respond back with that.
Your username is OK.
This is the status code for that.
Then the client will, since the user name is OK and send the password, then the server is going to
respond back that your password is also OK.
So these are all crafted.
So it appears to the client that they are actually talking with an actual FCP server while actually
they are not.
So then later on today we will receive or the FTP server.
This malicious server will receive the.
The payload from the yes, it will receive a new, let's say, command from the client and then what
we are going to do is send 220 as a response at the payload and then is current directory.
So most probably what the client is going to be sending is the print working directory.
Usually EFTPOS.
Once they log in, they will ask for the the working directory that they got in to.
So and that could be also, by the way, reconfigured one of the of applications.
But in this case, this is this is what's happening.
So now we have this going on.
Let's see what we need to do so we can start Python to exploit one.
OK, let's do that as well.
So now listening on part 21, let's go to our client and connect to our server.
So the server is IP address.
Is this in my case, just make sure you in your case, you know what the IP addresses, so I will need
to just connect to it.
So one nine two two one six eight one or nine.
Once I hit Connect, you can see we got this access violation.
Let me drink some coffee.
So we got this access violation, and it means that is something that happened.
Let's look at the the commands that we received, actually.
So let's look here a little bit and see what we have over here.
So if you go back, we can see this, which is the welcome to my FTP server, which the threat actors
were had in their code.
So in their code, if you remember here, we did welcome to my FTP server.
OK, after that, the client said the user, the user comment and then the password so that the user
anonymous we responded back, said yeah, that that username is OK.
Then the client sent the password, the pass commentary with the password itself.
And then we also responded.
Yes, that's also OK.
So they then sent print working directory so and we responded to the threat factor or the malicious
responded by 20 and all of this.
So we sent back the four hundred by four hundred bytes of eight.
As you can see that, by the way, the application didn't really crush it like that and it's still working,
I think we can still use it, but it didn't succeed in doing what we wanted it to do.
So let's check it in a debugger and look closer at what happened in this case.
So let's close go to our thieberger.
Immunity.
OK, now go open again, I've already done this, so if you go to the path, it will be installed on
C program files X 86 FCP client and then just go to special because I did this today to my students
and I also actually did it yesterday when my my recording failed.
So let me just, by the way, modify the appearance a little bit because I had to change this for my
class.
Let's do this.
I think it should be good.
Yeah, this should be fine.
Good.
The application is poor, so let's start the application and connect to our analysis of the piece over
again.
Silver is still running, right?
We are still running, accepting commands, so let's run again one six eight eight, one or nine and
third.
So crushed.
OK, pause.
It did pause or kind of Christ because the debugger now captured this.
Now, let's look at this.
What do we have here?
Do we have any control in the registers?
So in the registers, when we look at this, in the past we were focusing mostly on ESP.
So E.S.P now does not point to anywhere on my buffer like the buffer.
My A's are here, so it's deep down in the the stack.
So it's not directly now like you can see here.
So it's not really pointing directly to my eyes.
So I no longer can, let's say, uh, do a jump speed.
This is not going to work or E.S.P, but if we go down a little bit so it's not going to work.
Equipe also and currently we don't have let's see what we have an EVP.
So EBP is also not pointing to any of my bytes.
But if we look at this, I we got the string copied into IACI.
So if we follow them, we can see that the string was in IACI.
OK, so we control.
A registered, but it's not the ASPE.
Let's do some modification to our malicious server and run it again, see what's going to happen so
we don't have control over IP.
Let's see.
What's going to happen, let's modify this, so restart and start that again.
And while this is starting, I can drink coffee.
OK, start go back to our Threat Actors application, Mr. Silver, I'm going to stop again, I prefer
to do it this way.
So what we can do now, we can change.
Say, this is number two, it's up to you.
But this way you have an idea what are the changes that you did.
So if we had like one thousand, by the way, just let's add a number.
So increase the number C, will this override IP or not?
So let's do that.
Uh, no, not one we want to do who could run again, this is running, which is which is good.
Let's bring this little bit down here.
So go back and we have everything ready for 90 to 168, eight or nine and 30.
What happened here?
We all wrote what IP?
So it's interesting to know what the payload, which we sent now overwrote the IP.
So we are able to override override onto IP.
So we have control over IP.
But again, the idea why I wanted to use this example is there are many things we will learn out of
it.
It's not just about sending a payload, overwriting IP directly and then taking advantage of it with
in this case is not going to work.
But let's see why it's not going to work.
So IP is overwritten.
That's good.
At least for now.
