This is where we left off in the previous video.
Now let's find out the offset at which RBD being ordered to do this.
We are going to use some features available within Jeff since we came to know that there is a crash
with 300 characters to proceed further with our analysis, let's load the executable once again using
Jollibee.
Jeremy Bascule daughter slash vulnerable
inventor, and we should see the screen where the binary is loaded.
Now let's run the command pattern space, create three hundred.
So we are doing this within just a minute.
This is going to produce a pattern of length.
Three hundred, we can use this pattern instead of using 300 A's.
So we will be able to identify which four characters are actually overriding the HBP register.
Right.
So let's hit Enter the River.
Now, I'm just going to copy this.
And let's open up a new terminal.
And let's copy the file, exploit one dark pill and let's save it as exploit 2:00 p.m. and now let's
open up, explain to our people and let's replace these 300 is with the pattern that we have obtained
from Jeff.
All right, I have pasted it here.
Let's close the double quotes and there you go.
Now, let me just save the file.
Let's quickly check if it is working or not.
Seems like it is working fine.
So let's not exploit to people and let save the output into a file card.
Payload two.
Now let's go back to the Judy Wetangula and let us type run that payload to let us render.
Look at that, there is a segmentation fault once again, there doesn't seem to be any pattern overwriting
the AP register.
However, once again, the IVP appears to have been overwritten with eight bytes from our payload.
If you look at this, this is what our baby register is currently holding.
So let's quickly confirm that this is from our pattern by using pattern such command from Jeff.
Let's copy this.
And let's clear the screen and let's use pattern space search and let's give this input and let's look
at that.
It says The pattern is found after two hundred and fifty six bytes.
So we found the offset to our BP, which is 256 minus.
Even though we are unable to override Arizpe, we can calculate the possible offset to our IP based
on the offset we have gotten to our BP.
If our payload is properly reaching Oraibi, it has to be overwritten immediately after our BP.
But for some reason this Oraibi is not being overwritten.
We will understand why that is in a moment.
But for now, let's try to add eight more bytes.
So this offset to our BP and let's see what happens.
So I'm just quoting here and.
Let's copy this exploit to here and let's save it as exploit tilapia.
Let's open up this file, exploit to Dark Pier and let's quickly delete this line and let's create the
variable once again.
Let's give it two hundred and fifty six is.
And let's spend a bucks here.
OK, so this should be overriding the odd beep.
So if our analogy is correct, we should see eight BS in our BP register.
Now let's spend.
Eight sees to this, so essentially what we are trying to do is we are giving two hundred and fifty
six is to reach our BP and then we are overriding our BP with a base.
And according to our earlier technology, we should be able to override our IP register immediately
after overriding our BP register.
So we are giving eight more bites, hoping that we will see these eight CS in our IP register.
So let's just add a comment here.
This is for our BP and this is for our IP.
OK, so let's save the file and let's produce the payload.
OK, so we're done.
Now let's run the Binley once again using Jilib and let's run it using our payload.
Let's hit enter once again.
The application crashed and there is a segmentation fault, but the segmentation fault doesn't seem
to be showing us anything useful.
So let's type in four registers.
We can also use the registers shown by Jeff.
But just to keep it simple and typing in, for instance.
And if you notice, the odd BP Register has a piece, this is expected, but our IP register still holds
the same old value that we have been seeing from the beginning.
OK, now I don't want to keep the suspense on anymore.
I'm going to explain why this RHP register is not containing the values from our buffer.
Now, let's quickly go back to the slides.
And in 64 bit architecture, it is worth knowing about the usable address space, the usable address
spaces from this to this.
These are canonical addresses.
Now, attempting to use noncanonical addresses like this will cause a segmentation fault.
So so far we have been noticing the segmentation fault due to the fact that we were overriding our IP
register with a noncanonical address instead of an address from a valid range, which is this.
Now, this simply means we cannot override all 64 bits of the RHP register.
We should override the lower 48, but only to avoid this segmentation fault.
Now, let me switch to the washing machine and let's also see the memory maps of this process
time via map.
And if you see the output, these are the memory maps.
If you closely observe all the entries should be only in canonical address range.
If you notice here, the first two bytes are not similarly here.
The first two are notes similar to here and also the best ideas of Lipsey.
The first two bytes are nuts.
So essentially, if you look at this, all the userspace addresses are only making use of the 48 bits,
but not the 64 bits except for the last line.
This is true for all the other addresses.
So all the lines, excluding the last one, describing the memory regions in userspace and all of them
are having annuls on the first two bytes.
The last line, which is this is called, refers to a page and kernel space, and that's the reason
why it is making use of the higher two bytes as well.
But otherwise, if it is a userspace address, it will only be using the addresses in canonical address
range.
Right.
So the key takeaway here is that all the userspace addresses are in canonical address.
Reg, keeping this in mind, let's override RHP register with six bytes instead of aid bytes.
So let's go back to our previous terminal.
And let's copy this, exploit our and let's save it as exploit for our let's open it up using them
and let's replace these eight seas with sixes.
All right, so let's save the file and let's produce the payload using Explorer at 4:00 p.m. and let's
save it as payload for once again.
Let's start the binary and run it using this new payload.
So I'm just using the previously used command to load the binary.
And let's use a run space card payload for let's hit enter.
And there you go.
We managed to successfully override the RHP registered this time the segmentation fault clearly shows
that our address with six seats is in Oraibi, which has caused the crash.
Now, let's quickly confirm it by checking the registers.
Here it is.
As you can see, the AP register is now holding six seats and the BP register is holding the Forbess
as expected.
Now, let's also observe the stack exhibit and let's say we want to print 50 entries and we want to
print the hex values in 64 bit formats that I'm using.
And let's use Arizpe minus probably 280, because 256 is what is required to reach our BP.
So I'm just using 280 to see some more entries even before the buffer.
So I'm just hitting enter the go.
If you look at the output, there are a bunch of errors.
And then we placed Faldo's and after that we have six CS.
So this is our RHP Everything that we have placed inside the buffer is currently available on the stack
and that's the good news.
Now, the key takeaway from this observation is that we managed to identify how much junk is required
to be able to control the AP register.
And we also noticed that most of the characters that we are placing in the buffer are available on the
stack.
Right.
So this is a good news.
We are going to make use of all these details to write our final exploit, but that's all for this video.
In the next video, we are going to discuss how we can use this buffer that's being placed on the tag
for our own benefit.