This is where we left off in the previous video.
Now let's discuss how we can make use of this space we have on the stack that is controllable by us.
Let's also discuss how we can make use of this control on the AP register.
A simple idea here is that we will place some Chalco in the beginning of the buffer and then we will
force the IP register to execute the shell code that replaced.
Now the question is, what is Schenkkan?
Chalco is a sequence of instructions that the machine can execute directly.
We don't have to worry about compiling the Shell code because Schenkel is something that can be understood
and executed by the CPU directly.
So in the space that we have on the stack, we can place some code because it can be directly executed
by the CPU.
That's the idea.
But how do we get the shell code?
There are multiple ways to get shell code.
We can use online resources.
We can use a tool called MSF venom, which comes preinstalled with clinics.
We can also write our own channel code in a later section.
We are going to learn how to write our own channel code.
But let's first finish this exploit by using some shell code that's taken from the Internet.
There are multiple resources available online where Shell Code is publicly available.
Shell star dot org and exploit DBE dot com are few places where you can get shell code.
We will have to be extremely careful when downloading Shell code from publicly available resources because
the shell code that you're downloading can have malicious functionality and you may execute it on your
machine.
It can cause damage if it is built by someone with malicious intent.
This is where I suggest you to write your own shall code for the exploit that you are writing.
But just for the sake of completing this exploit, let's take some shall code that's available online.
We are going to take shall code from Standard Arc for this exercise.
This is the same court that we are going to use for this exercise.
This is basically going to give us a big message, shall, when executed, this court is going to execute
Behn message using Xigris.
So let's take a copy of this shall code.
And let's place it in our notepad.
Now let's go back to our washing machine.
Let's also take a copy of this stack.
And let's play straight here.
Let's go back to the virtual machine and let's quit jalebi
now let's copy the latest exploit that we have, which is exploited for Dogpile and let's say it has
exploited five dogpile now exploited five.
Dogpile is what we are going to work with.
So let's open it up using them now.
Let's copy the shall code that we have gotten.
And let's create a new variable called Shall Code.
And let's face it here now, the shell core taken from Shell Standard org is placed in our exploit.
Now, where do we place this shell in our buffer?
Let's examine the stack to understand this.
This is the current situation of our STAC, we have some junk filled in until we reach our IRAP and
after reaching IRAP, we are replacing this register with six caes.
Now we need to replace these six seats in a way that that execution will be redirected under Chalco.
So what we are going to do is instead of the junk this time, we are going to place the code in the
beginning of a buffer.
And obviously the code is not enough to fill in the complete buffer until we override the return address.
So the remaining buffer will be filled with some padding.
And when we want to override the return address, we are going to override it with some address that
is going to point to the beginning of our shell code.
So what happens is when the execution lands on the return address, it will redirect the execution to
the shell core and the shell code will eventually get executed while this is going to work to give some
room for error.
Let us also place some nevzlin just before the shell code that's going to look like this knob stands
for no operation and it basically does nothing but just passing the execution to the next instruction.
The reason we are going to use this nevzlin here is when we override this RFP register and when we pass
the execution to this nozzle, it basically does nothing but slighting the execution towards the shell
code.
And at some point of time, the execution will land on the shell code and the shell code gets executed.
One benefit with this is if you are trying to redirect the execution to the shell code, you have to
be accurate and your interdiction should exactly lead to the beginning of the shell code.
In case of an obsolete.
You don't have to be exactly at the beginning of the nevzlin.
You can land anywhere in between the non-slip.
So that's the advantage.
Now let's go ahead and find out an address that is going to point to the beginning of a buffer.
Here is the stack that we have copied earlier, if you notice.
This is where the buffer is beginning and as we have planned, we are going to fill in some of these
bytes with some nevzlin.
So this address is a good candidate for us.
So let's copy this address.
And let's start here at RHP.
And we will also have to fill in some knopf's in the beginning, as I mentioned, this is going to be
the beginning of the buffer and I'm going to choose platinum's.