We can see it's always overwritten with ease and we can see it now over 10 days, huh?
We have two things over 10 days.
But what we don't know yet is how many bites do I need to write in order to override the IP?
Right.
We need to know the offset.
So, again, last time I think or in the previous videos.
We use Mörner this time, let's use the MLO It's a pattern create, so let's restart again.
Like you can see, this is a long process, trial and error.
We keep doing that until we find at the end our working exploit.
So now let's we need to modify this.
So I'm going to create another file called number three.
OK.
But this time is going to be a little bit different, and we will let's do let's create our pattern
MSF pattern, create the length will be 1000, right.
That's what we used.
So that's just copy the one thousand bytes and put it into our payload.
So now our payload, instead of sending 1000 bytes of age, we are going to send all this junk, which
is a unique cycle.
If you remember, we talked about this last time.
It's a unique cycle of A's and in the buffer.
So let's get this started.
So let's run this again.
This is number three.
Yep.
So three run again.
Everything is working properly, fine, let's go here and connect to our religious Apicella.
Connected.
So we have over it and again, we have all of the other AVP like we saw, but with these characters,
which is are we I'm sure they are part of our payload we've overlooked.
And yes, I also with that and we have over in EBP and so the IP.
So let's copy that.
Not I'm going to write that down because I can't really copy and paste it into my transactor because
this is running on a remote environment.
So I'm going to I'm going to copy write them down six e.
For one four one three three six eight.
OK, I'm going to write this down to use it and calculate the offset again, restart again.
That's two that restart.
Yeah, we do want to restart and then start again.
Uh, OK, uh.
Ron.
While this is getting let's run it.
OK, so again, close this see, we can close it, by the way, because we had that line, which I added
into the code, this one which will allow us to close and run it again.
Now, let's create another one.
Call it number four.
And do a slight modification, but based on our calculation, so we need to do a massive pattern offset
this time, right.
And we need to do a query.
And the query is we want to ask for six E and then four to one six four, two, one, three, three
and then six E again.
So let's see.
Oh.
So the offset is four hundred bytes.
OK, so the offset is four hundred bytes.
Let's get this ready, which is number four, not running now until we update this.
So this time but we are going to do is we are going to delete this, put back our ace.
This is multiplied by 400.
Right.
Then we have IP because we need 400 days to reach IP.
So let's put the bees in there.
OK, we can do that or we can just say be multiplied by four.
And then after that, we need to put the pad because we sent one thousand bytes.
So let's just add that this time I'm going to use a cool method instead of like calculating things manually
every time.
If you have you have math problems, like probably myself, we can use this way of doing it.
So junk calculating the junk actually let me rename it now to offset.
Even so, this is going to be offset.
So I'm going to calculate the length of offset.
OK, then subtract again the length of the IP.
I know it's only just four bytes.
We could just say add those IP, but let's make our work clean.
So we have offset iPads, though, what we are going to send here is the payload, our payload will
be also offset.
Plus, VIP.
Plus iPad, so that's how our offset will look like, so we're going to subtract from that the length
of the offset, the length of the chip, the rest with what will, let's say, CES.
So let's do that.
Fill it with CES and now let's run number four again.
So if we do this wrong for twenty one and actually before I do that, let me do an update here.
I like to do this usually also debugging purposes.
The payload size is let's do this and then learn of payload.
Let's do that.
In this way we can keep continuously seeing the size of our payload.
So the size is one thousand, which is correct.
What we need.
And let's go back here and connect to our Google server.
So, again, one ninety two point sixty eight eight one or nine connect good.
So we did overwrite what?
Uh, i.p we managed to overwrite what IP and now let's look at this, because this is where this is
one of the reasons why I chose this example, by the way.
So we have.
Overrating IPN, if we look at the stack, we can see the start here and then if we go down, down,
down, more, more, more, we can see this is where our the bees, which got written into ippy.
And then we can see the seeds come immediately after that, which looks good, right.
Everything looks good here.
No.
What are we going to do next week and what are we going to do next?
Let's just look at this also.
We can see now that BP actually is pointing at.
So if do follow stock is pointing at the sea.
Why do following them we can see again is pointing at the seas.
Please keep this in mind.
Currently, BP is pointing at the sea path while its eye is pointing to the appart.
So if you remember, if we go back to our payload.
We had here 100 bites of then the iPad and the CS, so in this and this example, I draw this, by the
way.
Uh, I must paint, I'm not a good designer, but give it a try so we can see what's going on.
So we have this is our stock, OK?
Right.
