All right, let's ride or jump eggs exploit.
We are going to do a few things here.
First, we need to find out the jump oryx instruction within the target binary.
After doing that, we are going to use that address to override RHP.
We have everything that we need in the current military already, and there is one additional tool that
we are going to use in this exercise, that is Rockfeller robbery's already installed in this area.
As you can see, it loads this operation and we can use this robot terminal to search for gadgets or
instructions that we want.
Now, Robert is already started.
Now let's load the file vulnerable, which is available in the current directory.
And if you see this, it has loaded gadgets from us, from this binary.
Now we can search for those gadgets using the instructions of our choice.
We are going to use this tool rather extensively when we are going to write rock change.
But for now, we are going to search only for one instruction that is jump out.
OK, now let's search for the instructions that we want.
I'm typing search and I'm specifying the depth, which is one.
And let's type jump at X.
This is the instruction that we need.
So I'm just hitting enter.
If you observe this output, it says the target binary has jump IREX at this offset.
That's what it means and that's how we need to read it.
All right.
We have got the address of Jump Artex gadget in the target binary.
And this value can be directly used, you know, exploit.
Remember, we found the gadget within the same battery.
So we do not need to add the best address to this offset.
We found if we find the gadgets in libraries like Lipsey, we will have to add the best address.
When we use those gadgets in the exploit, we will use Lipsy for gadget such extensively.
And you will understand what I mean by this when we learn a return oriented programming.
So for now, let's go back and update our exploit using this value and creating this Raposo and and
just quickly going to copy this.
And let's open or exploit.
And let's replace this value that we have used to override earlier with the value that we have just
gotten from Iraq.
There it is.
So we now have RHP filled in with a jump IREX address.
If everything goes as planned, this Oribe should execute the instruction which jumps to ADEX.
What it means is it should execute jump attacks and we should jump to the ATEX address, which is basically
pointing to the nevzlin and thus we should execute the obsoleted and then eventually we will land on
this shell called Solectron they exploit.
And let's check if it works.
And saving the final.
This is the command to explain the program.
Let's type it.
There you go.
Great.
They exploit work and they got a shell.
I like this demo of using wrapper to get an address from the binary and then use it in our exploit to
relax the execution from our IP to our specific instruction and from there to our nevzlin.
I hope you enjoyed this video and I hope you like this technique.
That's all for this video.
See you in the next one.