So slash X 90 is what we can use to represent ANOP.
So we need 30 of these.
And if you notice, we have not misled.
And Shell called ready.
And still we have two hundred and fifty six is in the junk.
We don't need two hundred and fifty six is now because we are replacing some of this junk with an obsolete
and shell cord.
So let's adjust this length.
Two hundred and fifty six minus.
Length of knob's minus length of shell cord.
All right, we have fixed the total number of errors that we want in the buffer followed by this, we
have eight bees which are going to overwrite and the R, B, B register.
And finally, we will have to change these six C's with this address.
So let's remove these six C's here.
And let's write down this address in reverse order, because it has to be in little Indian format,
slash six one eight, slash X Diddy, slash x f f f f f f, slash X, seven F.
So that should fix the final exploit.
Now all we have to do is we will have to print the knobs and we will have to bend the skin code to it.
Finally, we will have to open the junk.
So we are first printing the obsolete followed by the shell code and then we have junk which will fill
the remaining buffer until we reach our BP eight base are used to override our BP.
And finally our reps filled with the address that is pointing to our non-slip.
So let's save the file.
And let's produce the payload using this exploit 5:00 p.m. and let's save it as payload five.
We can use a hex editor to verify if Panel five has everything we are expecting, so let's type the
payload five hit enter.
Look at that.
Our payload is actually beginning with some knob slid.
After that, we have Chalco and the remaining junk is filled with some years after that, we have eight
bays followed by the address that we have specified.
So this is going to override the return address.
Looks good.
Let's open up the vulnerable program using GDP once again.
Now, let's run the vulnerable program using the payload that we have just produced.
There you go.
Let's hit enter and look at that, the next flight word and we have got a shell.
Now, the next immediate step is to verify this exploit outside Jilib, because that's our end goal.
We are not going to execute or exploit using Gleib.
So let's quickly check if this exploit is also going to work outside Jilib.
So I'm quitting GDP here.
And let's try that level cat.
Payload five.
Let's look at that, there seems to be a bus error and code dumped, usually buzzers occur when your
processor cannot even attempt the memory access requested.
Right.
So let's quickly go through the code dump and see if it is something that we can fix.
Jeremy Dash code and let's open up the code file.
Look at that.
There seem to be some issue here with this address.
Let's examine the stack and see what happened.
If you notice, this is the address which has caused this Sigma's error.
However, our not sledded is actually beginning at a different address outside Jilib.
This is because addresses outside Jilib slightly differ from what you'll see within Greevey.
So we will have to fix this.
Now, we are going to copy this address, which is ending with the 88, and we are going to give this
in our next flight.
So let's quit from Julie Bishop.
And let's Koppio exploit, exploit five p.m. and let's save it as exploit Basche final dot pill, hopefully.
And let's replace this 18 with 88.
That's the address that we have noticed outside GDB.
Now let's save this file.
And let us type exploit Basche final thought here and let's save it as payload dash final.
Now let's run the vulnerable program and let's pass this as inpart.
Let's remember, they got the exploit, worked outside GDP and we have gotten benefits, so great now
we can run whatever the commands that we want, we can just type A. And we can basically run any command
in the context of the target program that we have exploited.
Right.
So let's exit from the shell before we move on to the next topic.
I'm going to make a small change to our final exploit before we move on to the next topic.
I'm going to make a small change or exploit.
I'm first going to open up the exploit exploit final R.P.M. and.
And let's use a function called PAC to automatically convert these endlessness into little alien format
for us.
So let's just copy this address.
And let's pass it to the back function from Paul and let's face it here, and let's change this 18 to
88.
And let's pass the first argument as uppercase.
Q We will have to use Q for longer addresses such as 64 bit addresses and let's save the file and let's
quickly remove payload dash final.
And once again, let's produce payload final to verified exploit.
I'm running may explode with a modified payload and let senator.
There you go, the exploit still worked.
All right, I hope you have enjoyed this video.
Congratulations on building your first stack based buffer overflow exploit.