And let's maybe do it over here somewhere.
So the zip it over here.
Yeah, and let's put just the name IP, so e i p just like that so we know what we are doing.
So this is the IP and then what happened is the A's or Forte's for a right for A's.
And then let's just add a filler, OK.
These are all A's also.
OK, these are all A's.
And then what happened here is we got the CS sees CS right CS and then we have the CS.
So this is how our stock actually currently is looking like.
OK, this is how currently our stock looks like we AIt's and IP in the seat, so we have our.
Yes, I actually pointing to the to the here at the beginning or actually the bottom, because the stack
is the other way around and we have the seas which are beyond i.p.
So it's pointing at the other part.
OK, so just keep that in mind because it's very important.
Why?
Because it means if I am going to want to put my payload in this area, then I need to use which one
I need to use EVP.
Right, because it's the payload is in the sea part.
If I want to put my payload in the 80s, then I will need to use the S Iwai because he has eyes pointing
to the eyes.
So this is really why I chose this example.
And you'll see we still haven't, uh.
Dig more into this, but you'll see why probably if I use EBP, it's not going to be a good decision
while if I use IACI sorry, it's going to be a good one.
Why?
I'm not going to tell.
Let's just get into that and see it by ourself, though.
Let's decide to go.
Because at the end, you are you you explore the ways you you will be able to exploit the application.
So let's decide to go the first way.
The first one use SBP.
So we are deciding to do EBP.
So what we need to search for is a jump or a call SBP Right.
That's what we need to search for.
So if I do find and that's to jump AVP.
So if we have one, so we do have one, but it has a no bite.
OK, so let's try to find maybe a call SBP.
Also by and this is in the same application, by the way, we are using the application itself.
I'm not going to use anything like we did in previous examples.
This time, I want to explain a different method.
So that's why I'm using the same example here.
So, again, let's do you can go with Carlip or Colly jump, but really not make a difference because
they both do the exact same thing.
Kind of.
So let's take this address, which is called EBP.
Let's put a break point on it and I'm going to just type it, write it down, I mean, on my paper here
so I can copy it to my six E and then eight two and then four zero.
OK, so let's do that.
So we are going to target our SBP by jumping to do a call to EBP.
OK, so we are going to like send our this address into IP, replace this with with this and try and
send it and get to this code, these this data over here, which are the CS.
Let's restart.
OK, yes.
And then start the application.
More coffee.
Uh, start.
And now let's, uh, yep, let's go to our right actor and modify the code, so let's do five.
So this is now five.
And then what we are going to do, the A's are going to stay the same, we are just going to modify
this part.
So this will be zero X.
And it will be 40 zero eight two zero six E, right, zero zero zero, right.
That's the number where we will be sending that.
OK, so now let's run this again.
But close line number five this time.
And we have also one thousand bites to everything the size of our payload is correct, let's get our
application and connect to our evil after piece over the two one six eight eight one nine and 13.
Look what happened.
So actually, what happened is we didn't jump to the we didn't jump.
To SBP, the call BP, we didn't jump there.
We didn't go that way because as you can see here, we have part of that address, by the way.
We can see that the six eight eight two, uh, four zero four, I mean, but it got stuffed with this
6F from somewhere.
We don't know that.
Got stuff from somewhere.
But let's look at the stack.
Let's go up the stack and looking down here.
So this is where our ace came in.
This is what our ace came in and all go to now.
Then look at here what happened.
So what happened is all of our data and our stack had got truncated.
Why?
Because of the NHLBI.
So the Knobi actually caused.
US to lose the seas, we don't know where the seas are anymore, we don't that's why we use a debugger.
We can wander around, take, uh, take, uh, explore what's available in the memory of this application,
what's inside its head.
And we can see there is no seat anymore.
We we don't we lost those seas.
They are probably somewhere, but we don't know or maybe they didn't even get to the memory.
We don't know.
We can't see them, at least in the stack.
We can't see them.
We might do some search.
But what happened is that no bite truncated the rest of the code.
OK, that no bite truncated the the rest of the code, let me just turn off my, uh, my phone, but
it's silent, so that means our call SBP will not be successful.
Why?
Because.
The BP or the jump means if I'm going to put my payload in the in the seaside or in the sea part of
the the my exploit, I'm going to lose it.
Why?
Because I don't know.
I no longer is going to be after the Nobakht.
Right is going to be after the NHLBI, and I know I don't control the area beyond the nobut I don't
control it.
I don't I can see where those seats are.
So we need to go back and check the other way around, which is using VCI.
