OK.
Now on to finding the right module.
So when we talk about finding the right module what we're saying is we're looking for a DSL or something
similar inside of a program that has no memory protections meaning no DEP no cell are no safe SDH etc..
Now there's a tool out there called mono modules that we can use with immunity debugger to achieve this.
So if you go out to Google and you search model modules you should be able to find a get hub page for
it.
You're going to need to download this moment out py file and put it in this specific folder here.
So the specific folder Is this P.C. Program Files 686 immunity Inc.
Immunity debugger pi commands and you're going to paste it right into here.
So go ahead and do that.
And then once you're ready let's go back to immunity debugger and now I already have the program attached
to phone servers here.
And what we're gonna do is we're going to actually type in this little bar down here.
So what you can type in is exclamation.
Mono modules and hit enter so that'll pop this guy up here.
And if you look what we can see is these protection settings right here look we've got false false false
false false across the board for some of these protection settings and that's what is ideal for us right.
We've got troops on some of these other things.
But really what we're looking for is we're looking for something attached to vote and server itself
which you could see this phone server right here and we're looking for all forces.
So a prime candidate immediately right away is this ISIS funk that deal.
So we're going to go ahead and just keep that in the back of our minds because we actually need to do
one other thing now if we know this by memory we can go ahead and type it out right here.
But I want to show you the process for actually finding what we're about to do.
We're about to do is find the app code equivalent of a jump.
So let's go ahead and look at how to do that.
To do that we're going to go into Cally Linux and we're going to locate something called Nassim shell.
So it was type locate Nassim shell and go ahead and just copy this ruby right here and then paste it
in like this and hit enter so when we say we're looking for the app code equivalent we're trying to
convert assembly language into hex code.
So what I'm doing is I'm going to type in this assembly language just JM PSP.
This is a jump command.
So what we're gonna do is we're going to use this as a pointer.
So the pointer is going to jump to our malicious shell code and that'll make more sense here in just
a little bit.
So the hex code equivalent of Jan PSP is F F E for OK.
So now what we're going to do is we're gonna take this information this F F E four and we're to go back
into immunity and we're gonna type this instead.
So let's delete the modules part.
We're gonna keep Mona and we're gonna say Mona find and we'll do a dash s and we're gonna say x f f
slash X E for and then we're gonna say m for module and we're gonna use this ESFs funk dot DL L so that
makes sense we've got our code equivalent here the F F E for and then we've got the module of ISIS funk
that DL L which is right here again we chose this because it goes with the Volt server program and it
has no memory protections.
So this is a good candidate for what we want to do.
So let's go ahead and just hit enter on this guy.
OK.
And I think I forgot to slash here.
Let's check this out.
OK.
So that is better.
So we're looking for it here is we're looking for these return addresses.
So if you look at this 6 2 5 0 1 1 a f that is going to be a return address.
So let's go ahead and just write this one down.
We're going to go right down the list and find what works.
So I would like to start at the top.
And you can see here that it found this ISIS Funky DL L and it's got all the memory protections here
listed as false.
So now what with this information what we're going to do is we're going to go into Cally
we're going gonna just type exit here on this Nassim shell and we need to edit our python script.
So whatever python script you're apt I'm still on to that pie.
Go ahead and open that guy up let's delete out the bad characters because we did already find those
and now we're gonna do is we're gonna delete out this B for so let's write in real quick what our return
address was.
Remember it was 6 2 5 0 1 1 A F.
So now instead of having four B's in place of the IP we're gonna put this pointer there.
So we're gonna have the IP be a junk code and then the junk code is gonna go to malicious code.
So we're going to enter that in here.
Now we're gonna enter in a little special.
So what we're gonna do is we're actually going to enter it and like this we're gonna say slash x f slash
x eleven slash X Five Zero slash x six to if you notice this is actually in reverse.
So you see a f 1 1 5 0 6 2.
We're doing this reverse for a special reason.
So when we're talking with X 86 architecture we're doing something called Little Indian format so x
86 architecture actually stores the low order bite at the lowest address in the high order by at the
highest address.
So we actually have to put this in reverse order so what this should do now is this should throw the
same error before but it's going to hit a jump point.
So we can do something special in immunity to actually catch this.
Let's go ahead and hit save on this script and let's open up immunity again so let's go ahead and minimize
this and let's maximize this guy again.
OK so we're gonna do something special here.
So first what we're gonna do is we're going to need to click on this little arrow here.
It's kind of bluish black and we're going to enter in this expression of follow 6 2 5 0 1 1.
A F.
So remember that's going to be our jump code.
So if we hit OK we should find this F F E for this GMP GSP right.
And this is perfect this is exactly what we want right here.
So we're gonna do is we're going to hit F two.
So F two we'll turn it blue and what we have just done is we've set a breakpoint.
So we have the breakpoint running what this means is we're gonna overflow the buffer.
But if we hit this specific spot this jump code it's not going to jump to further instruction.
It's actually going to break the program and pause right here for further instruction from us and that's
all we want.
We don't have anywhere to jump to right now.
So it's not important.
We just need to know that we are hitting this.
We're overwriting the IP in the exact spot we need to.
And then we're gonna be able to jump forward.
So let's go ahead play here and then we're we're gonna do is going to go back into Cally we're going
to execute our script so let's go ahead and do that.
We'll say to that pi here run that out.
You know what I did apologize here.
I never deleted the original code here.
So if you caught that.
Good job OK.
Let's go ahead and try that now
case we ran it and what happened.
You see breakpoint at ESFs funk that 6 2 5 0 1 when a f happened the program is now paused.
We have hit our breakpoint.
That means we control this e IP look at this 6 2 5 0 1 1 F we control the IP.
Now all we have to do is generate some shell code point directly to that show code and we are home free
with root so going to go ahead and do that in the next video now catch you over there.