All right.
The video you have been waiting for.
This is the last and final video in the course and now we're going to gain shell.
So here's what's gonna happen.
We're gonna use a tool called MSF phenom and we're gonna use that to generate show code.
So I'm going to go ahead and copy and paste the command over and then we'll talk about what this command
does so we're running MSF venom it's brought to you by medics flight and we're gonna set a switch a
P for payload so we're gonna set the payload for Windows because we're attacking the Windows machine
and we're gonna do a shell reverse DCP.
So we didn't declare X 64 here so we're gonna assume X 86 but we'll declare that later just in case.
So when we have a reverse shell like this what we're doing is we're having the victim connect back to
us.
So we need to provide our information.
So by our information I mean the Cally machine IP address which is gonna be our l host right here and
we're gonna also have a port we're gonna be listening on.
So that's going to be our l port our listening port.
And we're gonna declare that as four four four four.
I'm setting an exit func equal to thread all that does is make our exploit a little bit more stable.
We have a dash f for file type.
We're gonna export this in a c a dash a for architecture that's X 86 and then a dash B for bad characters.
Here's where finding the bad characters becomes important.
So we didn't have any besides the normal bite but it's always good to teach it and explain why it would
be important later.
So if we had any bad characters this is where we would put them in.
So let's go ahead and just hit enter here and we'll take just a second to generate this show code and
once it does we're going to copy and paste it into R Python script that we've been using so we're gonna
grab this information here.
We don't need the semicolon and it's always good to take note of the payload size so it's not going
to matter too much for us but if you do go and exploit development payload size can be everything it
could be that you're working with a very limited space say you only have two hundred bytes left in a
payload size of three hundred and fifty one is just not going to work because you're going to truncated
at two hundred.
So always good to know the payload size especially as you dive deeper into other projects if you do
go farther in to exploit development.
So let's go ahead now and open up our python script.
We've been using.
So I'm still on to that pie and I'm going to declare a new variable here up at the top.
We're just going to call this overflow set it equal to this and add a parentheses hit enter and then
add a closing parentheses like that so we're also going to do is really come down here and we're going
to add in overflow.
And then we're going to talk about this.
So what we've got here is we've got the shell code right.
So what's going to happen is we're going to submit the shell code in this variable shell code here.
We're gonna say OK.
Two thousand three bytes.
That gets us to the IP when we get to the IP.
We're gonna hit this pointer address right.
This pointer address is just the jump address.
So we're gonna jump to this set of instructions that we provide the set of instructions we're providing.
Is this overflow here.
So what we need to do before we submit this overflow is actually insert something else.
And those are called knobs.
So it's gonna look something like this.
So it's called X 90 like this and we're just going to add 32 in and so knobs are padding essentially
they stand for no operation.
If you've ever heard of something called a knob sled that's kind of what you're referring to.
So when we have something like this what we're doing is we're just adding a little bit of pad space
in between this jump command in this overflow shell code right.
So in an instance if we didn't have this it's possible that our overflow wouldn't actually work we wouldn't
get a command execution on the computer because something interfered here.
So we just like to add a little bit of padding in between these two and that makes it a little bit more
safe.
Again if you have a limited space say we go back to the two hundred byte example you might really need
a little bit of padding like eight bytes sixteen bytes you have to play around that and figure it out.
So a lot of exploit development is just messing around with the exploit until something works.
So we're going to go ahead and just save this.
Now
OK.
And then on another tab over here what we're gonna do is I'm going to set up net cat to listen.
So it's gonna be in the LP like this and then I'm going to put the port to all fours.
That's what we declared in our shell code generation OK.
Lastly what we need do is we need to run Volm server as administrator.
We don't have to have that immunity this time.
All we have to do is just make sure it's running and then we're going to fire off this guy.
So we're going to say to that pie hit enter.
Check this over here and look at that we've got a shell.
So now we are on this computer.
We could say who am I.
OK.
It's Heath Heath is me.
That's the administrator.
Perfect.
We are good to go.
So we have gone from fuzzing a program spiking a program not knowing anything about the program finding
the vulnerable try and command.
We use that to fuzz it.
We found and controlled the E IP.
We found some bad characters we found the right module generated some shell code and now here we are
we are rude.
So hopefully this has been easy for you.
My recommendation is to go through and make notes again try to understand the theory behind what's happening
and also try to understand everything that's going on.
This is as basic and simple as overflow can get of course or memory protections is not generally this
easy.
This is just meant to teach people how buffer overflows work.