OK, so we can do the SBP because this NHLBI truncated the code and EBP was pointing to the second part
of my payload.
So let's go back this time use a different method, which is to use either a jump, Yes I or Yes I.
Uh.
So let's start this again.
OK.
Start.
And let's go to our Michelle.
And just search for what on earth I want us to call IACI this time and we have this address.
So let's put a break point here.
Let me just type that down, which is zero zero four zero one two seven eight.
Now you'll say, hey, but this one also has an alibi.
How are you going to deal with that?
Now, the trick here is and this is why, again, we need a debugger and this is why exploitation,
each case should be taken differently or separately.
They I would say not all cases are exactly the same.
Every case has its ups and downs and it will interact with the the data we send differently.
So in this case, we remember that, yes, I was pointing to our stack, but it was pointing to a part
at the beginning, which we already control.
So what this means or what I'm trying to say here.
Is we could probably add these bites at the end of my payload, OK, at these bites at the end of my
payload.
And getting that stuffed into i.p, like just pushing it into i.p, OK, but without the second part
of the payload.
Again, what we are doing, what we are going to do here is to offset the number of bites here.
So we are going to send these bites, same thing.
But here, instead of sending all of the let's say, uh, let me just create a copy of this I will like.
Uh, modify this one, so what we are going to do is send, instead of all of i.p, we are just going
to send three bites of the bite.
We will not send it.
The application will add itself to truncate the string and then everything after this.
Actually, we will not send anything because it's not going to matter.
OK, so we're going to send Azz and then three bites here.
Three.
Let's let me.
You can delete this.
And just write down, uh, three bites of.
Oh, yes.
OK, three bites from the.
Yes, that's what we are going to say.
And again, what will happen is the system will automatically or the application will add that no bite
at the end because it will need to terminate the string.
So we have that here.
We have everything ready.
Let's get started.
So we'll go back to this now.
DOE number six, modify the code.
This is going to be number six.
And this time, what I'm going to do is IP, we are going to remove the NHLBI, but let's also modify
the whole code.
So this time we have Seventy-eight and then we have 12 and then we have 40.
We are not going to send the byte, OK?
In this case, let me just take this out and then I'm going to just send payload offset and IP.
We don't we no longer need actually the pad anymore.
We no longer need the pad.
So I'm going to, uh.
Yeah, I'm going to leave it this way.
OK, we no longer need because we have the four hundred and then we have this, which the system will
automatically actually kind of add.
You can think of it like this system or application.
Uh, application will be zero zero.
Which is the no bite.
OK, so let's start.
Let's check this out and see if that's true or if I'm just making this up.
So now let's go here.
This is number six.
From this time, the payload is four hundred and three, because four hundred is our offset and the
three is the three bytes of our, uh, jump our colleague IACI before I run it.
I do remember I put a breakpoint on.
So this is the one this is the one we are using, coleus I.
Right.
Let's do it.
This I'm going to delete this one.
Delete this one.
Keep the.
And you can just, like, hit the delete button on your keyboard.
It will delete those.
So just going to leave this breakpoint, which is actually as high as you can see this one.
And let's go back to wherever we were and now connect to our military server one on one sixty eight.
Eight, one or nine.
And then what happened here?
So look, what happened here is you can see we got to the IACI, which is great.
I if we follow it in the dump, it includes our payload, which is the ace.
And I know we have this construction here, but it's not really going to matter and we will see that.
And then after that, we have the whole EHS, we can see that.
And then here in the stack until you can see it even here.
So this is where the A's end and then we can see the address, which is 78, 140, and then the no by
got added automatically, same thing here.
If you go down in the stock, go down, down, down, down, down.
And then you can see here the forty one, forty one.
And then we have the address, which is zero zero zero forty twelve seventy eight which got pushed into
IP.
And that's why now we control IP with this partial address that we sent.
If we do F7, we will jump to this area where we control.
And now these are all the the A's that we sent.
So everything is working exactly properly as we want.
Right.
But if we added if we you can see now why we went with the S3 case, we didn't go with the case because
yes, I was pointing at some area over here.
And once we added that address at the end here, it truncated the code behind the address, behind the
IP.
We go back to our design because when we added the node by the truncated, all of that, so I no longer
control it, I don't know what it is.
So that's why we had to use the S.
S R instead of SBP.
So that's why.
That is first no jump.
We have no bite and why the is important in exploitation, trial and error, I know that it takes time.
I also know that.
But at the end, it's fun once you get everything sorted out and you understand what what you are doing.
So let's restart this.
Again and go modified our goal, modify our code a little bit so all should be running right.
Good.
Go back here and let's stop.
This time I'm going to do what am I going to do is we can let's change this with, uh, like not so
I'm going to modify the code.
And the payload may be so it's time to probably, uh, payload.
Still.
We can do let's put this over here and now we need the pat.
So let's do.
We need to do some calculations and create our payload.
So let's go to a payload.
Let's use this.
How did I get these?
Don't ask me now, you know, later.
But for now, let's just generate this payload and use it for our, uh, for our testing.
So let's bring this little bit up.
The.
So let me copy all of this and then we'll modify them inside our code.
So go here, we are going to modify this code with this, I'm going to delete.
Uh, this line, I don't need it.
Right, we don't need that.
This is going to be coming out and we don't need any of this.
We just use this way.
If not, I can remember, uh.
Remember, what is the command that I used?
OK, so in this case, this is our payload.
You can see the sizes two and 220.
Do we have enough space?
In this area to push our Palladin.
Now, if you are in a class with me, I will be asking you that question, but since this is just a
recording, the answer is what?
Let me drink some coffee.
The answer is yes, we do have that why?
Because this is 100 bites, so there's 400, right.
And we only have a period of 200 bites, so everything looks good.
So let's go back, modify our payload.
So we have this.
So what I'm going to do now, I'm going to add some notes at the beginning.
I'm going to do 16 and I'm on purpose, going to do 16.
You'll also see why.
But let's change this X 90 for the note we have we need now, what do we need now to do?
We need to put the pad.
Right, because our buffer here, if we go back our buffer, it's not 16 bytes, three chip, it's four
hundred bytes.
So I need to modify this.
So we have the 16 bytes.
Now let's get the pay the pad.
So let's bring it over here.
But this time the pad is actually 400, right.
And then what I'm going to subtract from it is not.
And also the buffer.
So I'm going to subtract from that the buffer and I'm going to replace this with also 90, so the buffer
will come in here, but I'm just going to put a placeholder.
So what will happen is we'll put knob's buffer pad and then Yipee!
So if we go back here just to understand, we'll put the buffer, the knobs.
We write this down, but let's use a different color.
Uh, black, for example.
So we we will have here the knobs we will have here then the buffer, which is a payload or the Chalco.
Shall, uh, yeah, let's just put it anyway, you know what I mean?
And then we'll have the pad, right.
So there's a placard at Numpad until we reach this location.
Right.
This is what we are doing right now.
This is exactly what we are doing.
So not for bad.
Bad, bad until we see.
All good.
Let's.
Make sure everything is working so the knobs, the buffer just put as a placeholder here so you can
understand, you can visualize it in your head.
One hundred.
Remove 16 knives from it, remove the buffer sides and then multiply the rest by 90, so we'll fill
the rest of the buffer or the rest of the payload with the rest of the 400 bites with nuts, OK, and
then our ship.
So what do we need to do here is modify our payload.
So now it's not.
And then both right and then Pat and then at the end.
So this is how because like I wrote them, not both, Pat, not sparked by the EIB.
So let's now run this code, which is No.7.
Good.
Everything is working.
So let's do that same thing for all three could go back one hour, one two one six eight eight one nine.
And we called SSI, so we stopped on our break point.
We are now ATSI.
Right.
And you can see, by the way, here in the buffer, these are where our 16 knobs are.
These are where our 16 jobs are.
And then this is where we have the shell codes.
And then after the shell code comes our, uh, more more buffer of knob's more not not not not snob's.
And then you can see this is where we had our, uh, call IACI, which got pushed into IP.
OK, now if we take that call.
So now we are, uh.
What did I do?
Darren, uh, did I step into it or did I run it actually?
No, I don't know what I did exactly.
Let me just repeat this again.
Sorry.
I think I hit F nine, but even if nine, it should work means probably have a bad character.
Let me check again here.
Excuse me.
So we have these.
Uh.
Should we just do it like this?
Uh, I know it's not going to change the bite itself, but I just cannot do it because I usually do
it this way.
And.
It's weird why this didn't work.
We will check it out.
No problem.
Oh, now, if I get rid of all of this.
OK, let's put the brackets I like to it this way.
Uh, remove these.
So this is our buffer.
And this should really work.
Why is this not working?
Let's check it out.
So we have no choice then the for.
Then this, yeah, everything should be fine, let's run it again.
And let's do this, uh, for three.
Come back here.
Sometimes we won't be able to run it and the debugger so we can test it.
Like, so coleus eyes, correct, if we do, oh, great, yeah, I think I pressed something by mistake
then.
So we landed on to our our, uh, are is pointing to.
OK, you can see his eyes pointing to this area if you you've on down, which is where our Chalco this
and now we run this, we can continue to just like skim through the payload.
Probably this is going to be affecting.
So that's why I will test running it and we will see how to find those bad characters and avoid them.
I'll have a session just for that.
For now, I wanted to introduce those main concepts which I listed over here.
So, uh, let's just run F nine again, see if anything's going to happen.
Good.
I don't know what I press the last time, so everything is working fine.
Uh, all good.
Let's, uh, probably replace our, uh, even our, uh, payload with a reverse shell just to make sure
we are good.
And that's probably what the fancy things about people like to see, which is a reverse shell or a shell
on your victim's system.
So let's do that.
Good.
And now.
So this was working great.
Let's do, uh, create a shell code of.
Let's see, do I have it over here or.
No, this is my handler, let's keep the handler ready.
I'm going to.
Prepare this and I'm going to create a payload, so these are, by the way, the aski.
You can see what the zero zero what, a zero nine zero eight that I removed.
But we'll get back to those later here.
I will use.
Windows Shandra WCP localhost 192 one six eight eight nine, local port four four three exit function
architecture platform windows encoders Shikata Garni minus F the C minus B the.
Let's go.
So let's get this going and now I'm going to rename this hour to a copy again, I prefer to do it this
way.
It's all up to your preference.
This is not nice, but no problem.
Uh, good.
So we have this let's copy it into our payload.
So from here, all the way to the end and.
Well, we can have the whole.
Think.
And let's now.
To fly.
This.
So we have.
Let's remove this.
We don't need it, let's move.
This as well.
OK.
But there is one thing here that we need to pay attention to.
So look at the payload size, by the way, three, eight, nine.
And three, eight, nine.
And if we add to that, like the, uh, the 16 bytes of no, uh, no operations.
What this means is we no longer have space for our buffer, so you'll need to modify this, OK?
That's why I did this on purpose last time.
You need to modify this to 10.
And as you can see here, you don't need to modify any of your code.
The buffer is going to stay here.
Just we needed to modify.
And this is just one example of one scenario.
Why sometimes I need to, like, lower the number of buffer, but not by sorry, the operations, et
cetera.
But you don't need to modify any of this.
Everything is going to stay the same.
So this time what we will be doing is three, eight, nine.
So we'll add first number ten and then add three, eight, nine to that, which means we will have three
hundred and ninety nine bytes.
So we are going to.
And at the end of that, we'll have just one bite left, so we are going to add the operation and then
after that we have our, uh, jump or call to IACI.
OK, so let's get this going and let's see.
Everything is good.
And let's go back here.
The payload the listener is working.
So now we are looking at number nine because we renamed it by mistake for all three.
Everything is good.
Let's now, uh, run the application.
And actually, that's on it from outside, that's from it from outside, just.
We tested it inside the debugger, let's test it from here.
Now.
Of top clients and now.
One six eight eight one nine eight until something is going on behind the scene and we can see that
we have a concrete, we have access to our, uh, Windows 10 system, uh, we managed to exploit this,
uh, FTP client that we we did a remote exploitation against, uh, and, uh, a client application.
OK, so that's it for this video.
I hope you understood all the concepts that we went over.
There are many of them.
This is really not just about, let's say, a basic buffer overflow or any of that.
It's it's more about the method of exploitation that we use that you you don't you shouldn't depend
always on a jump PSP or E.S.P.
Those might not work.
You need to find other alternatives.
And the more you work with this, you'll get better.
And it's already about a lot of assembly stuff.
We will add more different techniques while we go through the scores, the no bite.
We saw how we managed to overcome that.
And the scenario, by the way.
This doesn't mean you will always be able to do this.
We were lucky in this scenario.
I would say that we had another register pointing to some of our payload.
So we managed to kind of excuse me, craft the payload, which we are sending in a way to avoid the
Nobakht.
And then we also saw why, as DeBacker was really important, because if we went the way the AP was
pointing to the second part of my buffer, which is this one, and we saw once we add the nailbiter,
it got truncated and I no longer know where it is.
So we had to go back and go with the S3 way because it's pointing to another area that I can still control
and have access to and I can still see in my in my stack in my debugger.
So that's it for this video.
I hope it was useful to you, if you have any comments, questions, please let me know.
See you in another video.
Thank you and bye bye.